I'm pentesting a server infrastructure, and I already got in as an unprivileged user. I can run commands but some commands don't work, due to the nature of the reverse shell.

Using netstat I can see a server admin webapp running in a port that the firewall is blocking me out.

I want to leverage the fact that I'm running user space commands inside the server to create some way for my browser, running in my desktop, to connect to the admin app running in the blocked port.

In a way it's kind of a reverse shell, but a reverse shell that can then be used by the browser as a sort of socks proxy or something like that.

Is this even possible? What other ways you can think off? My goal is to connect to the blocked port. I can download files into the server into /tmp and execute them from there. The server is running ubuntu 14.04.5 LTS, if that matters.



It sounds like you have shell access so you should be able to setup an SSH tunnel and use the tunnel as a proxy in Firefox. Then you'd essentially be connecting to the server from itself.

  • I have pwned an unprivileged user who (I believe) can't login in SSH even if I set a password (/bin/nologin). – Alex Apr 10 '18 at 22:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.