ssh.exe
The OpenSSH client has been bundled with Windows by default since version 1803,
for the April 2018 Update, and has been available as a Feature-on-Demand
since version 1709 for the Windows 10 Fall Creators Update.
On Windows versions with SSH installed, we will find scp.exe, sftp.exe, ssh.exe,
along with other ssh-* utilities in the
%systemdrive%\Windows\System32\OpenSSH location by default.
Let’s practice this by creating a reverse dynamic port forward from MULTISERVER03,
a Windows machine, to our Kali machine.
In this scenario, only the RDP port is open on MULTISERVER03.
We can RDP in, but we can’t bind any other ports to the WAN interface.
Once we have our lab set up, it should appear as follows:
We will use the rdp_admin credentials we found earlier to RDP into the server.
We’ll then use ssh.exe to create a reverse dynamic port forward connection
to our Kali machine.
We can then use that to connect to the PostgreSQL database service
on PGDATABASE01.
First, let’s start by making sure the SSH server is running on our Kali machine.
We can then use xfreerdp from FreeRDP
to connect to the RDP server on MULTISERVER03.
Once we have a connection open, we can open a cmd.exe window and determine
whether SSH is on the box using where ssh.
Success!
We found ssh.exe on this machine.
Notably, the version of OpenSSH bundled with Windows is higher than 7.6,
meaning we can use it for remote dynamic port forwarding.
We can now create a reverse dynamic port forward to our Kali machine,
just as we did earlier.
We’ll pass the port 9998 to -R…
and authenticate as kali back on our Kali machine.
We can check that the SOCKS proxy port is opened on our Kali machine using ss.
Let’s update the /etc/proxychains4.conf file to use this socket.
Now that the configuration file is pointing at our remote dynamic
port forward SOCKS port, we can run psql through proxychains to connect
to the PostgreSQL database as the postgres user.
We’ll use the same psql command we would as if connecting directly
from MULTISERVER03.
The connection was a success!
We’re now interacting with the PostgreSQL database on PGDATABASE01 through
through an SSH remote dynamic port forward,
initiated from the OpenSSH client running on a Windows 11 machine.
In this section, we’ve set up a connection to a PostgreSQL database
running on a Linux server through an SSH remote dynamic port forward
made between a Windows SSH client and our Kali machine SSH server.