BASH FOR WINDOWS SSH TUNNEL HOW TO

Regardless of what kind of access I have to my beachhead, I’m going to want to scan the new network for host and port discovery. Bash scripting will take you a long way even if it’s just doing a ping sweep in parallel (putting the command in () with a & at the end will start them all in parallel, so this runs in a for i in $( seq 1 254 ) do (ping -c 1 10.2.2. They will likely have python and perl, and potentially gcc for compiling things. Linux workstations may have nmap already installed.

BASH FOR WINDOWS SSH TUNNEL HOW TO

Live Off the Land Why?īefore going to a ton of effort to figure out how to get your workstation talking to target hosts through the beachhead, consider what you can do from the beachhead itself, since you can already run commands there.

But, more often than not, I’ll find myself with only a nc reverse shell, and I’ll show some options here as well. The best case is if I can ssh into that host, because it allows me to port forward, and better yet, opens the door for a really nice tool, shuttle. How I do that will depend on what kind of access I have to the beachhead host. But there will be times that you want to use tools on your workstation to communicate with hosts through the beachhead. There’s a lot you’ll be able to do from the beachhead itself. The goal here is to send traffic through a compromised host (which I’ll refer to as beachhead) to other target hosts the beachhead can talk to.

Updated on to add references to two additional tools, Chisel and SSF. In this post I’ll attempt to document the different methods I’ve used for pivoting and tunneling, including different ways to use SSH, sshuttle, and meterpreter, as well as some strategies for how to live from the host you are currently working through.

I’ve run into this in Sans Netwars, Hackthebox, and now in PWK. But once you realize that you need to pivot through that host deeper into the network, it can take you a bit out of your comfort zone. That beautiful feeling of shell on a box is such a high.

Bash for windows ssh tunnel