Pivoting Around Obstacles
Last updated
Last updated
Plink, short for PuTTY Link, is a Windows command-line SSH tool that comes as a part of the PuTTY package when installed.
Before the Fall of 2018, Windows did not have a native ssh client included, so users would have to install their own. The tool of choice for many a sysadmin who needed to connect to other hosts was PuTTY.
That is just one potential scenario where Plink could be beneficial. We could also use Plink if we use a Windows system as our primary attack host instead of a Linux-based system.
Another Windows-based tool called Proxifier can be used to start a SOCKS tunnel via the SSH session we created. Proxifier is a Windows tool that creates a tunneled network for desktop client applications and allows it to operate through a SOCKS or HTTPS proxy and allows for proxy chaining.
It is possible to create a profile where we can provide the configuration for our SOCKS server started by Plink on port 9050.
After configuring the SOCKS server for 127.0.0.1 and port 9050, we can directly start mstsc.exe to start an RDP session with a Windows target that allows RDP connections.
Sshuttle is another tool written in Python which removes the need to configure proxychains.
However, this tool only works for pivoting over SSH and does not provide other options for pivoting over TOR or HTTPS proxy servers.
We can configure the Ubuntu server as a pivot point and route all of Nmap's network traffic with sshuttle using the example later in this section.
One interesting usage of sshuttle is that we don't need to use proxychains to connect to the remote hosts. Let's install sshuttle via our Ubuntu pivot host and configure it to connect to the Windows host via RDP.
To use sshuttle, we specify the option -r to connect to the remote machine with a username and password.
Then we need to include the network or IP we want to route through the pivot host, in our case, is the network 172.16.5.0/23.
With this command, sshuttle creates an entry in our iptables to redirect all traffic to the 172.16.5.0/23 network through the pivot host.
Traffic Routing through iptables Routes
We can now use any tool directly without using proxychains.
Rpivot is a reverse SOCKS proxy tool written in Python for SOCKS tunneling.
Rpivot binds a machine inside a corporate network to an external server and exposes the client's local port on the server-side.
We will take the scenario below, where we have a web server on our internal network (172.16.5.135), and we want to access that using the rpivot proxy.
Another way to install python 2.7
We can start our rpivot SOCKS proxy server to connect to our client on the compromised Ubuntu server using server.py.
Running server.py from the Attack Host
Before running client.py we will need to transfer rpivot to the target. We can do this using this SCP command:
Transfering rpivot to the Target
We will configure proxychains to pivot over our local server on 127.0.0.1:9050 on our attack host, which was initially started by the Python server.
Finally, we should be able to access the webserver on our server-side, which is hosted on the internal network of 172.16.5.0/23 at 172.16.5.135:80 using proxychains and Firefox.
Some organizations have HTTP-proxy with NTLM authentication configured with the Domain Controller. In such cases, we can provide an additional NTLM authentication option to rpivot to authenticate via the NTLM proxy by providing a username and password. In these cases, we could use rpivot's client.py in the following way:
Netsh is a Windows command-line tool that can help with the network configuration of a particular Windows system. Here are just some of the networking related tasks we can use Netsh for:
Finding routes
Viewing the firewall configuration
Adding proxies
Creating port forwarding rules
We can use netsh.exe to forward all data received on a specific port (say 8080) to a remote host on a remote port. This can be performed using the below command.
Verifying Port Forward
After configuring the portproxy on our Windows-based pivot host, we will try to connect to the 8080 port of this host from our attack host using xfreerdp. Once a request is sent from our attack host, the Windows host will route our traffic according to the proxy settings configured by netsh.exe.
