The previous article discussed blocking Tor. Using Tor, we can easily bypass firewall protection. However, there is a much more dangerous use case: leveraging Tor’s capabilities to tunnel other traffic into Tor networks. See the example below.
I have two virtual machines (VMs) located in completely different infrastructures: one in Azure and the other in my private data center lab. Both machines have the capability to connect to Tor networks. To modify the default Tor behavior and enable traffic tunneling, we need to adjust the configuration. The Tor configuration file, torrc, is located in: C:\Users\pzwierzynski\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor. I added the following lines to the file:
HiddenServiceDir C:\Users\pzwierzynski\Desktop\Tor Browser\Browser\TorBrowser\hiddenService
HiddenServicePort 80 127.0.0.1:3389 The first line creates a Tor browser onion address, which becomes visible in the specified directory under the hostname file:
qurbadqamqcquw7z37eikadammv3xbvdk7rekg6dtbjr6xruzxkggayd.onion
The second line redirects connections from the onion address on port 80 to localhost on port 3389, the default port for RDP connections.
On the second machine, I added the following line to the torrc file:
SockSPort 127.0.0.1:9050This opens a local socket on port 9050, redirecting traffic to the Tor tunnel.
To establish an RDP connection, I used a more advanced RDP client than Windows default. Parallels Client offers additional capabilities. I configured the RDP connection as follows:
- Connection tab: RDP connection to the onion address on port 80.
- Network tab: Connection redirected through a proxy, which is Tor
As a result, using the Tor network, I successfully connected remotely to a machine located in a completely different network.
I recorded my test to better demonstrate Tor’s capabilities:
Using Tor, firewall protection can be bypassed, but Tor can also serve as a channel for remote access to your infrastructure. Threat actors can exploit such capabilities, making it crucial to block Tor completely.