Using sshuttle
In situations where we have direct access to an SSH server,
behind which is a more complex internal network,
classic dynamic port forwarding might be difficult to manage.
sshuttle is a tool that turns an SSH connection into something similar
to a VPN by setting up local routes that force traffic through the SSH tunnel.
However, it requires root privileges on the SSH client and Python3
on the SSH server, so it’s not always the most lightweight option.
In the appropriate scenario, however, it can be very useful.
In our lab environment, we have SSH access on PGDATABASE01,
which we can access through a port forward set up on CONFLUENCE01.
Let’s run sshuttle through this to observe its capabilities.
First, we can set up a port forward in a shell on CONFLUENCE01,
listening on port 2222 on the WAN interface,
and forwarding to port 22 on PGDATABASE01.
Next, we can run sshuttle, specifying the SSH connection string we want to use,
as well as the subnets that we want to tunnel through this connection.
Although we don’t receive much output from sshuttle, in theory,
it should have set up the routing on our Kali machine so that any requests we make
to hosts in the subnets we specified will be pushed transparently
through the SSH connection.
Let’s test if this is working by trying to connect to the SMB share on HRSHARES
in a new terminal window.
Great!
We’re now connecting to HRSHARES transparently,
as though we are on the same network and have direct access.
In this section, we used sshuttle to create a VPN-like environment.
We were then able to connect transparently to HRSHARES from our Kali machine,
as though we were on the same network as PGDATABASE01.