Last updated
Was this helpful?
Last updated
Was this helpful?
Port forwarding involves using any compromised host as a Jump Box to pivot to other hosts to which we do not have direct access from our attacking host. We configure the compromised host to listen on a port and relay all packets received on that port to another destination (and vice versa for a remote forward).
There are fore main types of port forwarding:
Local port forwarding: Open a local port on the compromised server and redirect incoming traffic to an other port on the same host or to a different host in a remote network.
Remote port forwarding: Open a local port on our attacking server and redirect incoming traffic to a port on a remote machine through a compromised intermediary machine (the Jump Box).
Dynamic port forwarding (Forward Proxy): tunnel the whole attacker's network traffic (instead of only one port) through the compromised machine opened SOCKS port.
Remote dynamic port forwarding (Reverse Proxy): tunnel the whole network traffic from a remote machine through the attacker's machine SOCKS port.
In brief, while in local and dynamic port forwarding, the listening port is bound to the client, in remote port forwarding and remote dynamic port forwarding, the listening port is bound to the server. It should be noted that we prefer to use remote techniques, which will open the port on our attacking machine and have a greater chance of evading network defences.
SSH Local Forwarding: Open a local port on the SSH client and redirect incoming traffic from that port to a specific port through the SSH tunnel established with the server.
SHH Remote forwarding: Open a remote port on the SSH server and redirect incoming traffic from that port to a specific port through the SSH tunnel established with the server.
SSH Dynamic port forwarding (Forward Proxy): The SSH client creates a local SOCKS proxy server port to tunnel the whole attacker's network traffic
SSH Reverse dynamic port forwarding (Reverse Proxy): The SSH client creates a remote SOCKS proxy server port on the SSH server to tunnel the whole attacker's network traffic
This example opens a connection to the jump-server.net, and forwards any connection to port 80 on the local machine (attacking machine) to port 80 of intra.example.com.
Windows version is unlikely to bypass Antivirus software by default, so custom compilation may be required.
Setting up a Local port forward with SOCAT involves opening a listening port on the compromised server and redirecting incoming traffic to a target server.
Using this command on the Jump-Box will open port 33060 on it, and forward any connection from this port to port 3306 on 172.16.0.10.
Setting up a Reverse Proxy involves connecting from the compromised server to a listener on the attacking machine. Then, the Chisel client (Jump Box) opens/creates a remote SOCKS proxy server port on the Chisel Server (Attacking Host).
On the attacking host:
On the compromised host, after uploading chisel, we use the following command:
Once configured, you can use proxychains on your attacking host to run applications through the proxy network connections.
To create a reverse connection, we can execute the following command on our compromised host (Jump Box).
As with SSH Remote Forwarding, any connection on ATTACKING_IP:8000 will be redirected on 172.16.0.10:80.
On windows, Netsh requires administrative privileges to create a port forward.
We can setup a Local Port Forward using the Netsh commands on the compromised host (Jump Box).
The following command will open the local port 2222 on the Jump Box, and forward any connection from it to 192.168.50.44:22.
Then, we ensure that the connections will be allowed on firewall
After we successfully performed our port forwarding, we can clear our tracks like so.
By using a SSH client with an OpenSSH server, it's possible to create both forward (local) and reverse (remote) connections to make , allowing us to forward ports, and/or create proxies.
We can use static binaries of socat to pivot, they are easy to find for both and .
is an awesome tool which can be used to quickly and easily set up a tunnelled proxy or port forward through a compromised system regardless of whether you have SSH access or not. It's written in Golang and can be easily compiled for any system (with static release binaries for Linux and Windows provided). It tunnels connections within the HTTP protocol and uses the SSH protocol within this tunnel to encrypt our data.
is a Windows command line version of the PuTTY SSH client. Now that Windows comes with its own inbuilt SSH client, plink is less useful for modern servers; however, it is still a very useful tool.
On windows target, we can perform port forwarding using the the built-in firewall configuration tool (also known as Network Shell).
MITRE ATT&CK™ Protocol Tunneling - Technique T1572
