Pivoting internal with ProxyChains SSH

 

So we found  our way into some SSH creds for a webserver. Now we want to pivot to the internal network and start some recon.

The problem is our pivot box doesn't have all those fancy hacking tools our attacking machine has on it, and we might not have permission to install them with our current credentials. Also it might raise some red flags if all these hacking tools show up on the webserver..

So how do we get around this?  

Meet my friends SSH tunnel and Proxy Chains.

You might have used SSH tunneling in the past as just a way to visit an internal URL from your external attacking machine.

but we can go even further than that we can use SSH tunneling to create a forwarding port to the  internal network and use all our favorite hacking tools using proxy chains.

We can use a couple of switches with SSH here.

-D allows us to specify a local port to tunnel to this connection, This is important if you are lazy.. use port 9050 because it's the default port for proxychains, which means we don't have to mess with changing the config file for proxy chains.

-N allows us to connect with out immediately dropping us into the SSH session 

-f allows us to background the SSH tunnel so it runs in the background and we have access to our terminal again.

ssh pwnduser@10.10.110.100 -D 9050 -N -f

Now that we have our SSH tunnel running in the background we can just throw proxychains in front of pretty much any command we want to run and it will forward all the traffic from that command over our ssh tunnel and start our recon on the internal network.

if we want to do an nmap scan of a box

we might normally just use "nmap -T4 -p- -Pn 10.10.10.100"

now we just stick proxychains in front of that command

proxychains nmap -T4 -p- -Pn 10.10.10.100

and nmap will send all its traffic over to our compromised webserver to scan the internal network.

pretty cool right?

here is some output of nmap running with proxychains over my SSH tunnel.

its kind a ugly and slow but it works.

A bit of advice if the tool you are using with proxychains has an output option... use it to write the output of the program directly to file instead of trying to decipher and find the output in all the proxychains output.