SSH Remote Port Forwarding
In our examples so far, we’ve been able to connect to
any port we bind on the WAN interface of CONFLUENCE01.
This is more challenging in the real world because,
more often than not, firewalls are likely to get in the way.
Inbound traffic is often controlled much more aggressively than outbound traffic.
Only in rare cases will we compromise credentials for an SSH user,
allowing us to SSH directly into a network and port forward.
We will only very rarely be able to access ports
that we bind to a network perimeter.
However, we will more often be able to SSH out of a network.
Outbound connections are more difficult to control than inbound connections.
Most corporate networks will allow many types of common network traffic out.
So while it likely won’t be possible to connect to
a port we bind to the network perimeter,
it will often be possible to SSH out.
This is where SSH remote port forwarding can be extremely useful.
In a similar way that an attacker may execute a remote shell payload
to connect back to an attacker- controlled listener,
SSH remote port forwarding can be used to
connect back to an attacker- controlled SSH server,
and bind the listening port there.
We can think of it like a reverse shell, but for port forwarding.
Let’s reconsider our lab scenario, and take a small step backwards.
As before, we compromise CONFLUENCE01 using CVE-2022-26134.
However, in this scenario,
the administrators decided to improve network security
by implementing a firewall at the perimeter.
The firewall is configured so that,
regardless of whether we bind a port
on the WAN interface of ONFLUENCE01 or not,
the only port we can connect to from our Kali machine is TCP 8090.
As we did in the Socat section,
we want to enumerate the PostgreSQL database running on port 5432
on PGDATABASE01.
CONFLUENCE01 doesn’t have the tools to do this.
Because of the firewall, we can’t create any port forward
that requires opening the listening port on CONFLUENCE01.
However, CONFLUENCE01 does have an SSH client,
and we can set up an SSH server on our Kali machine.
We can connect from CONFLUENCE01 to our Kali machine over SSH.
The listening TCP port 2345
is bound to the loopback interface on our Kali machine.
Packets sent to this port are pushed by the Kali SSH server software
through the SSH tunnel back to the SSH client on CONFLUENCE01.
They are then forwarded to the PostgreSQL database port on PGDATABASE01.
Let’s set this up in our lab.
First, we’ll need to enable the SSH server on our Kali machine.
OpenSSH server is preinstalled - all we need to do is start it.
We can check that the SSH port is open as expected using ss.
The SSH server is listening on port 22 on all interfaces for both IPv4 and IPv6.
Once we have a reverse shell from CONFLUENCE01,
we can create an SSH remote port forward
as part of the SSH connection back to our Kali machine.
The SSH remote port forward option is -R,
and has a very similar syntax to the local port forward option.
It also takes two socket pairs as the argument.
The listening socket is defined first, and the forwarding socket is second.
In this case, we want to listen on port 2345 on our Kali machine,
and forward all traffic to the PostgreSQL port on PGDATABASE01.
The SSH connection back to our Kali machine was successful.
We can confirm that our remote port forward port
is listening by checking if port 2345
is open on our Kali loopback interface.
It is!
Our port forward is now set up as we intended,
with the SSH port forward command running on CONFLUENCE01.
We can now start probing port 2345 on the loopback interface of our Kali machine,
as though we’re probing the PostgreSQL database port on PGDATABASE01 directly.
On our Kali machine, we will use psql, passing 127.0.0.1 as the host (-h),
2345 as the port (-p),
and using the database credentials of the postgres user
we found earlier on CONFLUENCE01.
Success!
We’re now interacting with the PostgreSQL instance running on PGDATABASE01
through our SSH remote port forward
by connecting to port 2345 on our own Kali machine.
In this section, we created an SSH remote dynamic port forward
to allow us to connect to an internal database server from our Kali machine.
We did this while traversing a perimeter firewall,
which would otherwise block inbound connections.