Topic

[WireSock] Can’t tunnel cmd or powershell using AllowedApps

Viewing 7 posts - 1 through 7 (of 7 total)
  • Author
    Posts
  • August 25, 2022 at 9:01 pm #12319
    Plankton
    Participant

    [Interface]
    PrivateKey =
    Address = 192.168.100.2/24
    DNS = 192.168.100.1, 192.168.101.1
    [Peer]
    PublicKey =
    PresharedKey =
    Endpoint = domain:51820
    AllowedIPs = 0.0.0.0/0, ::0/0
    AllowedApps = chrome.exe, cmd.exe, powershell.exe

    As you can see above, I’m trying to tunnel only Chrome, Command Prompt, and Powershell using AllowedApps to my Wireguard server using WireSock. But while Chrome gets tunneled just fine, neither CMD nor Powershell gets tunneled. I’ve even tried adding conhost.exe and explorer.exe to AllowedApps (since those are parent processes to cmd and powershell) but that didn’t make a difference.

    The only time I’ve been able to successfully tunnel CMD and Powershell traffic is by straight-up removing AllowedApps and tunneling every application. But tunneling specific applications is the whole reason I’ve been trying to use WireSock.

    Can you please tell me what I’m doing wrong?

    August 26, 2022 at 12:04 pm #12320
    Vadim Smirnov
    Keymaster

    I just did a quick powershell test with the command line below, and it was correctly intercepted and redirected through the tunnel:

    Invoke-WebRequest "http://www.wiresock.net/downloads/wiresock-vpn-gateway-x64-1.0.31.1.msi" -OutFile "wiresock-gateway-x64.msi"

    I suspect you are expecting child processes launched from cmd or powershell to be tunneled. Note, however, that these child processes have different names and are therefore skipped by the filter. Of course, it is possible to extend the filter for child processes, but initially, I had no such intention.

    August 26, 2022 at 1:18 pm #12321
    Plankton
    Participant

    Ah ok. Here’s the only reason why I want to tunnel cmd or powershell: Since I installed WireSock as a Service, I want to have a constant ping going to some remote server so I can see at a glance whenever WireSock is tunneling my traffic.

    Is there some way for me to tunnel just ping commands? I tried doing this but it didn’t help:

    AllowedApps = chrome.exe, cmd.exe, powershell.exe, ping.exe

    August 26, 2022 at 1:33 pm #12322
    Vadim Smirnov
    Keymaster

    The Windows API only allows you to get the process context for the TCP and UDP protocols. So, ping.exe sending ICMP packets cannot be resolved and therefore not tunneled.

    The simplest alternative would probably be a simple UDP based pinger, which can be easily implemented in Golang.

    August 26, 2022 at 1:49 pm #12323
    Plankton
    Participant

    Would this work?

    Test-NetConnection google.com -Port 80

    August 26, 2022 at 2:32 pm #12324
    Vadim Smirnov
    Keymaster

    Yes, if you add “powershell” to AllowedApps then this request will be tunneled.

    August 26, 2022 at 5:28 pm #12325
    Plankton
    Participant

    Great, thank you so much for your help

  • Author
    Posts
Viewing 7 posts - 1 through 7 (of 7 total)
  • You must be logged in to reply to this topic.