Port forwarding from VM , Docker or WSL2 to host Windows 10 or 11 to allow remote access.

 

If you need to bypass NAT restriction on WSL or if you have a Virtual Machine that is NAT only in VirtualBox or VMware you can use these command on the host OS to enable port forwarding from the Host to the nested virtual machines.

Scenario,

HOST OS: windows 10 IP address 192.168.69.129

VM Ubuntu: on WSL2 IP address: 172.25.187.188

We have a Ubuntu box running on windows 10 WSL2, we have started a simple http server using python3 on port 9000, to allow this port access from the Host lan, we can use some of the netsh to expose that port to the wider network.

Now we need to proxy the port via the host to connect it to the VM running on WSL.

Below commands must be Run as administrator in Command Prompt

netsh interface portproxy add v4tov4 listenport=9000 listenaddress=192.168.69.129 connectport=9000 connectaddress=172.25.187.188

Now we need to enable this port via windows advance firewall:

netsh advfirewall firewall add rule name= "Open Port 9000" dir=in action=allow protocol=TCP localport=9000

Note 

This command will live after a reboot, so it is important to make sure you reset the port proxy sittings 

To see what ports you have enabled 

netsh interface portproxy show all 

To reset all ports 

netsh interface portproxy reset

Conclusion

This above trick can also be used during security assessment, In some situation you might land on a machine that is multi homed networked, meaning it has access to 2 networks, so this is a good way to proxy the port so you can remote access to it.

It can also be used in the cloud so you can redirect the traffic via another public IP. Example would be is you are in need of whitelisting, then you can use a windows VM running on a cloud provider that is then whitelisted at the client end, from home now you can connect to that port on the public IP of the VM you have in the cloud, that will then redirect you to the destination network.

SONICWALL TOTP MFA bypass due to misconfiguration

 

SONICWALL TOTP MFA bypass due to misconfiguration

Client of an organization called us asking how to resolve an issue that was suspected a 0 day vulnerability trying to figure out how someone bypassed MFA TOTP tokens, found out that they had 2 user’s groups, 1 calling LDAP the other are directly on the firewall. So when the user changed the name from the exact lower cases to anything like smith to sMiTh the firewall treated as 2 users with the 2^nd bypassing the TOTP 2FA that would have been for that user.

All this was due to 2 distinct VPN groups assigned to a VPN interface at the same time one calling local accounts with TOTP enabled and the 2^nd calling LDAP group vpnusers on the DC with no MFA TOTP option. Window server DC ignores Caps so it treats any name as lower cases, but not the firewall.

So these guys did everything right and still someone bypassed a security control measures due a misconfiguration that is not so obvious.

https://www.sonicwall.com/support/knowledge-base/how-do-i-configure-2fa-for-ssl-vpn-with-totp/190829123329169/