← Back to Academy

Academy Node

sshuttle

sshuttle creates transparent routes through SSH, making internal subnets feel locally reachable.

Intermediate100 XPPivoting

Why it matters

PEN-200 covers sshuttle as a useful tunneling method for internal network access.

How to identify it

  • SSH to pivot works
  • Pivot can route to internal subnet

Linux commands

sshuttle -r USER@TARGET INTERNAL_CIDR -x TARGET
nmap -sT -Pn -p 80,445 INTERNAL_IP
curl http://INTERNAL_IP

Expected output

  • c : Connected
  • Internal services reachable

Success looks like

  • Kali can directly reach internal subnet

Failure looks like

  • SSH failure
  • No route
  • DNS issue

Troubleshooting

  • Start with one CIDR
  • Confirm pivot can reach target
  • Use IPs first

Common mistakes

  • Forgetting -x pivot IP
  • Routing the VPN through itself

Alternative attacks

  • SSH dynamic SOCKS
  • Chisel

What to try next

  • Internal enumeration
  • AD enumeration

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.