Talha Asghar iamtalhaasghar

Circumventing Deep Packet Inspection with Socat and rot13

I have a Linux virtual machine inside a customer's private network. For security, this VM is reachable only via VPN + Citrix + Windows + a Windows SSH client (eg PuTTY). I am tasked to ensure this Citrix design is secure, and users can not access their Linux VM's or other resources on the internal private network in any way outside of using Citrix.

The VM can access the internet. This task should be easy. The VM's internet gateway allows it to connect anywhere on the internet to TCP ports 80, 443, and 8090 only. Connecting to an internet bastion box on one of these ports works and I can send and receive clear text data using netcat. I plan to use good old SSH, listening on tcp/8090 on the bastion, with a reverse port forward configured to expose sshd on the VM to the public, to show their Citrix gateway can be circumvented.

Rejected by Deep Packet Inspection

I hit an immediate snag. The moment I try to establish an SSH or SSL connection over o

	#!/usr/bin/python
	#
	# Based on answer from
	# http://stackoverflow.com/questions/1420426/calculating-cpu-usage-of-a-process-in-linux
	#

	from time import sleep
	import os
	import os.path
	import sys

	#!/bin/bash

	# Import Live Database
	#
	# This bash script will import the live catalog database into your local catalog db.
	# You can choose to only dump the table structure, all the data,
	# or you can specify exactly which tables you wish to import.
	#
	# Simply run `bash import-live-db.sh` and you will be prompted with what to do
	#

	[Unit]
	Description=ZooKeeper Service
	Documentation=http://zookeeper.apache.org
	Requires=network.target
	After=network.target

	[Service]
	Type=forking
	User=zookeeper
	Group=zookeeper

	#!/bin/sh

	WEBHOOK_URL="put your url here"
	PING="<@put your user id here>"
	MESSAGE="$PING reminder"
	JSON="{\"content\": \"$MESSAGE\"}"

	curl -d "$JSON" -H "Content-Type: application/json" "$WEBHOOK_URL"

	#!/bin/bash
	## Author: Jeff Higham <[email protected]>, <[email protected]>
	## Gist: https://gist.github.com/jeffhigham-f3/3b94d508269e614f1f2e701ada8239cc
	##
	## Usage: mysqlbackup
	##

	## BEGIN EDITING

	# timestamp for backups

	$ # Use Live CD to boot
	$ sudo su # Switch to root
	$ fdisk -l # Get names of root, boot & EFI partition names. you can also use blkid

	$ # http://dadadom.de/2020/04/11/fix-fedora-uefi-boot-with-encrypted-partitions/
	$ udiskctl unlock -b /dev/nvme0n1p6 # unlock root luks partition
	$ mount /dev/mapper/fedora_fedora-root /mnt # mount root partition
	$ mount /dev/mapper/fedora_fedora-var /mnt/var

	$ mount /dev/nvme0n1p5 /mnt/boot # mount boot partition