Pivoting & Tunneling
Pivoting is moving to other networks through a compromised host to find multiple targets on different network segments and Tunneling is the obfuscation of our actions to avoid detection.
SSH
client: Where the ssh command is executed.
server: Target of the ssh connection.
In Windows see %systemdrive%\Windows\System32\OpenSSH (where ssh)
Allows a local client port to be mapped to another port on a certain target reachable by the server.
ssh -N -L [<C_IP>:]<C_PORT>:<S_TRAGET_IP>:<S_TARGET_PORT> <S_USER>@<S_IP>(possible to repeat multiple times -L for multiple ports)
Allows a local client port to be mapped to the server. That port will be used as a proxy socks, so packets passing through that port will leave from the server.
ssh -N -D [<C_IP>:]<C_PORT> <S_USER>@<S_IP>vim /etc/proxychains[4].conf
# socks4 127.0.0.1 <C_PORT>sudo proxychains[4] <COMMAND> (ex.. nmap, msfconsole)
Allows a port on the server to be mapped to another port on a target reachable by the client.
ssh -N -R [<S_IP>:]<S_PORT>:<C_TRAGET_IP>:<C_TARGET_PORT> <S_USER>@<S_IP>Allows a server port to be mapped to the client. That port will be used as a proxy socks, so packets passing through that port will leave from the client.
ssh -N -R [<S_IP>:]<S_PORT> <S_USER>@<S_IP>-N: Without the ability to execute remote commands.
0.0.0.0: All interface.
If you are using the “Remote” technique and need to connect to your machine:
sudo systemctl start sshSetting
PasswordAuthenticationtoyesin/etc/ssh/sshd_configUse very secure passwords for accounts
Metasploit
Pivoting only inside metasploit. Maps reaching other subnets via meterpreter sessions (via victim hosts).
post/multi/manage/autoroute # set network and sessionOr
route add <NETWORK> <SESSION>Or, in Meterpreter:
run autoroute -s <NETWORK>Pivoting for tools outside metasploit. Allows a local port to be mapped to metasploit. That port will be used as a proxy socks, so packets passing through that port will be handled by the route paths defined in metasploit.
# Set Routeauxiliary/server/socks_proxy # set vSocks 4a or 5 and PORTvim etc/proxychains[4].conf
# socks4 127.0.0.1 <PORT>sudo proxychains[4] <COMMAND>(ex. nmap)
In meterpreter you can define both a Local and a Remote port forwarding (see above ssh).
Local
portfwd add -l <C_PORT> -p <S_TARGET_PORT> -r <S_TRAGET_IP>Remote
portfwd add -R -l <C_TARGET_PORT> -p <S_PORT> -L <C_TRAGET_IP>Other
Simple Port Forwarding (single-host)
Define the listening port and the destination to rebroadcast to.
Define the listening port and the destination to rebroadcast to. Requires administrator privileges.
To view
N.B. create a hole in the firewall if there is one
It allows you to define on the local machine routes to certain subnets reachable from a host, via an ssh tunnel to that host. It therefore eliminates the need to configure proxychains.
NO proxychains, but root on the SSH client and Python3 on the SSH server.
On Windows before OpenSSH, PuTTY and its command-line-only counterpart Plink were used. Plink has much of the functionality offered by ssh.
Download Proxifier, portable version (like proxychains but for windows).
Set new proxy server socks5 to 127.0.0.1:9050
If we cannot interact with the running shell:
Tunneling
Proxy on Attacker machine. Agent on Victim machine.
Connect the victim to the server
Connect to the attacker server
PROXY --> AGENT1 --> AGENT2 --> ?
You can listen to ports on the agent and redirect connections to your control/proxy server.
Useful when we need to set up a reverse shell or something else from the second target (AGENT2) in the network that is not directly reachable.
If we want to do another pivoting from the second target machine (AGENT2), we just need to load the agent, reconnect to the proxy server via the set listener, set new tun (ex. ligolo2) and add routing (see here).
Because the agent is running without privileges, it's not possible to forward raw packets. When you perform a NMAP SYN-SCAN, a TCP connect() is performed on the agent.
When using nmap, you should use --unprivileged or -PE to avoid false positives.
It performs TCP/UDP pivoting and tunneling, transported over HTTP and encrypted internally via SSH. Being hidden under HTTP it can bypass some restrictions.
On Attacker
On Target
<REMOTE>:
Add the port in proxychains
DNS-based encrypted command-and-control channel. A dnscat2 server runs on an authoritative name server for a particular domain (or as in our case a dummy dns server is created) while the client, configured to run queries on that domain, runs on the compromised machine.
On Attacker (Server)
On Target (Client)
Download compiled from HERE
Or with Windows PowerShell Script
Once connected, from Attacker
Communication channel encapsulated in ICMP packets. Requires administrator privileges.
Installation
.exefor Windows HERE
On Target (Server)
On Attacker (Client)
Allows tunnelling and pivoting between Windows systems via RDP. Requires administrator privileges.
On Attacker (Client), with System PowerShell
Download Proxifier, portable version (like proxychains but for windows).
Set new proxy server socks5 to 127.0.0.1:1080
On Target1, with System PowerShell
On Attacker
Warning
With proxychains only full TCP connect scan (
nmap -sT)Windows Defender blocks ICMP, traditional ping (
nmap -Pn)
Last updated