Pivoting is moving to other networks through a compromised host to find multiple targets on different network segments and Tunneling is the obfuscation of our actions to avoid detection.
SSH
client: Where the ssh command is executed.
server: Target of the ssh connection.
Allows a local client port to be mapped to another port on a certain target reachable by the server.
(possible to repeat multiple times -L for multiple ports)
Allows a local client port to be mapped to the server. That port will be used as a proxy socks, so packets passing through that port will leave from the server.
ssh -N -D <C_PORT> <S_USER>@<S_IP>
vim /etc/proxychains[4].conf
# socks4 127.0.0.1 <C_PORT>
sudo proxychains[4] <COMMAND>
(ex.. nmap, msfconsole)
Allows a port on the server to be mapped to another port on a target reachable by the client.
Allows a server port to be mapped to the client. That port will be used as a proxy socks, so packets passing through that port will leave from the client.
ssh -N -R <S_PORT> <S_USER>@<S_IP>
-N: Without the ability to execute remote commands.
0.0.0.0: All interface.
Metasploit
Pivoting only inside metasploit.
Maps reaching other subnets via meterpreter sessions (via victim hosts).
post/multi/manage/autoroute # set network and session
Or
route add <NETWORK> <SESSION>
Or, in Meterpreter:
run autoroute -s <NETWORK>
Pivoting for tools outside metasploit.
Allows a local port to be mapped to metasploit. That port will be used as a proxy socks, so packets passing through that port will be handled by the route paths defined in metasploit.
# Set Route
auxiliary/server/socks_proxy # set vSocks 4a or 5 and PORT
vim etc/proxychains[4].conf
# socks4 127.0.0.1 <PORT>
sudo proxychains[4] <COMMAND>
(ex. nmap)
In meterpreter you can define both a Local and a Remote port forwarding (see above ssh).
It allows you to define on the local machine routes to certain subnets reachable from a host, via an ssh tunnel to that host. It therefore eliminates the need to configure proxychains.
sudo sshuttle -r <USER>@<IP>:<PORT_SSH> <NETWORK>
<COMMAND_TO_NETWORK>
NO proxychains, but root on the SSH client and Python3 on the SSH server.
plink.exe -ssh -R <PORT>:<IP>:<PORT> <USER>@<IP>
plink.exe -ssh -D 9050 <USER>@<IP>
Set new proxy server socks5 to 127.0.0.1:9050
<COMMAND>
If we cannot interact with the running shell:
-pw # specify password from command
cmd.exe /c echo y | plink.exe -ssh ... # via piping
Tunneling
apt install ligolo-ng
Proxy on Attacker machine.
Agent on Victim machine.
sudo ./proxy -selfcert
# See ATTACKER_IP ATTACKER_PORT
# > help
Connect the victim to the server
> sessions
> autoroute
Ligolo-ng < v0.6
sudo ./proxy -selfcert [-laddr <MY_IP>:<MY_PORT>]
# See ATTACKER_IP ATTACKER_PORT
# > help
Create a tun interface on the Proxy Server (C2)
sudo ip tuntap add user <your_username> mode tun ligolo
sudo ip link set ligolo up
Connect the victim to the server and select the session
> sessions
> <ID>
> ifconfig
Setup routing
sudo ip route add <ROUTE/MASK> dev ligolo
> start [--tun <NAME_TUN>]
> stop
Ligolo-ng >= v0.6
sudo ./proxy -selfcert
# See ATTACKER_IP ATTACKER_PORT
# > help
Create a tun interface on the Proxy Server (C2)
> interface_create --name "<NAME>"
Connect the victim to the server and select the session
Useful when we need to set up a reverse shell or something else from the second target (AGENT2) in the network that is not directly reachable.
Because the agent is running without privileges, it's not possible to forward raw packets. When you perform a NMAP SYN-SCAN, a TCP connect() is performed on the agent.
When using nmap, you should use --unprivileged or -PE to avoid false positives.
It performs TCP/UDP pivoting and tunneling, transported over HTTP and encrypted internally via SSH.
Being hidden under HTTP it can bypass some restrictions.
vim /etc/proxychains[4].conf
socks5 127.0.0.1 <PORT>
proxychains[4] <COMMAND>
DNS-based encrypted command-and-control channel.
A dnscat2 server runs on an authoritative name server for a particular domain (or as in our case a dummy dns server is created) while the client, configured to run queries on that domain, runs on the compromised machine.
Allows tunnelling and pivoting between Windows systems via RDP.
Requires administrator privileges.
On Attacker (Client), with System PowerShell
regsvr32.exe SocksOverRDP-Plugin.dll
mstsc.exe # Connect on target1
Set new proxy server socks5 to 127.0.0.1:1080
On Target1, with System PowerShell
SocksOverRDP-Server.exe
On Attacker
mstsc.exe # Connect on target1 via Target1 pivoting
Warning
With proxychains only full TCP connect scan (nmap -sT)
Windows Defender blocks ICMP, traditional ping (nmap -Pn)
Last updated
Was this helpful?
On Windows before OpenSSH, and its command-line-only counterpart were used.
Plink has much of the functionality offered by ssh.
Download , portable version (like proxychains but for windows).
If we want to do another pivoting from the second target machine (AGENT2), we just need to load the agent, reconnect to the proxy server via the set listener, set new tun (ex. ligolo2) and add routing (see ).
Download compiled from
Or with
.exe for Windows
Download , portable version (like proxychains but for windows).
