Sunday, October 15, 2017

Port Redirection with RINETD to HTTP and Remote Desktop Protocol servers


- Layout for this exercise:

1 - Introduction

rinetd redirects connections from one IP address and port to another with basic IP based access control.

- rinetd is a single process server which handles any number of connections to the address/port pairs specified in the file /etc/rinetd.conf

- Since rinetd runs as a single process using nonblocking I/O, it is able to redirect a large number of connections without a severe impact on the machine. 

- This makes it practical to run services on machines inside an IP masquerading firewall.

2 - Port redirection to HTTP server

- Installing the service rinetd at the Kali Linux machine:

- Editing /etc/rinetd.conf:

- The configuration parameters are:

bindadress          = (Kali Linux)
bindport               = 3333 (redirected port at Kali Linux)
connectaddress  = (CentOS where the HTTP server is enabled)
connectport         = 80 (HTTP port at CentOS)

- Restarting the service rinetd:

- Now, connecting normally to (port 80) the Apache Server home page at Kali Linux is displayed:

- However, when connecting to port 3333 ( there is a redirection to the Apache Server located at CentOS Linux machine:

- Running netstat at Kali Linux, the redirected connection from Kali Linux local port 3333 to remote CentOS port 80 is displayed:

- It is interesting to notice that the CentOS Linux HTTP server does not have any news from its "hidden client" Windows 7 (, because the only "connection" to its port 80 detected by netstat  is the one coming from the proxy Kali Linux (

3 - Port redirection to Remote Desktop Protocol server

- Editing again /etc/rinetd.conf:

- The configuration parameters are:

bindadress          = (Kali Linux)
bindport               = 5555 (redirected port at Kali Linux)
connectaddress  = (Windows Server 2008 where RDP server is enabled)
connectport         = 3389 (RDP port at Windows Server 2008)

- Restarting the service rinetd:

- Connecting from Windows 5 with RDP to Kali Linux trough port 5555:

- Authenticating:

- The RDP connection to (Windows 2008) is successful, but let's notice that the connection is being redirected trough (Kali Linux Machine):

- Running netstat at Kali Linux, the redirected connection from local port 5555 to remote port 3389 is displayed:

- Interestingly, running netstat shows that  Windows 2008 is totally unware of the "hidden client" Windows 7 ( that originated and actually is taken advantage of the RDP connectionIn other words, the only connection detected by Windows 2008 is from the proxy Kali Linux (