Port Forwarding to access Internal services

LogoHTB: Sizzle0xdf hacks stuff

Let's say that hypothetically there is a firewall on the machine or a port that is only accesible through local host or whatever. We need to remote portforward a the local port we want to reach to one that we want to open on our kali machine.

The tool for the trade could either be plink.exe or chisel.exe

For this demonstration I will be using plink.exe because I am basing this off Tiberius's udemy course.

  1. Change the /etc/ssh/sshd_config file to permit root login

  2. Type service ssh restart

  3. Transfer plink.exe

  4. Execute on the victim machine as such: .\plink.exe root@our-ip -R <the-port-that-we-want-to-open-on-our-machine>:127.0.0.1:<local port that we want to reach>

For example if by any chance there is a website running we can simply visit it by curling our localhost and the port taht we opened or a sql database.

Hit enter a few times.

Chisel Port Forward

I can run exes out of windows\temp… I can’t read in there, so need to track what i upload. I’ll grab the chisel binary from site: https://github.com/jpillora/chisel/releases. I’ll start the server on my host, and start a python http server so I can get chisel to target. Then I’ll run:

The server sees:

Now kerberoast:

What? I’ll check the times:

For kerberos to work, times have to be within 5 minutes.

I’ll run again, and get the hash:

PreviousBypassing AVNextStart Up Apps

Last updated