TwitterGitHubBlog

Pivoting

Check if connections are allowed at a certain port (alternative to nc.exe and powercat.ps1):

nc.ps1
# Test-NetConnection -ComputerName 10.10.13.37 -Port 4444
$port = $args[0]
$endpoint = New-Object System.Net.IPEndPoint([System.Net.IPAddress]::Any, $port)
$listener = New-Object System.Net.Sockets.TcpListener $endpoint
$listener.Start()
Write-Host "Listening on port $port"
while ($true)
{
    $client = $listener.AcceptTcpClient()
    Write-Host "A client has connected"
    $client.Close()
}

Check if the machine can reach specific remote port when Test-NetConnection is not available (1, 2):

$ cme smb 192.168.1.11 -u snovvcrash -p 'Passw0rd!' -x 'powershell (New-Object System.Net.Sockets.TcpClient("192.168.2.22", 445)).Connected' | grep -ai True

Using PortQryV2:

SSH

Local vs Remote Port Forwarding

A cheatsheet for SSH Local/Remote Forwarding command syntax:

  • -L 1111:127.0.0.1:2222: the traffic is forwarded from SSH client via SSH server, so 1111 is listening on client-side and traffic is sent to 2222 on server-side.

  • -R 2222:127.0.0.1:1111: the traffic is forwarded from SSH server via SSH client, so 2222 is listening on server-side and traffic is sent to 1111 on client-side.

Consider the following example. An attacker has root privileges on Pivot1. He creates the first SSH tunnel (remote port forwarding) to interact with a vulnerable web server on Pivot2. Then he exploits the vulnerability on Pivot2 and triggers it to connect back to Attacker via a reverse-shell (firewall is active, so he needs to pivot through port 443, which is allowed). After that the attacker performs PE on Pivot2 and gets root. Then he creates another tunnel (local port forwarding) over the first one to SSH into Pivot2 from Attacker. Finally, he forwards port 80 over two existing hops to reach another vulnerable web server on Victim.

Notes:

  • 1 For SSH server to listen at 0.0.0.0 instead of 127.0.0.1, the GatewayPorts yes must be set in /etc/ssh/sshd_config.

  • 1 With SSH (or Chisel, for example) server running on the Attacker the same can be achieved by doing local port forwarding instead of remote.

Let's say we're doing a Remote Port Forwarding via SSH (with GatewayPorts yes) through ProxyChains like this:

Then it's crucial to make sure that local connections are excluded from ProxyChains interception via the localnet 127.0.0.0/255.0.0.0 option in proxychains.conf. Otherwise, traffic redirection from server's 192.168.1.11:80 to client's 127.0.0.1:8080 are captured by ProxyChains and never reach the client!

Remote Dynamic Forwarding

  • Attacker's IP: 10.10.13.37

  • Victims's IP: 10.10.13.38

An example how to safely set remote dynamic port forwarding (SOCKS) with a builin SSH client.

Generate a dummy SSH key on Victim:

Add dummy_key.pub contents to authorized_keys on Attacker with the following options:

Connect to Attacker's SSH server from Victim:

L2 VPN over SSH

Allow tunneling in SSH server config on Victim:

Connect to Victim building a Ethernet tunnel:

Enable tap interfaces on both ends:

Put Victim's interface and tap into bridge:

Get an IP address for tap on Attacker:

SOCKS over Hardened SSH

With AllowTcpForwarding set to no it's also possible to establish a SOCKS connection through active SSH connection:

netsh / NetFirewallRule

Rules

Allow inbound traffic flow on port 5986/TCP:

Relay

Add a relay between two machines (need to be local admin).

Make any traffic hitting port 8443 on 0.0.0.0 to be redirected to 10.10.13.37 on port 443:

Show active relays:

Remove a relay:

TCP over RDP

xfreerdp + rdp2tcp

Reverse local port 9002 (on Victim) to local port 9001 on Attacker (good for reverse shells):

Forward local port 9001 (on Attacker) to local port 9002 on Victim (good for bind shells):

Reverse tunnel web access via SOCKS proxy:

TCP over SMB

Tools

proxychains4 (proxychains-ng)

Install:

graftcp

sshuttle

chisel

garble
LogoHTB{ Reddish }snovvcrash@gh-pages:~$ _

  • Attacker's IP: 10.10.13.37

  • Victims's IP: 10.10.13.38

Reverse local port 1111 (on Victim) to local port 2222 (on Attacker):

Socks5 proxy in server mode:

Socks5 proxy in server mode when direct connection to Victim is not available (not relevant as Chisel supports socks5 in client mode now):

Socks5 proxy in client mode:

Quicky:

SharpChisel

revsocks

rsockstun

Quicky:

PowerShell

resocks

(Neo-)reGeorg

Generate a tunnel implant and copy it to the Victim web server from ./neoreg_servers/tunnel*:

Connect to the implant (.aspx, for example):

ssf

Map shells to users:

Telegram alers:

Services

Dev Tunnels

Don't forget to set Cookie: *tunnel_phishing_protection=xxxxyyyy.euw

Cloudflare Tunnels

Last updated