.. /Packetriot
Star

Access
Exfiltration

Packetriot (pktriot) is a tunneling service that exposes local HTTP, TCP and UDP services behind NAT or a firewall to the internet through Packetriot edge servers, reachable via assigned *.pktriot.net hostnames (edge servers use *.packetriot.net) or a custom domain. It has been observed being abused by threat actors, including in XWorm campaigns, to expose command-and-control and internal services without configuring port forwarding.

Paths:

Resources:

Detections:

Access

  1. Starts the Packetriot client using the configured tunnel, exposing the local service to the internet through a Packetriot edge server. The client is authenticated with an account token and the edge host is assigned as a *.packetriot.net address.

    pktriot start
    Use case
    Quick execution of Packetriot to expose a local service.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Forwards a public TCP port on the Packetriot edge to a local service such as SSH, giving remote access to a host behind NAT or a firewall.

    pktriot tunnel tcp --destination 127.0.0.1 --dport 22
    Use case
    Maintaining remote access to an internal host.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

Exfiltration

  1. Exposes a local HTTP service listening on port 8080 through the Packetriot edge, returning a public *.pktriot.net URL.

    pktriot http 8080
    Use case
    Exposing a local web service over the internet for access or data exfiltration.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS