Redirectors
A redirector is essentially a relay server that sits in between the attacker and the victim machine. When the attacker sends a command to the redirector, it forwards the command to the victim machine. Similarly, when the victim machine sends data back to the attacker, it goes through the redirector, which then forwards the data to the attacker.
A redirector helps us to evade the blue team and ensure that we burn the redirector instead of other parts of our infrastructure that potentially take longer to setup (Phishing server, C2, etc.)
The "Dumb" Redirector
Socat functions as a "dumb redirector" in the sense that they listen on the specified network interface and port, forwarding all traffic received to a listener port on the team server.
This doesn't provide the greatest hardening for our attack infrastrucutre and may lead to our infrastructure getting burned faster than we anticipated. The following command can be used to setup a dumb redirector with Socat:
Additionally, we can also configure a dumb redirector by using IPTABLES as demonstrated in the following command:
Getting Smart (Redirector)
When setting up infrastructure for a red team operation, I would recommend going the smarter route and leveraging the .htaccess file and Apache's mod_rewrite.
When writing custom rules for your redirector, I would recommend the following blog post:
Additionally, the below is an excerpt from that blog post on example rules to be placed in .htaccess. This ensures that only requests made with the specific HTTP_USER_AGENT specified will be forwarded to your team server, all other traffic will be redirected.
References
Last updated
