18 Port Redirection and SSH Tunneling

• improves security

• from a compromised device the attacker can not communicate to all devices

• receiving data on port x

• sending the datat to port y

Can be done via:

• socat on linux machines

• 
  

Sending a protocol as data stream within another protocol

• eg tunnel HTTP trough SSH

Can be done with ssh client:

• we can specify a listening port on the machine, which starts the ssh tunnel

• we can specify a target port (or ip:port) on the machine, which ends the ssh tunnel

• OS{19feb67af843b456112350dbaca23f38}

• opens a socks proxy on the host to enable dynamic routing

• use proxychains to interact with socks proxy

• we can only use local tunneling if the firewall allows inbound traffic to the listening port

• if the firewall blocks the local shh tunnel, we can use remote port forwarding

• remote port forwarding uses a compromised host to:

  • bind a port of your kali machine

  • forward that port to a ip:port which can be reached by the compromised host

Unix:

• ssh

Windows:

• ssh.exe?

• putty cli: Plink

• netsh (need admin permissions)