Pivoting is moving to other networks through a compromised host to find multiple targets on different network segments and Tunneling is the obfuscation of our actions to avoid detection.
SSH
client: Where the ssh command is executed.
server: Target of the ssh connection.
Allows a local client port to be mapped to another port on a certain target reachable by the server.
(possible to repeat multiple times -L for multiple ports)
Allows a local client port to be mapped to the server. That port will be used as a proxy socks, so packets passing through that port will leave from the server.
Allows a server port to be mapped to the client. That port will be used as a proxy socks, so packets passing through that port will leave from the client.
ssh-N-R<S_PORT><S_USER>@<S_IP>
-N: Without the ability to execute remote commands.
0.0.0.0: All interface.
Metasploit
Pivoting only inside metasploit.
Maps reaching other subnets via meterpreter sessions (via victim hosts).
post/multi/manage/autoroute# set network and session
Or
routeadd<NETWORK><SESSION>
Or, in Meterpreter:
runautoroute-s<NETWORK>
Pivoting for tools outside metasploit.
Allows a local port to be mapped to metasploit. That port will be used as a proxy socks, so packets passing through that port will be handled by the route paths defined in metasploit.
# Set Route
auxiliary/server/socks_proxy# set vSocks 4a or 5 and PORT
It allows you to define on the local machine routes to certain subnets reachable from a host, via an ssh tunnel to that host. It therefore eliminates the need to configure proxychains.
sudosshuttle-r<USER>@<IP>:<PORT_SSH><NETWORK>
<COMMAND_TO_NETWORK>
NO proxychains, but root on the SSH client and Python3 on the SSH server.
It performs TCP/UDP pivoting and tunneling, transported over HTTP and encrypted internally via SSH.
Being hidden under HTTP it can bypass some restrictions.
DNS-based encrypted command-and-control channel.
A dnscat2 server runs on an authoritative name server for a particular domain (or as in our case a dummy dns server is created) while the client, configured to run queries on that domain, runs on the compromised machine.
