Hacker News Reader

Comment by occultist_throw | Hacker News Reader

Then I would encourage you to try this tool (0) and then respond with your updated opinions.

Abstract:

     pwnat, pronounced "poe-nat", is a tool that allows any
     number of clients behind NATs to communicate with a
     server behind a separate NAT with *no* port forwarding
     *no* DMZ setup, and *no* 3rd party involvement. The server
     does not need to know anything about the clients trying
     to connect.

(0) https://samy.pl/pwnat/

View on HN

That is an awesome tool, but it requires a cooperating server inside your NAT; for security-breaching purposes, if you've got code execution on a machine inside the firewall, you've already won (against the firewall, anyway).

Well, indeed. But Im thinking that it could be done with a webapp and Websockets.

In other words, get sent to a domain that initiates the knock sequence. Other machine in waiting responds, and NAT traversal takes over, to any machines inside NAT.

The only real question is how much code is actually required to start this.

Web code is only allowed to send TCP packets (websockets go on port 80 by default, just like HTTP). It also doesn't allow crafting special packets. pwnat's method relies on being able to send ICMP and UDP, which the browser won't.

I didn't thank you for your response. I looked further in, and was mistaken - I thought that it allowed a bit more as in TCP and UDP. I was wrong.

So yes, it looks like some sort of further in-depth hackery would be required, or planting some sort of SBC in the building on the network. It's quite a bit more infeasible than I had initially thought.

Reply on news.ycombinator.com