SSH Tunneling Part 1

SSH Tunneling

Introduction

Tunneling and pivoting are crucial techniques in penetration testing. They enable penetration testers to access restricted networks and exploit internal resources after establishing a foothold. This blog post is the first in a series where we will explore these concepts and lay the groundwork for practical applications.
In the upcoming posts, we will delve into more advanced tunneling techniques across different operating systems, including Chaining Proxy using software like an SSH client, Ligo-Ng, and Proxifier, among others.

What is Tunneling?

Tunneling, or proxying, involves creating a pathway to route desired traffic through a compromised host, encapsulating one network protocol within another. Various protocols, such as HTTP, SSH, or custom proxies, can direct this traffic into the target network. This technique allows penetration testers to transmit data securely through restrictive network environments. It can be compared to building a secret tunnel through a firewall to access internal systems.

  • Example: Using SSH to forward traffic from a pentester’s machine to a remote server.
  • Tools: SSH Tunneling, Socat, VPNs, Chisel, Socat, FoxyProxy, sshuttle, and Ligolo-ng.

Now that we understand tunneling, often the first step in securely accessing a target network, the next challenge is navigating within the network. Once inside, the focus shifts to leveraging the initial access point to explore additional hosts and systems. This is where pivoting becomes essential.

What is Pivoting?

Pivoting occurs when a pentester uses a compromised system to access and explore other systems within a target network. It is essential for lateral movement in segmented networks.

  • Example: Gaining a foothold on a DMZ server, then using it to access an internal database.
  • Types:
    • Proxy-based pivoting: Routing traffic through the compromised host (e.g., SOCKS proxy – SSH Local, Remote, and Dynamic Port Forwarding).
    • VPN-style pivoting: Creating a tunnel that routes all traffic through the target system. (e.g., Tunneling like a VPN – Ligolo-ng)

Why It’s Important in Pentests

Modern networks are segmented for security purposes. Without proper pivoting, a tester’s access often ends with the initial foothold. Tunneling facilitates navigation through these restrictions, allowing the discovery of high-value assets.

Real-World Relevance:

  • When the Kali pentest machine is deployed on the client’s network but is not directly accessible, access is restricted to passing through two intermediary systems. These systems create a layered network structure that adds complexity to direct communication.
  • Accessing sensitive data stored deep within the network.
  • Exploiting internal-only services such as databases, LDAP, file shares, and reaching different subnets.
  • Conducting reconnaissance on segmented subnets.
  • Executing Windows tools through tunneling using Linux systems.

Port Forwarding: A Key Technique for Pivoting

Port forwarding is a networking technique that allows external devices or systems to access services on a private network. It redirects communication requests from one address and port combination to another, typically passing through a router or firewall. This is particularly useful for enabling access to servers or devices on a local network from an external network, such as the Internet.

In a penetration test (pentest) context, port forwarding refers to connecting a port on your local machine to a specific port on the target machine through a compromised host. This method is generally faster and more reliable than tunneling but is limited to specific ports. Port forwarding is crucial when attackers seek to access internal systems or services behind a firewall or Network Address Translation (NAT). During a pentest, this technique is commonly used for pivoting. It allows the tester to interact with services on an internal network from an external position, often after initially breaching an external-facing system.

SSH Config File: Optional Extra Step 

To configure SSH on the client side:

1. Edit Config:

nano ~/.ssh/config

2. Add Server Details:

Host rbt
    HostName 192.168.1.100
    User username
    Port 22
    IdentityFile ~/.ssh/id_rsa

3. Connect:

ssh rbt

Local Port Forwarding: Accessing local Services on a Single Machine

Local Port Forwarding (LPF) is a technique for forwarding traffic from a local port on your machine to a destination system or service accessible only through a remote server. It lets you interact with internal services hidden behind a firewall or NAT.

If a service (such as a Nessus or webserver) runs on ports 8080 and 5000 on the remote server (AWS Kali machine), we can now access it by connecting to localhost:8834 on our local machine.

ssh -fNC -L [local_port]:[target_host]:[target_port] [user]@[ssh_server]
ssh -fNC -L 8834:localhost:8834 rbt

Parameters:

  • -f: Puts the SSH session into the background after the connection is established.
  • -N: Tells SSH not to execute any commands on the remote server.
  • -C: Enables compression for the SSH tunnel.
  • local_port: The port on your local machine to listen on.
  • target_host: The remote machine you want to access.
  • target_port: The port on the remote machine where the service is running.
  • user: Your SSH username.
  • ssh_server: The SSH server (e.g., Server host ip).

Remote Port Forwarding: Exposing Local Services to the Outside World

Remote Port Forwarding (RPF) allows a machine inside a private network (or behind a firewall/NAT) to expose a service or port to the outside world by creating a tunnel through an SSH server. It essentially makes a service running on a local system accessible from a remote system.

If we are running a web server (python webserver) on localhost on port 9090 on our local machine, after running this command, a user on the remote machine (AWS Kali machine) could access it by navigating to http://localhost:9090

ssh -fNC -R [remote_port]:[local_host]:[local_port] [user]@[remote_server]
ssh -fNC -R 9090:localhost:9090 rbt

Parameters:

  • -f: Puts the SSH session into the background after the connection is established.
  • -N: Tells SSH not to execute any commands on the remote server.
  • -C: Enables compression for the SSH tunnel.
  • remote_port: The port on the remote server that will listen for incoming connections
  • localhost_host: Specifies the host on your local machine or a network-reachable host where the traffic should be forwarded.
  • user: Your SSH username.
  • ssh_server: The SSH server (e.g., remote host ip).

Dynamic Port Forwarding: Secure Access to Multiple Internal Systems

Dynamic Port Forwarding is an SSH feature that allows you to create a SOCKS proxy. This proxy enables you to route multiple connections from your local machine through an SSH server to any remote host. It’s like having a flexible, encrypted gateway for your traffic.

Dynamic Proxy created through Dynamic Port Forwarding is a crucial technique that every penetration tester must understand. It allows for flexible routing of network traffic over an encrypted SSH tunnel. This is especially useful when the pentester needs to bypass firewalls, access internal networks, or evade detection. In other words, unlike local or Remote Port Forwarding, Dynamic Port Forwarding doesn’t bind to specific ports or addresses—it allows traffic to multiple destinations.

ssh -fNC -D 1080 user@remote.example.com
ssh -fNC -D 1080 rbt

Once the SSH tunnel is established, we must configure our tools or browsers (FoxyProxy) to send traffic through the SOCKS proxy.

Conclusion

Tunneling is an essential technique in a penetration tester’s toolkit. It enables access to remote services, evasion of network restrictions, and increased security during assessments. Whether through Local Port Forwarding, Remote Port Forwarding, or Dynamic Port Forwarding (SOCKS proxy), each method offers unique advantages depending on the engagement’s specific requirements.

Using SSH tunnels for port forwarding, penetration testers can securely direct traffic through intermediate servers, bypass firewalls, and access services otherwise restricted or hidden behind network segmentation. Dynamic port forwarding, in particular, offers a flexible and discreet method for routing various types of traffic through an encrypted tunnel, enabling unobtrusive access to a range of services within the target network.

In conclusion, mastering tunneling techniques such as Local, Remote, and Dynamic Port Forwarding enables penetration testers to expand their attack surface, maintain anonymity, and conduct more thorough and effective assessments. As both attackers and defenders evolve their strategies, tunneling remains vital for ensuring that penetration tests are comprehensive and secure.

Detections & Mitigations

Detection

Tunneling (e.g., SSH tunneling, SOCKS proxies, Port Forwarding) can be used by attackers to bypass network defenses or exfiltrate data through a covert channel. The MITRE ATT&CK Framework identifies several techniques that might be used in such scenarios. Below are the primary detection methods and relevant ATT&CK techniques:

1. Technique: T1071 – Application Layer Protocol

  • Description: Attackers may tunnel traffic through application layer protocols (like SSH or HTTP.
  • Detection Methods:
    • Monitor SSH Traffic: Look for SSH connections (particularly long-lived connections) on non-standard ports or unexpected destinations. Flag unexpected SSH tunneling behavior, such as tunneling through port 443 (HTTPSd.
    • Traffic Analysis: Analyze traffic patterns and payloads. Large amounts of traffic over uncommon ports could indicate tunneling. Tools like Zeek (formerly known as Bro) can monitor and alert SSH traffic anomalies.
    • Network Flow Analysis: Check for unusual or encrypted traffic between internal and external systems. Investigate traffic that passes through suspicious proxy servers or seems to establish unauthorized tunnels.

2. Technique: T1073 – Tunneling Protocol

  • Description: Attackers may leverage protocols such as SSH or VPN to create tunnels.
  • Detection Methods:
    • SSH/Proxy Tunnel Detection: Implement intrusion detection systems (IDS) such as Snort or Suricata to detect tunneling behaviors (e.g., unusual SSH packets).
    • Inspect Firewall Logs: Watch for patterns that indicate connections are being made via SSH on non-standard ports. If SSH is being used, check the originating IPs for anomalies.
    • Monitoring Proxy Configurations: Any automatic configurations of proxy servers or socks5 proxies should be logged and examined to detect unauthorized tunneling.

3. Technique: T1090 – Proxy

  • Description: Attackers may configure proxies for network communication.
  • Detection Methods:
    • Network Scanning: Regularly scan the network for newly configured SOCKS proxies or unexpected changes to network configurations.
    • Web Proxy and SOCKS Proxy Logging: Monitor for unauthorized or unusual connections using proxy services. Attackers can use tools like Burp Suite or FoxyProxy to route traffic through proxies.
    • Inspect Application Traffic: Analyze HTTP(S) traffic for anomalies indicating that it is being tunneled through a proxy. Looking for unusual patterns in HTTP headers or the use of uncommon tunneling protocols.

4. Technique: T1080 – T1070 – Indicator Removal

  • Description: Attackers may try to remove traces of tunneling activity by clearing logs.
  • Detection Methods:
    • Centralized Logging and Monitoring: Ensure that logs are stored centrally and are immutable (e.g., in a SIEM). Logs should be protected against unauthorized changes or deletions.
    • Integrity Checking: Regularly check logs for tampering or unauthorized access attempts. Alerts should be set up for suspicious log deletion activities or file system tampering.

Mitigation

Mitigating tunneling techniques (like port forwarding or SSH tunneling) requires layered defense and proactive network monitoring. Below are the main mitigation strategies based on MITRE ATT&CK:

1. Mitigation: T1071 – Application Layer Protocol

  • Use of Application Layer Gateways (ALGs):
    • Deep Packet Inspection (DPI): Utilize DPI to inspect encrypted traffic and block traffic that matches known tunneling patterns.
    • Application Layer Filtering: Apply SSH and VPN protocol filters to detect anomalies and block unauthorized application-level protocols.
    • Block Unnecessary Services: Disable unused application layer protocols, especially SSH, on non-standard ports or other tunneling applications like SOCKS5 proxies.

2. Mitigation: T1073 – Tunneling Protocol

  • SSH Hardening:
    • Use Strong Authentication: Ensure SSH keys are properly managed and require multi-factor authentication (MFA) wherever possible. Avoid using password-based authentication for SSH.
    • Limit SSH Access: Only allow SSH access from known and trusted IPs. Use firewall rules to restrict access to the SSH port (especially if using a non-standard port).
    • Disable SSH Tunneling: Explicitly disable port forwarding on the SSH server. In OpenSSH, this can be done by setting AllowTcpForwarding no in the SSH server configuration.
    • Monitor SSH Logs: Regularly review SSH logs for unusual activities or unauthorized tunneling attempts.

3. Mitigation: T1090 – Proxy

  • Proxy Detection and Blocking:
    • Enforce Proxy Controls: Configure firewalls to block unauthorized proxy traffic. Limit proxy use to only legitimate services (such as corporate VPNs).
    • Monitor Proxy Use: Use SIEM systems to detect any proxy usage that does not correspond to approved usage.
    • Limit Outbound Connections: Restrict access to known proxies and limit outbound traffic to only necessary destinations.

4. Mitigation: T1080 – T1070 – Indicator Removal

  • Logging and Alerting:
    • Centralized and Immutable Logging: Store logs in a centralized and tamper-resistant log management system to ensure that attackers cannot remove or alter indicators of tunnelings.
    • Alerting: Implement real-time alerting for suspicious activities that could indicate tunneling, such as long-lived or unexpected SSH sessions or the use of proxy services.

5. Other Mitigations

User Education: Educate staff about the risks of tunneling and the importance of using secure network communication methods.

Network Segmentation: Use network segmentation to isolate sensitive internal services and systems and prevent unauthorized tunneling into high-value targets.

Encryption and VPN: Use encryption tools and enforce VPN access policies for legitimate, secure access to remote systems. Block or filter unauthorized VPN and tunneling protocols.

Share the Post:

Table of Contents

Subscribe To Our Blog

Light