Forwarding one port on the client system to exactly one port accessible from the SSH pivot server. It's still confusing no matter how many times I read it.
# Below sets up local port 8123 forwarded thru victim to reach port 80 on target.localssh -L 8123:target.local:80 [email protected]curl localhost:8123attacker:8123 -> 10.0.0.1:22 -> 10.0.0.5:80# Below forwards a port on the victim localhost to be accessible (i.e. MySQL for localhost only)ssh -L 3306:localhost:3306 [email protected]mysql -u root -p
SOCKS Proxy used to forward several ports. Can use
proxychains to help non-proxy aware programs to reach the intended destination. Do not try to port scan through a SOCKS proxy, it is VERY SLOW!!
ssh -D 9123 [email protected]
A port on the pivot system is forwarded to a local port, not commonly used.
ssh -R :8123:localhost:80ssh -R :8000:www.google.com:80
Can use built in mechanisms in meterpreter/msf to port forward or route easily
# Cmd below will create a local port on 0.0.0.0:4321 to reach target:80meterpreter > portfwd add -l 4321 -r target -p 80