From 198a70ae8983084db7a1ed9973e86214bcff9cf4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Faisal=20Fs=20=E2=9A=94=EF=B8=8F?= <51811615+faisalfs10x@users.noreply.github.com> Date: Thu, 13 Apr 2023 04:14:51 +0800 Subject: [PATCH 1/3] Update README.md SSH pivoting via ProxyJump --- README.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/README.md b/README.md index 6283674..5237be0 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,7 @@ Got tricks? Join us on Telegram: [https://t.me/thcorg](https://t.me/thcorg) 1. [SSH tunnel](#ssh-tunnel) 1. [SSH socks5 tunnel](#ssh-socks-tunnel) 1. [SSH to NATed host](#ssh-j) + 1. [SSH pivot via ProxyJump](#ssh-pj) 1. [Network](#network) 1. [Discover hosts](#discover) 1. [Tcpdump](#tcpdump) @@ -301,6 +302,28 @@ ssh -J 5dmxf27tl4kx@ssh-j.com root@5dmxf27tl4kx ``` The ssh connection goes via ssh-j.com into the reverse tunnel to the host behind NAT. The traffic is end-2-end encrypted and ssh-j.com can not see the content. + +**2.v SSH pivoting to multiple servers** + +SSH ProxyJump trick can save you a lot of time and hassle when working with remote servers. Let's assume the scenario as below. +We have $local-kali behind NAT, we want to ssh into $target-host without interactively login to each intermediary servers. +The route is; we can SSH to C2, the C2 can SSH to internal-jumphost via internal IP(eth1) and internal-jumphost can SSH to target-host via eth2. +``` + $local-kali -> $C2 -> $internal-jumphost -> $target-host +eth0 192.168.8.160 10.25.237.119 +eth1 192.168.5.130 192.168.5.135 +eth2 172.16.2.120 172.16.2.121 +``` +``` +# if we want to SSH to $target-host: +kali@local-kali$ ssh -J c2@10.25.237.119:22,jumpuser@192.168.5.135:22 target@172.16.2.121 + +# if we want to SSH to $internal-jumphost: +kali@local-kali$ ssh -J c2@10.25.237.119:22 jumpuser@192.168.5.135:22 +``` + + + --- ## 3. Network From 95969dea53f2462a358af687fdc9efe1b03441de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Faisal=20Fs=20=E2=9A=94=EF=B8=8F?= <51811615+faisalfs10x@users.noreply.github.com> Date: Thu, 13 Apr 2023 04:16:37 +0800 Subject: [PATCH 2/3] Update README.md SSH pivot via ProxyJump --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 5237be0..4f5f29d 100644 --- a/README.md +++ b/README.md @@ -310,9 +310,9 @@ We have $local-kali behind NAT, we want to ssh into $target-host without interac The route is; we can SSH to C2, the C2 can SSH to internal-jumphost via internal IP(eth1) and internal-jumphost can SSH to target-host via eth2. ``` $local-kali -> $C2 -> $internal-jumphost -> $target-host -eth0 192.168.8.160 10.25.237.119 -eth1 192.168.5.130 192.168.5.135 -eth2 172.16.2.120 172.16.2.121 +eth0 192.168.8.160 10.25.237.119 +eth1 192.168.5.130 192.168.5.135 +eth2 172.16.2.120 172.16.2.121 ``` ``` # if we want to SSH to $target-host: From 19c4d5f1dc5e3897b53fccae64250d721ff3610d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Faisal=20Fs=20=E2=9A=94=EF=B8=8F?= <51811615+faisalfs10x@users.noreply.github.com> Date: Thu, 13 Apr 2023 04:23:38 +0800 Subject: [PATCH 3/3] Update README.md fix formatting --- README.md | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 4f5f29d..969b314 100644 --- a/README.md +++ b/README.md @@ -308,22 +308,20 @@ The ssh connection goes via ssh-j.com into the reverse tunnel to the host behind SSH ProxyJump trick can save you a lot of time and hassle when working with remote servers. Let's assume the scenario as below. We have $local-kali behind NAT, we want to ssh into $target-host without interactively login to each intermediary servers. The route is; we can SSH to C2, the C2 can SSH to internal-jumphost via internal IP(eth1) and internal-jumphost can SSH to target-host via eth2. -``` +```sh $local-kali -> $C2 -> $internal-jumphost -> $target-host eth0 192.168.8.160 10.25.237.119 eth1 192.168.5.130 192.168.5.135 eth2 172.16.2.120 172.16.2.121 ``` -``` -# if we want to SSH to $target-host: +```sh +## if we want to SSH to $target-host: kali@local-kali$ ssh -J c2@10.25.237.119:22,jumpuser@192.168.5.135:22 target@172.16.2.121 -# if we want to SSH to $internal-jumphost: +## if we want to SSH to $internal-jumphost: kali@local-kali$ ssh -J c2@10.25.237.119:22 jumpuser@192.168.5.135:22 ``` - - --- ## 3. Network