Pivoting(Tunneling and Port Forwarding)
Pivoting
Pivoting is the art of using access obtained over one machine to exploit another machine or sets of machines deeper in the network which may not be accessible from outside.
Types of Pivoting
There are generally two types of pivoting they are Tunneling and Port Forwarding
Tunneling
Port Forwarding
Tunneling or Proxying
What's a proxy? A proxy is simply an intermediatery server or system which sits in between the user and the resource which the user is trying to access. For example if i simply want to visit facebook.com using a proxy the proxy acts as a middleman it first receives the request to visit facebook.com from me(the user) and retrives the page for facebook.com for me and sends it back to our computer. So for example we have compromised a host 10.10.10.129, this host can talk to another host on the internal network which is on a different subnet 10.10.11.220 and is only accessible from internal network, what we can do it we can use our compromised host 10.10.10.129 host as a proxy server to route all desired traffic into 10.10.11.220. (A proxy is good if we want to redirect lots of different kinds of traffic into our target network -- or to access multiple ports on multiple different machines which our compromised host can talk to, however it may take alot of time)
Port Forwarding
This is technique where after compromising a host we create a connection between our local port and a single port of target which we want to access with the help of that compromised host.This is fast and reliable and usually is a chosen method of pivoting by an attacker.
Tools for Tunneling and Port Forwarding
SSH port forwarding and tunnelling (primarily Unix)
plink.exe (Windows)
socat (Windows and Unix)
chisel (Windows and Unix)
sshuttle (currently Unix only)
Uploading static nmap binary to scan the internal network
Enumerating a network for pivoting
The first and initial step of pivoting to another host after compromising one host is to enumerate which hosts our compromised hosts is allowed to access or talk to. After we have identified a host using any of the steps below we can simply ping that host from our compromised host and see if it is up or not.
Step 1
The first step of enumeration is to always check ipconfig /all in windows and ifconfig -a in linux to see if our target host is physically or by some other means is connected to or with other hosts in the network, if it is we will see another ipaddress with different last bit for example if we have compromised a host 10.10.10.11 and we do ipconfig /all and see ip address 10.10.10.20 we can know that this machine is connected to 10.10.10.20 machine and we can now pivot into that machine.
Step 2
We can use arp -a command in both linux and windows which will show any IP addresses of hosts that our compromised host has interacted with recently.
Step 3
We can also check the /etc/hosts file in linux and C:\Windows\System32\drivers\etc\hosts file in windows to check for any other ip address other than our own.
Step 4
A simple bash one liner can also be used to enumerate any other hosts on the network with whom our compromised host can talk to suppose we have compromised 10.10.10.12 host now we can use below bash one liner to find other hosts on the network with whom 10.10.10.12 is allowed to talk to.
Static nmap binary
SSH Tunneling and Port Forwarding
If we have ssh access to target host suppose 10.10.11.12 and after doing netstat -ano or ss -lntp we find a weird looking port 8080 running web service which is listening internally on that target host itself so if we want to forward this 8080 port to our local machine we can simply do the following.
After this we can simply navigate to http://127.0.0.1:8080 on browser on our local machine
Suppose we had ssh access on 10.10.10.12 and we identified that our compromised host can talk to 10.10.10.20 on the internal network, after performing an nmap scan from our compromised host on 10.10.10.20 we identified that it is running a web service on port 8000 if we want to forward this port to our attacking machine then we can do the following.
After this we can navigate to http://127.0.0.1:8000 on our own local machine and access that website
SSH Dynamic Port Forwarding
In the above examples we were only limited to forwarding a single port of a single host in the internal network. This technique allows us to setup a local listening port on attacker's server and when a request in made through this port(using proxychains) the connection is first forwarded to compromised machine then to specific internal host within the compromised machine. For example: Suppose we have ssh access over 10.10.11.129 and after doing ifconfig -a we identify additional network interface 192.168.1.X which seems to be connected to different network, After doing bash oneliner ping on 255 hosts of 192.168.1 network we identified two hosts 192.168.1.110 and 192.168.1.220,Now if we wanted to forward every single port on our local machine for every identified host on 192 network it would be almost impossible or very time consuming so in such cases we use SSH dynamic port forwarding.
First we setup a local listening port 8080 which will forward any request to 10.10.11.129 and then to our specified host on the internal 192 network.
Configure proxychains, then we setup SOCKS proxy in our /etc/proxychains.conf file like below.
Now suppose we identified 192.168.1.110 and 192.168.1.220 hosts on the internal network we can interact with these hosts from our own attacker box as below. The nmap, smbclient or ftp traffic will first go through the 10.10.11.129 network then to 192.168.1.110 and 192.168.1.220 on the internal network.
Remote Port Forwarding(When we donot have ssh access on target but have a shell)
SSH Remote Port Forwarding
Step 1 (On attacker machine)
Step 2 (On attacker machine) Now copy the content of id_rsa.pub and paste into our own authorized keys file with
this line at the start
Now our authorized_keys file should look something like this
Step 3 (On attacker machine) Start the ssh server if not started
Step 4 (On victim machine) Now transfer our private key to the victim host where we have a stable shell. So if we have a stable shell on victim host 10.10.10.112 and this host is internally connected to 10.10.11.120 which is running web service on port 80
This will open port 80 on our attacker box and create a link between our(attacker's) port 80 and victim host 10.10.11.120:80 through 10.10.10.112(host where we have stable shell access)
plink.exe(Windows)
Same case as above if we have a stable shell on a victim host but donot have ssh access we can use statically compiled tools to achieve port forwarding plink in this case.
plink.exe - Case1(Forwarding local port of victim machine of same host to our machine)
Suppose 10.10.10.11 is our attacker ip address and we need to forward port 3306 of victim host to our attacker box now first we need to transfer plink.exe static binary to victim host we also need to configure ssh server on our attacking box and launch plink.exe as follows in the victim machine.
plink.exe - Case2(Forwarding port of internal network's host connected with our compromised host to our attacking machine)
Suppose we have compromised a host 10.10.11.229 and this host is connected to another host 10.10.11.230 which is running a web server on port 8000, Here our attacking host's ip is 192.168.55.229. After uploading the plink.exe binary to our compromised host 10.10.11.229. Here we need to first run ssh server on our attacking machine 192.168.55.229.
Step 1(Generate ssh key in our attacking machine) doing
ssh-keygenStep 2 (Install puttygen tools in our attacking machine)
sudo apt install putty-toolsStep 3 (Convert id_rsa keyfile doing)
puttygen id_rsa -o id_rsa.ppkStep 4(chmod 600 this id_rsa.ppk file and send to victim host)
Now on victim host do the following
Plink.exe (Another Method):
we use plink.exe in windows to forward port of victim machine which is listening internally to same/another port of our attacker machine.
in attacker pc: edit the ssh configuration from /etc/ssh/sshd_config and uncomment the PermitRootLogin line and set its value to yes and restart the ssh servive. in victim pc:
-l represents local username of our kali -pw represents root password of our kali and we are forwarding port 445 of victim machine to port 445 of our machine which lives on 10.10.15.133 via ssh
we may have to press enter key couple of times in order to work.
we use winexe to execute commands on windows via linux suppose we forwarded port 445 of victim machine and we have credentials of smb so on our linux we do
Chisel(Linux and Windows)
Here we must have an appropriate copy of chisel binary on both attacking and victim hosts. On attacking host: ./chisel server -p 8000 --reverse On victim Host:
Connect to 8000 on attacker's server open port 80 on attackers server and forward port 80 of victim(this) machine to port 80 of attacker's server
Connect to 8000 on attacker's server open port 4444 on attackers server and forward port 80 of internal host 10.10.10.240 to 4444 of attacker's server
Connect to 8000 on attacker's server open port 80 on attackers and Create SOCKS5 listener on 1080 of attacker's server
ligolo-ng
Forwarding port 80 of internal Windows host from compromised Windows machine(Compromised windows=10.10.11.1, internal windows=192.168.55.1)
From attacker's server
Accessing internal windows host through compromised windows host via smb/cifs
Forwarding port 3389(any) of internal windows host from compromised linux host(through http shell) where only port 80,443 and 1234(any) is allowed, Remote ssh login is not allowed but we have ssh creds to attacker's host so that any traffic sent to a certain port on attacker's host is forwarded to internal window's host in port 3389
In attacker's host
In compromised linux host
In compromised linux host
In attacker's host
Last updated