OSCP Notes
Search…
Port Forwarding / SSH Tunneling

SSHUTTLE

1
pip install sshuttle
2
sshuttle -r [email protected] 10.10.10.10/24
Copied!

SSH: Local Port Forwarding

1
# Listen on local port 8080 and forward incoming traffic to REMOT_HOST:PORT via SSH_SERVE2
2
# Scenario: access a host that's being blocked by a firewall via SSH_SERVER;
3
4
ssh -L 127.0.0.1:8080:REMOTE_HOST:PORT [email protected]_SERVER
Copied!

SSH: Dynamic Port Forwarding

1
# Listen on local port 8080. Incoming traffic to 127.0.0.1:8080 forwards it to final destination via SSH_SERVE2
2
# Scenario: proxy your web traffic through SSH tunnel OR access hosts on internal network via a compromised DMZ box;
3
4
ssh -D 127.0.0.1:8080 [email protected]_SERVER
Copied!

SSH: Remote Port Forwarding

1
# Open port 5555 on SSH_SERVER. Incoming traffic to SSH_SERVER:5555 is tunneled to LOCALHOST:3382
2
# Scenario: expose RDP on non-routable network;
3
4
ssh -R 5555:LOCAL_HOST:3389 [email protected]_SERVER
5
6
plink -R ATTACKER:ATTACKER_PORT:127.0.01:80 -l root -pw pw ATTACKER_IP
Copied!

Proxy Tunnel

1
# Open a local port 127.0.0.1:5555. Incoming traffic to 5555 is proxied to DESTINATION_HOST through PROXY_HOST:3122
2
# Scenario: a remote host has SSH running, but it's only bound to 127.0.0.1, but you want to reach it;
3
4
proxytunnel -p PROXY_HOST:3128 -d DESTINATION_HOST:22 -a 5555
5
6
ssh [email protected] -p 5555
Copied!

HTTP Tunnel: SSH Over HTTP

1
# Server - open port 80. Redirect all incoming traffic to localhost:80 to localhost:22
2
hts -F localhost:22 80
3
4
# Client - open port 8080. Redirect all incoming traffic to localhost:8080 to 192.168.1.15:80
5
htc -F 8080 192.168.1.15:80
6
7
# Client - connect to localhost:8080 -> get tunneled to 192.168.1.15:80 -> get redirected to 192.168.1.15:22
8
ssh localhost -p 8080
Copied!
Last modified 1yr ago