SSH Remote Dynamic Port Forwarding
With remote port forwarding,
we were able to forward packets to one socket per SSH connection.
However, just as we found with local port forwarding,
this single-socket-per-connection limitation can slow us down.
We often want more flexibility when attacking networks,
especially in the enumeration stages.
Luckily, remote dynamic port forwarding can provide this flexibility.
Just as the name suggests, remote dynamic port forwarding
creates a dynamic port forward in the remote configuration.
The SOCKS proxy port is bound to the SSH server,
and traffic is forwarded from the SSH client.
To conceptualize how useful this might be, let’s apply it to our previous scenario.
This diagram illustrates how the network layout would improve if we were to apply
remote dynamic port forwarding to the remote port forwarding scenario.
It’s much more flexible.
Suddenly, we are able to connect to other ports and hosts
through the same connection.
Remote dynamic port forwarding is just another instance
of dynamic port forwarding, so we gain all the flexibility
of traditional dynamic port forwarding alongside the benefits of the
remote configuration.
We are able to connect to any port on any host that CONFLUENCE01 has access to
by passing SOCKS-formatted packets through the SOCKS proxy port that is bound
on our Kali machine.
Let extend our scenario again.
This time we find a Windows server on the DMZ network.
The firewall prevents us from connecting to any port on MULTISERVER03,
or any port other than TCP/8090 on CONFLUENCE01 from our Kali machine.
But we can SSH out from CONFLUENCE01 to our Kali machine,
then create a remote dynamic port forward so we can start enumerating MULTISERVER03
from Kali.
The SSH session is initiated from CONFLUENCE01,
connecting to the Kali machine, which is running an SSH server.
The SOCKS proxy port is then bound to the Kali machine on TCP/9998.
Packets sent to that port will be pushed back through the SSH tunnel
to CONFLUENCE01, where they will be forwarded based on where
they’re addressed - in this case, MULTISERVER03.
To demonstrate exactly how useful remote dynamic port forwarding can be,
let’s set up an example in the lab.
Once we have a reverse shell from CONFLUENCE01,
and have enabled SSH on our Kali machine,
we can start crafting the remote dynamic port forwarding command.
The remote dynamic port forwarding command is relatively simple,
although slightly confusingly,
it uses the same -R option as classic remote port forwarding.
The difference is that when we want to create a remote dynamic port forward,
we pass only one socket: the socket we want to listen on the SSH server.
We don’t even need to specify an IP address; if we just pass a port,
it will be bound to the loopback interface of the SSH server by default.
To bind the SOCKS proxy to port 9998 on the loopback interface
of our Kali machine, we simply specify -R 9998 to the SSH command
we run on CONFLUENCE01.
We’ll also pass the -N flag to prevent a shell from being opened.
Back on our Kali machine, we can check that port 9998 is bound by using ss.
The SOCKS proxy port has been bound on both the IPv4 and IPv6 loopback interfaces
on our Kali machine.
We’re ready to use it!
Just as we did in the classic dynamic port forwarding example,
we can use Proxychains to tunnel traffic over this SOCKS proxy port.
We’ll edit our Proxychains configuration file at /etc/proxychains4.conf on our
Kali machine to reflect our new local SOCKS proxy port.
We can then run nmap with proxychains as we did before,
this time against MULTISERVER03.
After a few minutes, we receive our results and discover ports 80, 135,
and 3389 are open.
In this section, we used SSH remote dynamic port forwarding to open
a SOCKS proxy port on our Kali machine by initiating an SSH connection
from a remote compromised host.
We then used Proxychains to port scan a host on the internal network
through the SOCKS proxy port.