【Tunnel】portforwarding

Port forwarding

• socat : 課本18.2 範例
• rinetd：它更適合長期的端口轉發配置，但對於臨時端口轉發解決方案來說可能稍微不夠靈活。
• Netcat + 命名管道文件（FIFO）來創建端口轉發。 link

#!/usr/bin/env bash
# https://gist.github.com/holly/6d52dd9addd3e58b2fd5
set -e

if [ $# != 3 ]; then

        echo 'Usage: nc-tcp-forward.sh $FRONTPORT $BACKHOST $BACKPORT' >&2
        exit 1
fi

FRONTPORT=$1
BACKHOST=$2
BACKPORT=$3

FIFO=/tmp/backpipe

trap 'echo "trapped."; pkill nc; rm -f $FIFO; exit 1' 1 2 3 15

mkfifo $FIFO
while true; do
        nc -l $FRONTPORT <$FIFO | nc $BACKHOST $BACKPORT >$FIFO
done
rm -f $FIFO

• 如果我們擁有 root 權限，我們可以使用 iptables 創建端口轉發。對於特定主機的 iptables 端口轉發設置可能取決於已經存在的配置。要在 Linux 上轉發封包還需要在我們想要轉發的接口上啟用轉發，這可以通過向 /proc/sys/net/ipv4/conf/[interface]/forwarding 寫入 "1" 來實現（如果尚未配置允許的話）。

 

SSL forwarding

 

靜態

# kali -> vm1 (192.168.248.63 | 10.4.50.63) -> vm2(10.4.50.215|172.16.50.215)
#  靜態 ssh -N -L 0.0.0.0:{vm1_port}:{vm2_ip}:{vm2_port} database_admin@10.4.50.215
confluence@confluence01$ ssh -N -L 0.0.0.0:4455:172.16.50.217:445 database_admin@10.4.50.215
<0:4455:

動態

# kali -> vm1 (192.168.248.63 | 10.4.50.63) -> vm2(10.4.50.215|172.16.50.217:445215) -> vm3(172.16.50.217)
# 動態port forwarding
ssh -N -D 0.0.0.0:9999 database_admin@10.4.50.215

Could

# not修改設定檔
createkali@kali:~$ directoryvim '/home/confluence/.ssh'.etc/proxychains4.conf
The

authenticity

of

# hostkali '-> vm1 (192.168.248.63 | 10.4.50.21563) (-> vm2(10.4.50.215|172.16.50.215)' can't-> bevm3(172.16.50.217)
established.# ECDSAsmbclient
keykali@kali:~$ fingerprintproxychains issmbclient SHA256:K9x2nuKxQIb/YJtyN/YmDBVQ8Kyky7tEqieIyt1ytH4.-L Are//172.16.50.217/ you-U surehr_admin you--password=Welcome1234

want# tonamp
continuekali@kali:~$ connectingproxychains (yes/no/[fingerprint])?nmap yes-vvv yes-sT Failed--top-ports=20 to-Pn add the host to the list of known hosts (/home/confluence/.ssh/known_hosts).
database_admin@10.4.172.16.50.215's password:217