Opens a listener on port 4455 (CONFULENCE01 Jump Host) and forwards all traffic through 10.4.50.215 to 172.16.50.217:445. (PGDATABASE01).
NOTE: -N flag is means execute no remote commands. No shell will be opened.
Dynamic Port Forwarding - Tunneling over SOCKS proxy
Local port forwarding is limited to one socket per SSH connection. OpenSSH allows for dynamic port forwarding. From a single listening port, packets can be forwarded to any socket that the server can route to. This works because the listening port creates a SOCKS proxy.
D_ynamic Port Forwarding from Attack Host:_
attacker@kali$ ssh -D 9050 ubuntu@10.129.202.64
NOTE: The -D flag enables dynamic port forwarding & ssh acts as a SOCKS server.
$ tail -4 /etc/proxychains.conf
# meanwile
# defaults set to "tor"
socks4 127.0.0.1 9050
Also known as Reverse Port Forwarding. In real world scenarios it is likely we'll encounter a firewall that heavily restricts inbound connections. Outbound connections however, are less likely to be blocked.
Start SSH Service
kali:~$ sudo systemctl start ssh
Connect back to Kali Host
The below command opens a port on localhost 2345 on our kali machine. All traffic is forwarded through the jump host to 10.4.50.215:5432.
As we can see, our kali box is listening on 127.0.0.1 2345
kali@kali$ ss -ntlpu
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 0.0.0.0:52704 0.0.0.0:*
tcp LISTEN 0 128 127.0.0.1:2345 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 128 [::]:22 [::]:*
Remote Dynamic Port Forwarding
NOTE: This tends to be the most optimal setup for port forwarding during engagements. We get all the benefits from Dynamic Port forwarding along with the remote configurations.
Create Dynamic Remote Port Forward
Creating a Dynamic Remote Port Forward is similar to creating a Remote port forward. We use the -R command but only with one port. We do not specify and address! Neither do we use -D!
kali@kali:~$ tail /etc/proxychains4.conf
# proxy types: http, socks4, socks5, raw
# * raw: The traffic is simply forwarded to the proxy without modification.
# ( auth types supported: "basic"-http "user/pass"-socks )
#
[ProxyList]
# add proxy here ...
# meanwile
# defaults set to "tor"
socks5 127.0.0.1 9998 # IP address is localhost 127.0.0.1
Verifying Port Forward
As we can see, our kali box is listening on 127.0.0.1 9998
kali@kali$ ss -ntlpu
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 0.0.0.0:52704 0.0.0.0:*
tcp LISTEN 0 128 127.0.0.1:9998 0.0.0.0:*
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 128 [::]:22
Additional Info
Transferring Metasploit Binary to Victim (on internal network).
We may need to transfer a binary to a machine we've gained access to so we can port forward.
If the host has ssh we can connect back to our kali box to tunnel traffic.
This is a command to tunnel all traffic through a jump host back to our kali web server. This is useful when downloading tool to a host inside an internal network.
Say we discover a web service that is running locally, or only allows 127.0.0.1 to authenticate. We can port forward the service back to our kali host and access it locally.
