pentest-pivoting - A compact guide to network pivoting for penetratio

项目说明

Pi Guide

Table of Contents

1. Important Notes
2. SSH Dynamic Port Forwarding
3. SSH Remote Port Forwarding
4. SSH Local Port Forwarding
5. Double Pi
6. sshuttle
7. Chisel
8. Using Burpsuite as Proxy
9. Usefull Resources

Important Notes

Do not use ICMP echo requests (ping) to test SOCKS proxies.

SOCKS is an Internet protocol that exchanges network packets between a client and ser a proxy server. Practically, a SOCKS ser TCP connections to an arbitrary IP address, and provides a means for UDP packets to be forwarded.
You should test it using a TCP based protocol (e.g. try to SSH or send an HTTP GET request to a host accross the pi).

NMAP must be used with TCP connect scan (-sT) and no ping (-Pn)

This also applies to (-sV) and script scans (-sC). They should be used in combination with -sT and -Pn.
Examples:

Tip: You can upload naabu to the machine and scan away like a boss.

Using scripts and binaries with proxychains

One tip for using proxychains is to ensure that if you are running an interpreted program (like a Python script) its a good idea to explicitly reference the Python binary before that script, even if the script starts with a hash bang, e.g.:

Without this specific reference to the script interpreter, sometimes the traffic generated from the script will fail to be routed through the proxy as you intended, and the network connection will fail. Tip Source

Uncomment line "quite mode" in /etc/proxychains.conf to avoid stdout that can be frustrating at times.

This is merely a suggestion.

SSH Dynamic Port Forwarding

Allows you to create a socket on the local (ssh client) machine, which acts as a SOCKS proxy server. When a client connects to this port, the connection is forwarded to the remote (ssh server) machine, which is then forwarded to a dynamic port on the destination machine.

How to set it up:
1. Edit /etc/proxychains.conf and implement the following:
- Remove Dynamic chain from comment.
- Comment Strict chain and Random chain.
- Append line socks4 127.0.0.1 9050 at the end of the document (proxy list), save and close file. *You can, of course, use a different port.

2. Setup the SSH Dynamic Port Forwarding:

Usage examples:
With x.x.x.x being the ip address of a host that belongs to the tunneled network:

In order to use firefox throught the tunnel:

SSH Remote Port Forwarding

If you are searching how to get a reverse shell through a pi, this is what you need. It allows you to forward a port on the remote () machine to a port on the local (attacker) machine.

How to set it up:
1. SSH into the machine.
2. Edit /etc/ssh/sshd_config and implement the following:
- Remove GatewayPorts no from comment and change it to Yes. Save and close file.

**This is very important and many guides around the web do not mention it. If you don't do this you will only be able to set the tunnel on 127.0.0.1 rather than 0.0.0.0, which will end up not forwarding traffic when it originates from any host except localhost.*

- Restart the SSH service for changes to be effective. sudo service ssh restart
- Exit and return to your machine.

3. Setup the SSH Remote Port Forwarding:
Essentially, after setting it up as mentioned, the command is as simple as that:

In order to test if it works, you could do the following:
Set a listener (e.g. netcat) on your attacker machine (on the port you configured the remote forward, in this example 2222) and make a request from the machine to itself (localhost). In this example, that would be nc 127.0.0.1 2222. If your attacker machine receives the connection then it means that a) it works and b) every connection from pi hosts to the :2222 will be forwarded to attacker machine.

You can set multiple ports like this:

Caution: Requests from foreign hosts (pi network) must be addressed to the ip in order to be forwarded back to the attacker machine.

**You can also implement Remote Port Forwarding by SSH connecting from to attacker machine.*

SSH Local Port Forwarding

Local port forwarding allows you to forward a port on the local (attacker) machine to a port on the remote () machine. Particularly usefull in order to scan local ports on .

Usage:

You can now use e.g. nmap to scan port 8086 on the machine like this:

Double Pi

An example of how to implement double pi with SSH Dynamic Port Forwarding and Proxychains.

Concept:
Suppose we have the following 4 machines.
| IP | Role |
|-------------|:---------:|
| 10.10.10.10 | Attacker |
| 10.10.10.11 | Jumphost1 |
| 172.16.1.12 | Jumphost2 |
| 172.16.2.13 | Jumphost3 |

Attacker can reach Jumphost1.
Jumphost1 can reach Jumphost2.
Jumphost2 can reach Jumphost3.

1. In order to reach Jumphost2, implement SSH Dynamic Port Forwarding instructions mentioned before, against Jumphost1.
2. In order to reach Jumphost3, edit /etc/proxychains.conf and add another proxy entry at the end of the document. The end of your proxychains.conf will now look something like this:

3. SSH into Jumphost1 and set another Dynamic Port Forwarding against Jumphost2 (the local port you choose must be the same as the one set for your second proxy entry in proxychains.conf):

You should now be able to reach Jumphost3.

sshuttle

sshuttle allows you to create a from your machine to any remote server via ssh, as long as that server has python 2.3 or higher. To work, you must have root access on the local machine, but you can have a normal account on the server. It's valid to run sshuttle more than once simultaneously on a single client machine, connecting to a different ser time, so you can be on more than one VPN at once. Check the sshuttle github repository.

Usage:
Assuming we want to pivot into 172.16.2.0/16:

If you want to use ssh key:

Chisel

Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go (golang). It's insanely awesome and useful.

Installation:
You can easily install chisel on kali:

In order to use it, you also need to upload the chisel binary on the . You can download precompiled here.

Local port forwarding example
On your attacker machine:

On the machine:

This is going to forward traffic from attacker machine port 1234 to machine port 8443.

Using Burpsuite as Proxy

Burpsuite supports the capability of setting proxies, an incredibly useful and powerfull feature.

How to set it up:
Fire up Burpsuite and implement the following:

Goto Proxy/Options and hit add on the Proxy Listeners section.

Set a binding port and interface.

on the second tab, set the host and port you want to redirect traffic to.

In combination with setting up an SSH Dynamic Port Forwarding or sshuttle, you can now use Burpsuite to pi to desired hosts by sending traffic to your localhost bind port. A useful example with gobuster dir brute through the tunnel (Assumming that you set port 2222 as the redirect port):

Usefull Resources

项目信息

开发语言：未知

Star 数：228

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A compact guide to network pivoting for penetration testings / CTF challenges.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。