1

If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so:

ssh [email protected] -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10.0.0.45:139

Then I would configure Nessus to scan localhost or 127.0.0.1 with credentialed checks, using the Windows admin username and password.

Trouble is that Nessus detects that it has command execution on my local Linux host and mixes the results from the target host with my local host.

Not normally a problem as I should be able to differentiate Linux results from Windows, but just wondered if there was a way to tell Nessus not to query the local machine in the interests of clean separation of results.

Note that limiting the ports to 139 and 445 and setting the Test the local Nessus host setting have no effect on this.

Improve this question
1
  • Maybe try listening and attacking 127.0.0.2, another option is to use ssh -D and run nessus with proxychains, or if nessus has support for proxies configure it.
    – Jonathan Allon
    Jun 7, 2017 at 15:52

1 Answer 1

Reset to default
0

You could instead set up a layer 3 tunnel over SSH and route directly to the windows target (see below link for example).

https://wiki.transmission.ninja/doku.php?id=networking:layer_3_vpn_over_ssh

This would solve the issue of you scanning the linux target as you will be able to scan the windows IP address directly.

You could also use a tool called sshuttle for this, but I find that can be a little buggy sometimes.

Improve this answer
3
  • This is a link-only answer. Please include the relevant parts of the link in your answer. And explain how this solves the issue.
    – schroeder ♦
    Oct 30, 2020 at 16:25
  • @schroeder, the wiki link I shared is an example of how to setup a layer 3 tunnel over SSH. This solves the issue since instead of scanning 127.0.0.1 you can route directly to your target IP address.
    – transmission
    Oct 31, 2020 at 0:51
  • **Please include the relevant parts of the link in your answer. ** And edit your question to provide the relevance.
    – schroeder ♦
    Oct 31, 2020 at 8:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .