← Back to Academy

Academy Node

SSH Dynamic SOCKS Proxy

SSH dynamic forwarding creates a SOCKS proxy that can route multiple tools through an SSH pivot.

Intermediate100 XPPivoting

Why it matters

PEN-200 covers SSH dynamic port forwarding as a flexible way to enumerate internal networks through a compromised host.

How to identify it

  • SSH pivot host can reach internal network

Linux commands

ssh -N -D 127.0.0.1:1080 USER@TARGET
echo 'socks5 127.0.0.1 1080' | sudo tee -a /etc/proxychains4.conf
proxychains -q nmap -sT -Pn -p 80,445,3389 INTERNAL_IP
proxychains -q curl http://INTERNAL_IP

Expected output

  • Proxychains routes traffic
  • Internal ports reachable

Success looks like

  • Multiple internal services reachable through proxy

Failure looks like

  • Timeouts
  • DNS issues
  • Tool incompatible

Troubleshooting

  • Use TCP connect scans
  • Test with curl first
  • Use IPs before DNS

Common mistakes

  • Using SYN scan through SOCKS
  • Not using -sT
  • DNS leak/misconfig

Alternative attacks

  • sshuttle
  • Chisel
  • local forwards

What to try next

  • Internal enumeration
  • Web enum
  • SMB enum
  • AD enum

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.