{"id":3109,"date":"2021-05-03T08:49:19","date_gmt":"2021-05-03T06:49:19","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=3109"},"modified":"2026-06-03T20:15:53","modified_gmt":"2026-06-03T18:15:53","slug":"forwarding-tunneling-and-redirections","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=3109","title":{"rendered":"Forwarding, Tunneling and redirections"},"content":{"rendered":"\n

Socat<\/h2>\n\n\n\n

If Socat is not on the tar\u00adget sys\u00adtem, upload a sta\u00adt\u00adic bina\u00adry<\/a>.<\/p>\n\n\n\n

This will lis\u00adten to port 5555 and for\u00adward it to the giv\u00aden IP<\/span> on the giv\u00aden port deep\u00ader in the tar\u00adget\u2019s network:<\/p>\n\n\n\n

socat -ddd TCP-LISTEN:5555,reuseaddr,fork TCP:10.4.247.215:5432<\/pre>\n\n\n\n
Proxychains<\/h2>\n\n\n\n
! If prox\u00ady\u00adchains is slow, espe\u00adcial\u00adly while port scan\u00adning, try to reduce the fol\u00adlow\u00ading parameters:<\/p>\n\n\n\n
# Some timeouts in milliseconds
tcp_read_time_out 1500
tcp_connect_time_out 800<\/pre>\n\n\n\n
Single pivoting<\/h3>\n\n\n\n
Cre\u00adate a SOCKS<\/span> proxy from the attack\u00ader sys\u00adtem to the victim:<\/p>\n\n\n\n
ssh -N -D 127.0.0.1:9990 <username>@$victim<\/pre>\n\n\n\n
Con\u00adfig\u00adure prox\u00ady\u00adchains to use this SOCKS<\/span> proxy. In \/etc\/proxychains.conf, set<\/p>\n\n\n\n
socks4 127.0.0.1 9990<\/pre>\n\n\n\n
Now, prox\u00ady\u00adchain can be prepend\u00aded to com\u00admands, which dynam\u00adi\u00adcal\u00adly redi\u00adrects the pack\u00adets through the sock proxy. E.g. the fol\u00adlow\u00ading scans with nmap on the vic\u00adtim host:<\/p>\n\n\n\n
proxychains nmap -p1-1024 -sT -Pn<\/strong> 127.0.0.1<\/pre>\n\n\n\n
Tip: Use proxychains3 \/ proxychains4 if some\u00adthing does\u00adn\u2019t work.<\/p>\n\n\n\n
Double pivoting<\/h3>\n\n\n\n
Cre\u00adate a SOCKS<\/span> proxy from the attack\u00ader sys\u00adtem to the victim:<\/p>\n\n\n\n
ssh -N -D 127.0.0.1:9990 <username>@$first_victim<\/pre>\n\n\n\n
Note: If for\u00adward\u00ading does\u00adn\u2019t work (all the time), make sure to have<\/p>\n\n\n\n
TCPKeepAlive yes
AllowTCPForwarding yes<\/pre>\n\n\n\n
acti\u00advat\u00aded in the sshd_file of the vic\u00adtim SSH<\/span> server(s)!<\/p>\n\n\n\n
Option 0<\/h4>\n\n\n\n
Use SSH<\/span> prox\u00ady\u00adHost to con\u00adnect to the first and then to the sec\u00adond host via one SOCKS<\/span> proxy. In this case, the prox\u00ady\u00adchains con\u00adfig\u00adu\u00adra\u00adtion file must have only one socks entry.<\/p>\n\n\n\n
ssh -N -D 127.0.0.1:9990 -J $user@$jump_host user@$victim<\/pre>\n\n\n\n
Option 1<\/h4>\n\n\n\n
    \n
  1. Cre\u00adate on $first_victim a tun\u00adnel to the $second_victim 
    ssh -N -D 127.0.0.1:9991 -i lr root@$second_victim<\/pre> <\/li>\n\n\n\n
  2. Add the sec\u00adond proxy to the prox\u00ady\u00adchains con\u00adfig\u00adu\u00adra\u00adtion. 
    socks4 127.0.0.1 9990
    socks4 127.0.0.1 9991<\/pre><\/li>\n<\/ol>\n\n\n\n
    With this option, prox\u00ady\u00adchains works, but the proxy on port 9990 can\u00adnot be used to reach tar\u00adgets in the sec\u00adond net\u00adwork. To work with Fire\u00adfox, it has to incap\u00adsu\u00adlat\u00aded with prox\u00ady\u00adchains (and no FF<\/span> proxy)<\/p>\n\n\n\n
    MOZ_DISABLE_CONTENT_SANDBOX=1 proxychains4 firefox<\/pre>\n\n\n\n
    Option 2<\/h4>\n\n\n\n
    Unsure if this works<\/strong> | Cre\u00adate a sec\u00adond SOCKS<\/span> proxy on the local system.<\/p>\n\n\n\n
    proxychains ssh -N -D 127.0.0.1:9991 <username>@$first_victim<\/pre>\n\n\n\n
    Now, prox\u00ady\u00adchain can be used. (See here for source.<\/a>)<\/p>\n\n\n\n
    User-compiled proxy server<\/h2>\n\n\n\n
    See local_proxy.go. Change the ports, com\u00adpile it with go build local_proxy.go and upload it.<\/p>\n\n\n\n
    Netcat<\/h2>\n\n\n\n
    Port forwarding<\/h3>\n\n\n\n
    For\u00adwards port 4444 to 5555 on the same\/another system:<\/p>\n\n\n\n
    ncat -l 4444 --sh-exec \"ncat 127.0.0.1 5555\"
    ncat -l 4444 --sh-exec \"ncat 10.4.220.215 5555\"<\/pre>\n\n\n\n
    Or just with nc:<\/p>\n\n\n\n
    mknod mypipe p
    nc -l -p 4444 < mypipe | nc 127.0.0.1 22 >mypipe<\/pre>\n\n\n\n
    SSH<\/span><\/h2>\n\n\n\n
    For\u00adward remote port to the local machine:<\/p>\n\n\n\n
    ssh -L...<\/pre>\n\n\n\n
    For\u00adward local port on a remote machine to the local machine:<\/p>\n\n\n\n
    ssh -R...<\/pre>\n\n\n\n
    The net\u00adwork lay\u00adout is A -> B -> C -> D.<\/p>\n\n\n\n