How to Use SSH Local Port Forwarding to Pivot into Restricted Networks « Null Byte :: WonderHowTo

SSH is a powerful tool with more uses than simply logging into a server. This protocol, which stands for Secure Shell, provides X11 forwarding, port forwarding, secure file transfer, and more. Using SSH port forwarding on a compromised host with access to a restricted network can allow an attacker to access hosts within the restricted network or pivot into the network.In this article, we'll look at one of the SSH port forwarding options, local port forwarding. Since this can be somewhat confusing, I'd like to talk a little bit about the idea of port forwarding first.Why Port Forwarding Is ImportantWhen we think of port forwarding, we usually think of it in the terms of a router. With a typical home internet setup, the router is connected to the WAN (wide area network), and it will have an IP address assigned by the ISP (internet service provider). On the other side of the router, you have your LAN (local area network). Hosts within the LAN are generally assigned IP addresses by the router.In most home setups, the router also acts as a firewall, allowing outboundTCPconnections and killing inbound connections. If you want to access a service on a machine within your local network, you will have to configure the router to forward connections on that port to your machine. This means that the entirety of the internet would have access to that service on your internal (or local) network. The router will take the incoming traffic destined for your service and forward it right on to your machine.Don't Miss:Hacker Fundamentals, a Tale of Two StandardsNow, let's expand on this a bit. Let's say the network is a little larger. We could have a Wi-Fi network for the public to use and another network for staff to use. All of the hosts would be connected to a gateway and segmented by the network. Like in our home example, we have one WAN connection, except this time we have two LANs. The router keeps the traffic from the public network from accessing the staff network.When SSH Port Forwarding Comes in HandyIf you have administrative control of the router, you can configure it to forward traffic into the staff network. But what if you don't have administrative control? Maybe you have a low-level user account and can SSH in, but you can't access the admin panel and you can't modify any of the settings.This is where SSH port forwarding comes in; we can use it to forward our traffic into a network we normally wouldn't be able to access, thus pivoting into the network. This doesn't just work on routers, this works on any node with SSH enabled and access to two or more internal networks.Let's Take a Look at This in ActionIn one scenario, we are connected to a publicperimeter network(demilitarized zone, or DMZ) at a local university. Through enumeration, we have discovered that the firewall is running SSH with extremely weak credentials. We're coming from the DMZ, and our target is the intranet. The only thing standing in our way is the firewall, which we can log in to via SSH, but our captured account isn't privileged enough to change any settings.The firewall protects the intranet (university staff hosts, the target) from external malicious traffic, but allows both networks access to the internet. We are unable to connect to hosts in the LAN from the DMZ, and based on the ease of access to the firewall, I suspect the hosts on the LAN are incredibly soft. Weak credentials combined with a lot of administrators not treating their internal networks as hostile means the security on the hosts within the LAN should be next to none.Image by Pbroks13/Wikimedia CommonsSince it's an internal staff network, it probably contains or has access to quite a bit of confidential information. If we're conducting a penetration test as a white hat, we want to be able to put that confidential information in a report. If we're black or gray hats, we might be looking to exfiltrate, change, or delete that data. The question is how do we get access?In order to access the internal network, we're going to have to get tricky and pivot into it, since we can't directly connect to it. This is where SSH port forwarding comes in handy.Step 1: The SetupIn this situation, we have three machines — our attacking machine, the firewall, and a host within the internal network. In a real engagement, there will usually be more than one machine on the internal network, but for learning purposes, all we need is one machine.My attacking machine is on the 192.168.1.0/24 network, which represents the DMZ network. The firewall is accessible as a gateway from the DMZ on the same network. It is also accessible as a gateway from the internal network, which is in the 192.168.56.0/24 range. These addresses are represented usingCIDRnotation.Our network.The goal here is to be able to discover and attack hosts within the internal network from the DMZ network. Since we can't just connect directly to a host within the internal network, we will use the DMZ firewall's SSH service to reroute our traffic into the internal network.Many beginners are not aware of the full feature set of SSH. Without a pivot into the internal network, an attacker would be totally reliant on the toolset contained on the compromised firewall. Which is likely extremely limited. Sometimes you'll getNmapif you're lucky. An attack could be carried out in this manner, but it's much easier to work with a large toolkit like the one included in Kali Linux. Tools likeMetasploitcan really make things easier.Don't Miss:Getting Started with MetasploitTo simulate this setup, I configured a virtual machine within the compromised host with a host-only adapter. This makes the victim non-routable by traffic on my DMZ network. If you want to try this at home, simply create a Linux virtual machine with SSH enabled inVirtualBoxand configure the network adapter to host only. The host operating system will need to have SSH enabled, and you will need another machine to access the host operating systems SSH service.When all the configuration is done, we should have a setup that looks like this:What happens when the attacking machine attempts to ping the guest machine? We can't route traffic to the victim machine, but we can access the host machine via SSH, and that's all we need.Here, we see that the attacking host cannot route to the vboxnet0 network.Don't Miss:How to Pivot from a Victim System to Own Every Computer on the NetworkStep 2: Gathering InformationBefore I can properly pivot in the network, it's probably a good idea to have a look at what I have access to via the firewall. I open a terminal and login with SSH by typing the following, replacingvictimmachinewith the IP address of the victim computer we have access to.ssh user@victimmachineI didn't post the full output of the ifconfig here since my machine has quite a few interfaces and the full output would be confusing. Since I set up these networks, I know the interface that we are targeting. If this were an actual penetration test, part of the post-enumeration of hosts is gathering connected interfaces, just in case there is a pivot available there. If there are multiple connected network interfaces, you should be able to pivot into any of those networks.Step 3: Local Port ForwardingUsing our SSH connection to the firewall, it's advised to do a bit of network recon. You will want to discover what hosts are active within the internal network. If you're lucky, Nmap will be installed on the compromised firewall, otherwise, you may have to resort a manual approach. The manual approach would be writing a ping sweep bash script (which will not spot machines with ping blocked). For this example, there is only one machine running on the network, and port 80 (HTTP) is open.Web applications are often an excellent attack vector. Depending on the owner of the process, a web application could return a low privilege shell all the way up to an admin shell. Except I have limited information. I know there is a web server running on the host in the internal network, I just don't know what it is.In order to learn more about this web application, I will configure a local port forward to the application using the following command.ssh -L 8080:internalTarget:80 user@compromisedMachineThe-Loption specifies that connections to the given TCP port on the local host are to be forwarded to the given host and port on the remote side. This allows us access to the internal network via the compromised firewall.In our case. the internal network is anything behind the vboxnet0 interface. More technically, this command creates an SSH tunnel using your local port 8080 to connect to the internal target machine through the firewall. SSH will listen on localhost port 8080 for any connections. When it receives a connection, it will tunnel data to an SSH server, in this case, our compromised firewall. The compromised firewall then connects to the target server and port returning data back across our SSH tunnel.When executing this command, you get a standard interactive SSH connection to the firewall, as well as port forwarding. If you don't want the shell, you can change the argument in your command to-NTL. TheNargument tells SSH to not execute a remote command, and theTargument tells SSH to disable pseudo-terminal allocation.Don't Miss:How to Use Remote Port Forwarding to Slip Past Firewall Restrictions UnnoticedUsing a simple SSH command, we have pivoted into an internal network that would normally not be accessible to us. This allows us to use our own toolkit instead of relying on the initially compromised host to have what we need.Of course, we aren't limited to forwarding HTTP. We can forward any port on the internal machine, including SSH, providing we know the port of the service we are attempting to forward.It's as easy as changing a port number in our SSH command. Below, we forward the SSH service on the victim machine back to our local port 8080. This would allow us to brute force SSH or try credentials for login if we have them.ssh -L 8080:internalTarget:22 user@compromisedMachineLocal port forwarding is a great way to pivot into internal networks. It is also an excellent way to bypass network restrictions, such as a block on web traffic to Null Byte! Some networks, for example, may be locked down to only allow traffic to exit via a few limited ports. As an added bonus, all traffic we generate from the local host to SSH server is encrypted.In the next article, we'll be looking at remote port forwarding. It's similar to what we're doing with local port forwarding, but as always with traffic redirection, it's a brain twister. So make sure to keep an eye out for that guide in the future.As always, questions or comments you can reach me on Twitter@0xBarrow.Don't Miss:How to SSH into Your Raspberry Pi Using a USB-to-TTL Serial CableFollow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image and screenshots by Barrow/Null ByteRelatedHow To:Use Remote Port Forwarding to Slip Past Firewall Restrictions UnnoticedHacking Windows 10:How to Use SSH Tunnels to Forward Requests & Hack Remote RoutersHow To:Use the Cowrie SSH Honeypot to Catch Attackers on Your NetworkHow To:Run Your Favorite Graphical X Applications Over SSHHow To:Enable the New Native SSH Client on Windows 10How To:Configure a Reverse SSH Shell (Raspberry Pi Hacking Box)How To:Punchabunch Just Made SSH Local Forwarding Stupid EasyHow To:Use the Chrome Browser Secure Shell App to SSH into Remote DevicesSPLOIT:How to Make an SSH Brute-Forcer in PythonHow To:Create a Native SSH Server on Your Windows 10 SystemHow To:Locate & Exploit Devices Vulnerable to the Libssh Security FlawHow To:Share Your LAN Minecraft World with Your Linux-Savvy FriendsHow To:Configure Port Forwarding to Create Internet-Connected ServicesHow To:Port Forwarding for NewbiesHow To:Perform an Attack Over WAN (Internet)How To:Discover & Attack Services on Web Apps or Networks with SpartaHow To:Remotely Control Computers Over VNC Securely with SSHHow To:Create an SSH Tunnel Server and Client in LinuxHow To:Safely Log In to Your SSH Account Without a PasswordHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHow To:How Hackers Use Your IP Address to Hack Your Computer & How to Stop ItHow To:Protect Your Mac & Linux Computers from Hacks by Creating an iptables FirewallHow To:Spy on the Web Traffic for Any Computers on Your Network: An Intro to ARP PoisoningHow To:Run an FTP Server from Home with LinuxHow To:Share Your Laptop's Wireless Internet with Ethernet DevicesHacking Reconnaissance:Finding Vulnerabilities in Your Target Using NmapMastering Security, Part 2:How to Create a Home VPN TunnelUDP Flooding:How to Kick a Local User Off the NetworkHow To:Use Tortunnel to Quickly Encrypt Internet TrafficHow To:Mask Your IP Address and Remain Anonymous with OpenVPN for Linux