SSH Tunneling via HTTP CONNECT Proxy

This project demonstrates how to establish an SSH connection through an HTTP CONNECT proxy. It consists of three main components:

1. SSH Server: A simple SSH server that accepts connections and executes commands
2. HTTP Proxy: A proxy server that handles CONNECT requests and tunnels traffic
3. SSH Client: A client that connects to the SSH server through the HTTP proxy

Components

SSH Server (ssh_server.go)

The SSH server listens on port 2222 and accepts connections without authentication (for demonstration purposes only). It can execute shell commands sent by clients and return their output.

Key features:

• Listens on localhost:2222
• No authentication required (PoC only)
• Executes bash commands and returns their output
• Uses a hardcoded RSA key for simplicity

HTTP Proxy (http_proxy.go)

A simple HTTP proxy that supports the CONNECT method, allowing tunneling of arbitrary TCP connections through HTTP.

Key features:

• Listens on port 8080
• Handles HTTP CONNECT requests
• Establishes connections to requested destinations
• Provides bidirectional data transfer

SSH Client (client.go)

Demonstrates how to establish an SSH connection through the HTTP proxy and execute commands on the SSH server.

Key features:

• Connects to the HTTP proxy on localhost:8080
• Sends a CONNECT request to establish a tunnel to the SSH server
• Creates an SSH session through the tunnel
• Executes commands and displays their output

How It Works

1. The SSH server starts and listens for connections on port 2222
2. The HTTP proxy starts and listens for connections on port 8080
3. The client connects to the HTTP proxy and sends a CONNECT request
4. The proxy establishes a connection to the SSH server
5. The client performs SSH handshake through the proxy tunnel
6. The client sends commands to be executed on the server
7. The server executes the commands and returns the output

Usage

Start each component in a separate terminal:

1. Start the Docker Compose Environment

docker-compose up -d

This will start all three containers: ssh-server, http-proxy, and ssh-client.

2. Execute Commands Through the SSH Tunnel

You can execute commands on the SSH server through the HTTP proxy tunnel using the client:

# Connect to the ssh-client container
docker exec -it ssh-tunneling-via-http-connect-proxy-ssh-client-1 /bin/sh

# Run the SSH client with a specific command
/bin/ssh-client -cmd "ls -la"

You can replace "ls -la" with any bash command you want to execute on the SSH server.

3. Testing Different Commands

Here are some example commands you can try:

# Check system information
/bin/ssh-client -cmd "uname -a"

# View running processes
/bin/ssh-client -cmd "ps aux"

# Check network configuration
/bin/ssh-client -cmd "ip addr"

# Create and read a file
/bin/ssh-client -cmd "echo 'Hello from SSH tunnel' > test.txt && cat test.txt"

4. Monitoring the Connection

You can view the logs of each component to understand what's happening:

# View SSH server logs
docker logs ssh-tunneling-via-http-connect-proxy-ssh-server-1

# View HTTP proxy logs
docker logs ssh-tunneling-via-http-connect-proxy-http-proxy-1

5. Shutting Down

When you're done experimenting, shut down the environment:

docker-compose down

This will stop and remove all containers created for this demonstration.