A Simple Port Forwarding Scenario
Let’s examine a port forwarding scenario.
During an assessment, we find a Linux web server running a version of Confluence
vulnerable to CVE-2022-26134: a pre-authentication remote code
execution issue.
We can exploit this vulnerability and gain a reverse shell from the server.
During our enumeration, we find that this server has two network interfaces:
one attached to the same network our Kali machine is also on,
which allowed us to route to it directly, and another on an internal subnet.
In the Confluence configuration file, we also find credentials and the IP address
and port for a PostgreSQL database instance on a server in that
internal subnet.
We want to use these credentials to gain access to the database
and enumerate further.
Let’s review a diagram which shows the network layout as we understand it so far.
One of the first things to notice about this diagram
is that there are two named networks: the Wide Area Network (WAN) on the left,
and the Demilitarized Zone (DMZ) on the right.
Our Kali machine is in the WAN,
the PostgreSQL database server PGDATABASE01 is in the DMZ,
and the Confluence server CONFLUENCE01 straddles both.
A WAN is a network that is large and expansive.
Some people refer to the public internet as the largest WAN in the world,
and some larger organizations will refer to their large internal network as a WAN,
or internal WAN.
In this case, since we’re simulating an attack from an external network,
the WAN represents a large corporate internal network,
or the internet itself.
A DMZ is a network containing devices that may be more exposed to a wider,
less trusted network.
A DMZ helps create a buffer zone between hosts on the wider,
less trusted network and internal hosts.
In this way, it serves a similar function to a real-world Demilitarized zone.
In this scenario, the DMZ is the buffer network segment between the WAN
and whatever other internal networks we may find.
CONFLUENCE01 is straddling both the WAN and DMZ
to illustrate that it is able to communicate on both networks.
CONFLUENCE01 is also listening on TCP port 8090,
illustrated by the “open socket” attached to the icon.
PGDATABASE01 is within the DMZ network boundary -
it does not straddle the WAN/DMZ.
Our Kali machine is not in the DMZ, so we can’t directly route to PGDATABASE01.
PGDATABASE01 also has an “open socket” attached to it,
illustrating that there’s something listening on TCP port 5432,
this is likely a PostgreSQL server, since the default port is 5432.
With the credentials we found on CONFLUENCE01,
we want to try to connect to this PostgreSQL port on PGDATABASE01
from our Kali machine.
Before getting into more detail,
let’s set up our lab environment to recreate the scenario we’ve described
so far.