ICMP Tunneling
ICMP tunneling encapsulates TCP traffic inside ICMP packets, usually the echo request and echo reply of ping. It is the technique you reach for when a firewall lets ping through but blocks almost everything else: ping is considered harmless and rarely filtered, so its data field becomes an outbound channel nobody watches.
Mechanism
An ICMP echo packet has a data field whose content the protocol does not examine (it exists to measure latency and size). Tunneling exploits that: the client chops up the TCP traffic and stuffs it into the data field of echo request; the server, at the other end, extracts it, forwards it to the real destination and returns the replies inside echo reply. To the network in between, it just looks like pings going back and forth.
ptunnel-ng implements this scheme. On the compromised host (with ICMP egress) you stand up the server, forwarding to an internal service such as SSH:
sudo ./ptunnel-ng -r<ip> -R22And on the attacker you connect the client, which exposes that SSH on a local port through the ICMP tunnel:
sudo ./ptunnel-ng -p<ip> -l2222 -r127.0.0.1 -R22
ssh -p2222 <user>@127.0.0.1Requirements
You only need ICMP to leave the segment (very common, because blocking ping breaks legitimate diagnostics) and the ability to run the server on the pivot host. The tunnel is slow and somewhat fragile (it depends on the network not rate-limiting or reordering ICMP), but when ping is the only thing that crosses the firewall, it is the difference between pivoting or not.
How to detect it
A tunnel's echo request/reply differ from normal ping by the size and variability of the data field (a legitimate ping carries a fixed, small payload; the tunnel, large and changing loads), by a sustained volume of ICMP toward one host, and by a request/reply ratio that does not match normal diagnostics. An IDS that inspects the ICMP payload catches it quickly.
Defence. Limit or block outbound ICMP to the Internet, rate-limit echo, and inspect the size and content of the ICMP payload at the perimeter. Related to DNS tunneling and socat relay.