configure & make :) This tool is a swiss army knife in the proxy world so it has a ton of functionality. As for Linux, you will need to build it yourself which is not a rocket science, just. There are pre-built binaries for Windows. In this example the serverРІР‚в„ўs external network interface is eth0 and the newly created tun devices on both sides are tun0. Now you can make the peer host 1.1.1.1 your default gateway or route a specific host/network through it: Iptables -t nat -A POSTROUTING -s 1.1.1.2 -o eth0 -j MASQUERADE Ip addr add 1.1.1.1/32 peer 1.1.1.2 dev tun0Р”В®nable ip forwarding and NAT on the server: The tunnel between the tun devices is enabled but the interfaces are yet to be configured. It can be set explicitly -w 0:0 or you can use -w any:any syntax to take the next available tun device.

The flag -w accepts the number of tun device on each side separated with a colon. The following command on the client will create a pair of tun devices on client and server: These lines should be present in your /etc/ssh/sshd_config file (server-side): PermitRootLogin yes This is quite simple, but you need root on both machines since the creation of tun devices is a privileged operation. ItРІР‚в„ўs done via the creation of tun devices on client and server side and transferring the data between them over ssh connection.

So, for example, you are able to perform SYN-scan with nmap and use your tools directly without resorting to proxychains or other proxifying tools. This has an advantage over a typical tcp tunnel because you are in control of ip traffic. Since openssh release 4.3 it is possible to tunnel layer 3 network traffic via an established ssh channel. Note, that to bind privileged ports (such as 445) you will need root privileges on your machine. This way a port 445 will be opened on the attackerРІР‚в„ўs side. LetРІР‚в„ўs say you need to access an SMB share in the internal network on host 192.168.1.1. Welcome to the intranet ) It is also possible to forward one specific port to a specific host. This will spawn a socks server on the attackerРІР‚в„ўs side (ssh-client side). Managed to find credentials to the SSH-service running on the host? Great! Connect to the host as follows: Note that in this specific scenario you should able to bind ports on the compromised host and those ports should be accessible from the external network. You upload a shell and want to develop your attack into the internal network. LetРІР‚в„ўs say you find an RCE bug in a web-app accessible from the internet. In this post IРІР‚в„ўll cover common pivoting techniques and tools available.Р”Р„ prevalent scenario.

Pivoting is a set of techniques used during red team/pentest engagements which make use of attacker-controlled hosts as logical network hops with the aim of amplifying network visibility. Common scenarios include developing the attack into the internal network after successful perimeter breach or gaining access to initialy unroutable network segments after compromising hosts inside the organization. Penetration testers often traverse logical network boundaries in order to gain access to clientРІР‚в„ўs critical infrastracture.

Socat tutorial