.. /Tunna
Star

Access

Tunna is a set of tools for tunneling TCP traffic over HTTP, pairing a Python client (proxy.py) with a server-side component (ASPX, PHP, JSP or ASP) uploaded to a compromised web application server. It can tunnel traffic outbound through packet-inspecting firewalls, and the same mechanism works anywhere a web shell could be deployed. Tunna is the predecessor to the project’s own reGeorg.

Paths:

Resources:

Detections:

Access

  1. Runs the client on the operator host, forwarding a local port through the uploaded server-side component on the compromised web application server.

    python proxy.py -u <REMOTE_URL> -l <LOCAL_PORT>
    Use case
    Tunneling RDP, SSH or another TCP service through a compromised web application server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Variant tuned for tunneling RDP traffic, with an adjusted buffer size.

    python proxy.py -u <REMOTE_URL> -l <LOCAL_PORT> -r <RDP_PORT> -b 8192
    Use case
    Tunneling RDP through a compromised web application server.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS