# Client Configuration Guide ## Linux/Mac v2.3 _This document is designed to quickly get you up and running on Linux or Mac using a customized client configuration._ **TELESPLOIT** November 28, 2017 --- # Overview The Telesploit solution consists of three distinct parts: the Telesploit server, the Telesploit relay, and an SSH capable client. ### Telesploit Server The server runs a customized version of Kali Linux and is deployed within the target environment. Once network connectivity and power have been applied to the device, it will automatically connect to the relay server and create TLS encapsulated reverse SSH tunnels in its default configuration. These connections provide access to a command line interface (SSH), remote desktop (VNC), web proxy (Squid), and many other applications on the Telesploit server. ### Telesploit Relay The relay runs in the cloud and provides secure access to the Telesploit server from Internet-connected clients using SSH key-based authentication. The relay includes pre-configured IRC and Mattermost servers for team-based communication and collaboration. ### Client The client connects to the Telesploit server via the relay. Penetration testing tools, such as Metasploit, can then be run directly from the server within the target environment or proxied through the established connections. --- # Client Setup Telesploit will provide a URL to download the customized scripts for connecting to your dedicated relay and server. **Example:** [https://relay-d015.telesploit.com/8b85b0fbb32c0575bc3cb21cc1af7db4eb167eed0b0d2de101bc7572363415bc/telesploit-d015-client.tar.gz](https://relay-d015.telesploit.com/8b85b0fbb32c0575bc3cb21cc1af7db4eb167eed0b0d2de101bc7572363415bc/telesploit-d015-client.tar.gz) ### Download and Extract Client Download the archive file. In this example we are accessing the Telesploit relay/server with the designation d015. Change the commands to reflect your assigned environment. ```bash curl https://relay-d015.telesploit.com/8b85b0fbb32c0575bc3cb21cc1af7db4eb167eed0b0d2de101bc7572363415bc/telesploit-d015-client.tar.gz -o telesploit-d015-client.tar.gz ``` The integrity may be validated by performing a sha256sum on the file. The value should match the subdirectory name in the URL. ```bash sha256sum telesploit-d015-client.tar.gz ``` If the checksum matches then extract the archive file and change into the newly created directory. ```bash tar -zxvf telesploit-d015-client.tar.gz && cd telesploit-client/telesploit-d015 ``` You should see the following files and directories: The readme.txt file contains the server, relay, and port assignments for your Telesploit deployment. These should be used to replace the examples given in the subsequent sections. ### Configure Client The first time you setup your client you will need to run the script `setup_client.sh`. If you are in an environment that allows outbound SSH then it is recommended that you select that option. If you will be tunneling the SSH connections through TLS then ncat (part of the nmap suite) will be required on your system. If your environment requires using a proxy for outbound TLS connections then both ncat and proxytunnels are required. The proxy information will also need to be either entered in the configuration file `client-configs/client.cfg` or interactively from within the setup script. ```bash ./setup_client.sh ``` Enter the path to the private key corresponding to the public key previously provided to Telesploit. Tab complete is enabled on this field. Choose your connection type. SSH is recommended. Direct (TLS) requires ncat to be installed while all proxy connection types require both ncat and proxytunnels. The script will then pull a file from the relay containing the SSH server's known fingerprint and compare it to a locally generated version. Matching files indicate that an active Man-in-the-Middle attack is not being performed against your connection. Enter the password for the private key corresponding to the public key previously provided to Telesploit. If you are not prompted for your password then verify the location and permissions on your private key and that you have ncat installed if using TLS or proxy connections then re-run `setup_client.sh`. You should then be returned to the command prompt. ### Establish SSH Tunnels and Connect to the Server Once the client has been configured for your environment, verify that you can create SSH tunnels to the relay by running the script `create_tunnels.sh`. You will once again be prompted for the password to your SSH private key. ```bash ./create_tunnels.sh ``` Once the tunnels have been established you can verify connectivity by connecting to the Telesploit server using the script `console.sh`. You will once again be prompted for the password to your SSH private key. If everything has been configured properly you should see a Kali Linux command prompt. ```bash ./console.sh ``` ### Disconnecting from Server and Closing Tunnels Typing 'exit' at the server command prompt will return you to your local shell. ```bash exit ``` When not performing testing, you may teardown the tunnels by running the script `kill_tunnels.sh`. You should immediately be returned to the command prompt. ```bash ./kill_tunnels.sh ``` The next time you wish to connect to the Telesploit server it is not necessary to re-run the `setup_client.sh` script, just use the `create_tunnels.sh` script to bring the tunnels back up. --- # Common Tool Configurations Please note that the SSH, VNC, Squid, and PostgreSQL services provided on the Telesploit server have been configured to only listen on localhost. If you install any additional services, such as Nessus, and do not want them to be exposed to the testing environment then restrict their access as well. The following sections assume that you have configured the Telesploit client and established the required SSH tunnels. ### Command Line Interface Your SSH client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment. #### Example SSH Configuration - Host: localhost (127.0.0.1) - Username: root - Password: N/A - Private Key: Your SSH private key - Port: 13015 Note: As with any remote console, Telesploit recommends using a detachable session, such as screen, for long running processes. This example uses the script `console.sh` included with the Telesploit client. ```bash ./console.sh ``` ### Remote Desktop Your VNC client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment. #### Example VNC Configuration - Host: localhost (127.0.0.1) - Username: - Password: telesploit - Port: 23015 The following example uses the Remmina Remote Desktop Client. You will be prompted to enter the VNC password. As the VNC server is only listening on localhost, and connectivity requires SSH key authentication, this password is superfluous and has thus been set to ‘telesploit’ for all deployments. ### Web Proxy Your browser and web application assessment tools of choice (e.g. Chrome, Edge, Burp Suite, Zap) may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment. #### Example Web Proxy Configuration - Host: localhost (127.0.0.1) - Username: - Password: - Port: 33015 In Firefox these settings can be found under Options -> Network Proxy -> Settings. ### File Transfer In addition to command line utilities, such as scp, file transfer tools like FileZilla may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment. #### Example File Transfer Configuration - Host: localhost (127.0.0.1) - Username: root - Password: N/A - Private Key: Your SSH private key - Port: 13015 The following example uses FileZilla. To configure the application to use your SSH private key select Edit -> Preferences -> SFTP -> Add key file. ### Internet Relay Chat The Telesploit relay has an IRC server built in and both the client and server create SSH tunnels to communicate with it. Your IRC client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment. #### Example IRC Configuration - Host: localhost (127.0.0.1) - Username: - Password: - Port: 53015 Client Configuration Guide | 11/28/2017 ### Collaboration The Telesploit relay has a Mattermost instance installed and both the client and server create SSH tunnels to communicate with it. A web browser or Mattermost client may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment. #### Example Mattermost Configuration - Host: localhost (127.0.0.1) - Username: - Password: - Port: 63015 The first configured user will become the Mattermost admin. The following example uses a standard browser to access the collaboration platform. --- # Troubleshooting If you are unable to connect to the Telesploit server, then verify that you are able to directly connect to the relay. If your client is configured to use an SSH connection, then try directly accessing the SSH server on the relay. You will not be able to successfully login with the following command, but it will validate that nothing is blocking your access and that the relay is up. ```bash ssh test@relay-d014.telesploit.com ``` If you are using TLS or proxy connections, then try accessing the SSH server through the HA Proxy running on the relay using ncat. You should see output similar to the following if nothing is blocking your access and the HA Proxy and SSH server are up. ```bash ncat -v --ssl relay-d015.telesploit.com 443 ``` If either of the above tests result in timeouts or no connections then verify that your outbound connections are not being blocked by a firewall or Intrusion Prevention System. Contact Telesploit support for additional assistance. If the tests are successful then verify that the tunnels have been created by running netstat and reviewing the output. If the tunnels have not been created then the output should look similar to the following depending on what services you have running. ```bash netstat -plnt ``` If the tunnels have been established then the output should look similar to the following, again depending on what services you have running. ```bash netstat -plnt | sort -k7 ``` If the tunnels have not been established then re-run the script `create_tunnels.sh`. If the tunnels have been established run the script `kill_tunnels.sh` followed by `create_tunnels.sh` to clear any hung connections. If you receive an error similar to the following after running `create_tunnels.sh` then the tunnels have already been established. If you receive an error similar to the following after running `kill_tunnels.sh` then there are no active tunnels to teardown. If you are still unable to create SSH tunnels to the relay then run the script `kill_tunnels.sh` followed by `setup_client.sh` before once again executing `create_tunnels.sh`. If this still fails then please contact Telesploit support.