Multitun – Tunnel arbitrary traffic through an innocuous WebSocket(github.com)
github.com
Multitun – Tunnel arbitrary traffic through an innocuous WebSocket
https://github.com/covertcodes/multitun
7 comments
The IV doesn't start as zero; it starts as a random number.
Oh, you are correct. It's chosen by the client here:
https://github.com/covertcodes/multitun/blob/master/multitun...
https://github.com/covertcodes/multitun/blob/master/multitun...
This looks pretty cool, but why not just run sshd on port 80/443 then use corkscrew[1] to tunnel through an http proxy?
[1] http://www.agroman.net/corkscrew/
[1] http://www.agroman.net/corkscrew/
To bad that networks/proxies usually block websocket connections causing this solution to fail.
Based on a quick skim:
* no kdf on the password, just SHA-2-224(password)
* uses the same key and iv (which always starts as 0) in both directions
* uses CFB mode without a MAC, which has malleability issues (IIRC you can flip bits in a ciphertext block, and the same bits will be flipped in the plaintext, but the rest of the stream will be garbage).
* the authentication used is pretty sketchy (the key is fixed at 16 bytes and PW_LEN 15, so ljust shouldn't be doing anything):
Reminds me of this: https://www.cs.auckland.ac.nz/~pgut001/pubs/linux_vpn.txt