3

I have a firewall, which only forwards HTTP requests, and only if the request is pointing to something in a /admin/ folder, so it only lets through requests like this:

http://www.anysite.com/admin/anyfile.file

I can bypass this and view any site with a PHP Proxy (web proxy, using this: php-proxy.com) in a /admin folder on a webserver, but it only works through the web browser.

Is there any way to create any kind of tunnel (VPN, SOCKS proxy etc.) that can use this folder to route any traffic trough?

  • Why does it only work with the browser? That seems to be the important question. – schroeder Oct 15 '16 at 10:32
  • @schroeder because im using this php web proxy: php-proxy.com – xdavidhu Oct 15 '16 at 10:43
  • I'm confused. My first reaction is to then upload another type of proxy to the folder that provides the services you need. Did I miss something?\ – schroeder Oct 15 '16 at 11:04
  • @schroeder yes, but the problem is that I only can find proxy-s witch use just a port to connect. But i need to connect to it 'trough a subfolder' to bypass the firewall. So the problem is that i cant find anything that can open a vpn/socks-proxy connection using a http 'url', cause i need to route it over the admin subfolder. – xdavidhu Oct 15 '16 at 11:23
  • Similar but probably not a duplicate Working of SSH connection through Proxy, still it is very likely you can use that. Yet you do not say what you use, that is not a web browser, that is not proxy aware. – grochmal Oct 15 '16 at 11:38
3

TL;DR That proxy does not allow for tunneling. And you have a firewall that parses the HTTP requests, likely to disallow HTTP tunneling altogether. You're pretty much limited to GET and POST.

Since you can resolve DNS, and IPsec VPN on port 53 may be a good alternative.


php proxy is not a standard general proxy. In other words it does not follow (general) proxy standards (HTTP CONNECT or SOCKS), it simply is an HTTP proxy for GET and POST requests. It is not a full HTTP proxy implementing HTTP CONNECT which would allow for tunneling connections and bypassing a firewall.

In the code php proxy uses CURL, more exactly curl_exec, as follows:

$result = @curl_exec($ch);

// there must have been an error if at this point
if(!$result){
    $error = sprintf('(%d) %s', curl_errno($ch), curl_error($ch));
    throw new \Exception($error);
}
// we have output waiting in the buffer?
$this->response->setContent($this->output_buffer);

// saves memory I would assume?
$this->output_buffer = null;

Even if you send an HTTP CONNECT the proxy will return to you the response to that and close the connection, which is not how HTTP CONNECT works.

That is not to say that CURL cannot work with HTTP CONNECT, it can, but not through PHP curl_exec.

All that said. You have a stateful firewall that analyses HTTP headers (since it only allows for /admin/ only). I highly doubt that the firewall will allow you to send an HTTP CONNECT in the first place. In other words, if the firewall rejects this (note the typo):

GET /typo-in-amdin/somehting HTTP/1.1

Then I do not believe it will allow:

CONNECT /admin/somewhere HTTP/1.1

Since it would fail on the same regex match. And since your firewall only allows HTTP through (and parses it) you cannot use other protocols, e.g. VPN on posrt 80.


Extra (more optimistic) note

One thing that strikes me is that you can resolve DNS. Therefore the firewall must allow UDP packets on port 53.

And, unless you are using an internal DNS server (and so the DNS resolution is not passing through the firewall), you can get around the HTTP header limitation by running a VPN in udp mode (IPsec) and "connect" to port 53. That will tunnel your traffic, and will look to the firewall as DNS requests and responses.

  • yeah, (upvote, i dont have 15 rep yet :D) so in theory, i can use openvpn because it has a HTTP CONNECT proxy type connection. but i can't find any option to set a path for it to use the '/admin/' here. And yeah, the DNS is not suitable. its only port 80 and /admin/. – xdavidhu Oct 15 '16 at 13:01
  • 1
    @xDavid - actually openvpn does a plain TLS connection, but it has the http-proxy configuration to make the HTTP CONNECT hop. What really kills you is that all your outgoing TCP connections must start with ^(GET|POST)\s/admin/, and there isn't really a trivial way to get around that. (You could write a webserver that will keep the state of your connections on the server side, and talk to it with a false GET /admin/<connection-id>\r\n<actual data>, but that is a lot of work) – grochmal Oct 15 '16 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.