Port Redirection and Pivoting
What to know
A pivot host has two interfaces; your goal is to reach a subnet you cannot route to directly. SSH is the standard tool: local forwarding (-L 8080:internal:80) exposes one service locally, remote forwarding (-R) pushes a port back out through the pivot, and dynamic forwarding (-D 1080) creates a SOCKS proxy for arbitrary destinations. Chain tools through it with proxychains. Where SSH is unavailable, use socat, chisel, ligolo-ng, plink.exe on Windows, netsh interface portproxy, or Meterpreter's autoroute plus the socks module.
Plan your payload direction before you launch. A reverse payload needs the pivot to carry traffic back out to your listener; if that path is blocked, use a bind payload and reach the bound port through the tunnel. For each hop, confirm three things: the pivot can reach the target port, you can reach the pivot, and the tool you want to run survives the tunnel.
Traps
- Forgetting
proxy_dnsin proxychains, so hostnames fail to resolve while IPs work. - Using raw-packet nmap through SOCKS; use
-sT -Pnand expect no ICMP, so host discovery fails. - Assuming the whole subnet is reachable when only one host actually forwards traffic.
- Losing track of which listener sits on which interface after a double pivot.
Rule of thumb
Test every new tunnel with something trivial (curl, nc -zv, nmap -sT -Pn -p<port>) before running an exploit through it. Debugging a tunnel and an exploit simultaneously is how hours disappear.