Hacking or Getting Around Proxy Servers At work?

[SLAG]

this is in theory


Proxy server called "Blue Coat" - www.bluecoat.com -

How would I go about getting around it?

Now it seems just like an HTTP proxy as i can still run CMD and do an ftp command from the console. Email Ports are working and functional.


How to get around the "Blue Coat"

[unlurking]

http://www.tartarus.org/~simon/putty.../x86/putty.exe

Putty is a GUI SSH client that does not install. Just execute the binary and off you go.

[StcChief]

Originally Posted by unlurking

http://www.tartarus.org/~simon/putty.../x86/putty.exe

Putty is a GUI SSH client that does not install. Just execute the binary and off you go.

Putty is a good free product for server level access.

[SLAG]

Too Bad my Microsoft Thumb Drive Has not Arrived Damnit Bill

[SLAG]

I found this at the bottem of some page--

Note: Using port forwarding with FTP (Port 21) only tunnels/forwards the initial command channel, the second data channel that FTP uses even under passive mode will not be tunneled and therefore tunneling/forwarding FTP connections to bypass the security perimeter WILL NOT work.

I wonder if just ssh 22 is open?

I am also getting this error once i start ssh back up after editiing my sshd_config -

Starting SSH daemon/etc/ssh/sshd_config line 13: Badly formatted port number.
startproc: exit status of parent of /usr/sbin/sshd: 255

any ideas?

[Boozer]

Originally Posted by SLAG02

any ideas?

Tell you employer you're going to work for his competitor if he doesn't uncripple your Internet access. If he lets you walk, you probably shouldn't be spending so much time surfing the web at work.

[unlurking]

DOH!!!

My bad, sorry!

You actually need one line for every port, so...

Port 22
Port 23
Port 25
Port 389

etc.

Sorry 'bout that. Got apache stuck in my head where you can define multiple ports using commas.

And yes, FTP uses 2 ports, 21 for control and 22 for data. Also, they are both UDP, and HTTP is TCP. Even if you change ports, the firewall will not let it through, as it is only letting UDP through over 21 and 22.

[unlurking]

Originally Posted by Boozer

Tell you employer you're going to work for his competitor if he doesn't uncripple your Internet access. If he lets you walk, you probably shouldn't be spending so much time surfing the web at work.

[Onion_Knight]

Originally Posted by unlurking

DOH!!!


And yes, FTP uses 2 ports, 21 for control and 22 for data. Also, they are both UDP, and HTTP is TCP. Even if you change ports, the firewall will not let it through, as it is only letting UDP through over 21 and 22.

FTP is tcp based and uses TCP 20, and 21.
http://www.faqs.org/rfcs/rfc959.html
http://www.networksorcery.com/enp/protocol/ftp.htm

TFTP is UDP based and uses UDP 69.
http://www.networksorcery.com/enp/protocol/tftp.htm
http://www.faqs.org/rfcs/rfc1350.html


SSH utilizes port 22 TCP

[SLAG]

Originally Posted by Onion_Knight

FTP is tcp based and uses TCP 20, and 21.
http://www.faqs.org/rfcs/rfc959.html
http://www.networksorcery.com/enp/protocol/ftp.htm

TFTP is UDP based and uses UDP 69.
http://www.networksorcery.com/enp/protocol/tftp.htm
http://www.faqs.org/rfcs/rfc1350.html


SSH utilizes port 22 TCP

Interesting Info, Thanks, Welcome to the Planet,


I also found out that there are static I.P.'s that are going to be Immune to the bluecoat restrictions, I found a list of the unrestricted IP. Address along with all the correct DNS, WINS's Server information


Does this change the plan of the Hypothetical Attack

[Onion_Knight]

Originally Posted by SLAG02

Interesting Info, Thanks, Welcome to the Planet,


I also found out that there are static I.P.'s that are going to be Immune to the bluecoat restrictions, I found a list of the unrestricted IP. Address along with all the correct DNS, WINS's Server information


Does this change the plan of the Hypothetical Attack

Most likely, These would be servers that depend on updates. I would recommend running a couple traceroutes through your network. Find out which route your normal network traffic goes through, and try and find out which route your HTTP traffic routes through. Its most likely that your gateway router has acls to redirect you to the web proxy if your using certain ports or services. The idea is to find out what traffic you can use to get out w/out restrictions. The next step would try and track down a tunneling program that is port configurable to an outside machine that retrieves your HTTP traffic as text and rebuilds the session on the box. That or start getting to know UPS and USPS.

[htismaqe]

FYI, most current firewalls can detect FTP data spoofing on TCP 21.

Use a different port...

[Onion_Knight]

I wouldn't recommend doing it all. I think its an easy way to lose your job. In fact, if you spent all this time working, that you have trying to circumvent the rules, they most likely never would have spent the money on the proxy.

They most likely have logs that look for any connection going outbound to IP addresses that they've blacklisted.

Your best chance to do get away with it is to use encrypted channels utilizing ports higher than 1024 and most likely higher than 6500. Don't use backup http ports 80-88, 8080-8088, or 443. Don't use SOCKS ports for that matter as well.

I'd try and use persuasion...

Here's a recent article on web surfing at work...show it to your bosses...try and get some feedback on at least getting a few websites returned.

http://www.msnbc.msn.com/id/12462332/

[SLAG]

ok... after today's day on the job I am Determined to get around the proxy server... .my best bet seems to tunnel x11 over PuTTY,

This is where i am stuck, I have added all those ports to the sshd config file, now sshd starts fine, nmap dosent seem to be a reconized command, I cannot connect to the PC from my laptop on MY LAN... any other tips or suggestions, i ran some traceroutes and netstats as well i think i know the ip address of the Proxy or of the gateway, login.oscar.aol.com port 5190 is open to connect to AIM using lotus, but if i go to the web browser and type in login.osacr.aol.com i get nowhere.


This is more than hacking to browse the net or chiefs planet... this is personal

[SLAG]

Ok i can log in remotley ( havent tested work yet... ) into linux from my XP box using putty..

when i try to throw the command

  startx

from putty i get this error...

Fatal server error:
Server is already active for display 0
        If this server is no longer running, remove /tmp/.X0-lock
        and start again.


When reporting a problem related to a server crash, please send
the full server output, not just the last messages.
Please report problems to http://www.suse.de/feedback.

Xlib: connection to ":0.0" refused by server
Xlib: Invalid MIT-MAGIC-COOKIE-1 key
giving up.
xinit:  unable to connect to X server
xinit:  No such process (errno 3):  Server error.

any suggestions?

[SLAG]

ok i'm at work now and it looks as ssh was/is open--- now if we can get past that error message -- thanks chiefs planet You rock