Client Configuration Guide

Windows v2.1

This document is designed to quickly get you up and running on Microsoft Windows with the free KiTTY SSH client.

TELESPLOIT

December 1, 2017

Overview

The Telesploit solution consists of three distinct parts: the Telesploit server, the Telesploit relay, and an SSH capable client.

Telesploit Server

The server runs a customized version of Kali Linux and is deployed within the target environment. Once network connectivity and power have been applied to the device, it will automatically connect to the relay server and create TLS encapsulated reverse SSH tunnels in its default configuration. These connections provide access to a command line interface (SSH), remote desktop (VNC), web proxy (Squid), and many other applications on the Telesploit server.

Telesploit Relay

The relay runs in the cloud and provides secure access to the Telesploit server from Internet-connected clients using SSH key-based authentication. The relay includes pre-configured IRC and Mattermost servers for team-based communication and collaboration.

Client

The client connects to the Telesploit server via the relay. Penetration testing tools, such as Metasploit, can then be run directly from the server within the target environment or proxied through the established connections.

Client Setup

KiTTY Portable Download and Setup: Download KiTTY Portable from http://www.9bis.net/kitty/. Place the program kitty_portable.exe in its own directory and run it. This will create several files and subdirectories. Close the application.

Telesploit will provide a URL to download the customized configuration files for connecting to your dedicated relay and server.

Example: https://relay-d015.telesploit.com/

b58e067ac6b7666cfbc539a4980363cc6c6cea55269916aa0285b82f2bbc4769/kitty.zip

The integrity may be validated by performing a sha256sum on the file. The value should match the subdirectory name in the URL.

CertUtil -hashfile kitty.zip SHA256

If the checksums match then place the archive, kitty.zip, in the same directory as kitty_portable.exe and unzip it. The file telesploit-readme.txt should appear in the directory and three new files will be added to the Sessions subdirectory.

Reopening the application should reveal three new entries, Telesploit-Relay-SSH, Telesploit-Relay-SSL, and Telesploit-Server.

Load each session and specify the private key that corresponds to the public key provided to Telesploit during the pre-deployment process.

Return to the Session tab and select Save. Perform this action on all three sessions.

Telesploit-Relay-SSH

This configuration uses a direct SSH connection to the relay server to establish tunnels for accessing SSH, VNC, and Squid and SOCKS proxies running on the server. It also creates tunnels to access the IRC and Mattermost instances running on the relay.

Telesploit-Relay-SSL

This configuration creates an SSL/TLS connection to the relay server in order to establish tunnels for accessing SSH, VNC, and Squid and SOCKS proxies running on the server. It also creates tunnels to access the IRC and Mattermost instances running on the relay. Use this configuration when outbound SSH is restricted from your environment. It requires that ncat, part of the nmap suite, be installed on the local client.

Telesploit-Server

Once tunnels have been established to the relay this configuration may be used to establish console access on the server.

The readme.txt file contains the server, relay, and port assignments for your Telesploit deployment. These should be used to replace the examples given in the subsequent sections.

Establish SSH Tunnels and Connect to the Server

Once the KiTTY client has been configured for your environment, verify that you can create SSH tunnels to the relay by opening either Telesploit-Relay-SSH or Telesploit-Relay-SSL.

The first time you connect to the relay server, KiTTY will pop-up a security alert indicating that the host key hasn’t been cached.

If you are connecting from a trusted environment, accept the relay fingerprint and enter the passphrase for your private key.

The session window will appear to hang, but the tunnels will have been established. Minimizing the window will not have an effect on your connection. Closing the window will teardown the tunnels.

With the tunnels established, open another instance of KiTTY and select Telesploit-Server. The first time you connect to the server you will receive another security alert. If you are connecting from a trusted environment, accept the server fingerprint and enter the passphrase for your private key. You should now have a console session on the server.

Common Tool Configuration

Please note that the SSH, VNC, Squid, and PostgreSQL services provided on the Telesploit server have been configured to only listen on localhost. If you install any additional services, such as Nessus, and do not want them to be exposed to the testing environment, then restrict their access as well.

The following sections assume that you have configured the Telesploit client and established the required SSH tunnels.

Command Line Interface

Your SSH client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment.

Example SSH Configuration

  • Host: localhost (127.0.0.1)
  • Username: root
  • Password: N/A
  • Private Key: Your SSH private key
  • Port: 13015

Note: As with any remote console, Telesploit recommends using a detachable session, such as screen, for long-running processes.

Remote Desktop

Your VNC client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment.

Example VNC Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password: telesploit
  • Port: 23015

You will be prompted to enter the VNC password. As the VNC server is only listening on localhost, and connectivity requires SSH key authentication, this password is superfluous and has thus been set to ‘telesploit’ for all deployments.

Web Proxy

Your browser and web application assessment tools of choice (e.g. Chrome, Edge, Burp Suite, Zap) may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment.

Example Web Proxy Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password:
  • Port: 33015

Web applications within the target environment can then be accessed by entering their IP address or Fully Qualified Domain Name along with the port they are running on just as if you were testing from the local network.

File Transfer

In addition to command line utilities, such as scp, file transfer tools like FileZilla may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment.

Example File Transfer Configuration

  • Host: localhost (127.0.0.1)
  • Username: root
  • Password: N/A
  • Private Key: Your SSH private key
  • Port: 13015

To configure the application to use your SSH private key select Edit -> Preferences -> SFTP -> Add key file. Enter ftp://localhost in the Host field, leave the password blank to force key-based authentication, and enter the SSH port number assigned to your deployment in the Port field.

Internet Relay Chat

The Telesploit relay has an IRC server built in and both the client and server create SSH tunnels to communicate with it. Your IRC client of choice may be used by configuring it with the following values. Adjust the port number to match your Telesploit deployment.

Example IRC Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password:
  • Port: 53015

In addition to communication between team members, the IRC server can be used to provide updates from scanners and other tools running on the Telesploit server. Dedicate a channel for the output of each discrete activity and immediately know its status without cycling through multiple consoles or screen sessions.

Collaboration

The Telesploit relay has a Mattermost instance installed and both the client and server create SSH tunnels to communicate with it. A web browser or Mattermost client may be used by configuring them with the following values. Adjust the port number to match your Telesploit deployment.

Example Mattermost Configuration

  • Host: localhost (127.0.0.1)
  • Username:
  • Password:
  • Port: 63015

The first configured user will become the Mattermost admin.

Troubleshooting

If you are unable to connect to the Telesploit server, then verify that you are able to directly connect to the relay.

If your client is configured to use an SSH connection, then try directly accessing the SSH server on the relay.

If you are using SSL/TLS proxied connections, then try accessing the SSH server through the HA Proxy running on the relay using ncat. You should see output similar to the following if nothing is blocking your access and the HA Proxy and SSH server are up.

If either of the above tests result in timeouts or no connections then verify that your outbound connections are not being blocked by a firewall or Intrusion Prevention System. Contact Telesploit support for additional assistance.