NETCAT REVERSE SHELL CHEAT SHEET PASSWORD

Msf5 auxiliary(scanner/ssh/ssh_login) > set PASSWORD letspivot Msf5 auxiliary(scanner/ssh/ssh_login) > set USERNAME pentester

Msf5 auxiliary(scanner/ssh/ssh_login) > set RHOSTS ssh Msf5 > use auxiliary/scanner/ssh/ssh_login $ docker exec -it pivots_metasploit_1 /bin/bash

The below will jump from our machine into the metasploit docker container, start metasploit, and create a meterpreter over SSH connection. We'll run meterpreter over SSH for this example, but the steps would be the same for any meterpreter session once connected.

NETCAT REVERSE SHELL CHEAT SHEET FULL

Unfortunately, socks4 proxies only generally support TCP protocols, and certain kinds of traffic won't work well, so full nmap and similar tool usage may not be possible. If you are using the docker compose file provided, I include a slightly modified metasploit image on the public network. Similar to SSH, meterpreter can become a socks proxy, though I have generally found it less reliable than SSH. Some servers don't run SSH, and I often like to leverage meterpreter once I find an initial entry vector for a variety of reasons. Method 2: Pivot With Meterpreter and socks proxy RDNS record for 224.0.0.1: Д©001/tcp open jdbc HSQLDB JDBC (Network Compatibility Version 2.3.4.0) You could use any normal ip range on the target network instead. Note I use the network 'webgoat' because the docker-compose network sets up this dns name. Here is an nmap scan of the webgoat host. In /etc/nf (or similar depending on version), add the following to the end of the file: socks5 127.0.0.1 9000 This sets up an SSH tunnel in the background on local port 9000. Assuming you are using the sample environment: ssh -D localhost:9000 -f -N -p 20022 Setting up the tunnelДЇirst login with SSH using dynamic port forwarding. Non-root accounts may limit some tools from working fully (such as nmap), when creating certain types of packets are root only activities.

A password compromise or writing of a public key for entry, to a user that allows remote SSH login.

SSH service running on target machine and reachable from the attacker machine.

It requires the following pre-conditions to leverage: This method allows mostly complete access to the target network, with few limitations, and is generally my preferred way to access gated networks.

Run a command with proxychains, which tunnels data over the SSH proxy.

This works great in tools that support it like Burp.

In a tool, configure a SOCKS proxy and point it to the SSH tunnel.

This method leverages SSH with dynamic port forwarding to create a socks proxy, with proxychains to help with tools that can't use socks proxies. You can get this environment running with docker and docker compose by checking out the repository, then running docker-compose build and docker-compose up.

The SSH machine is accessible from localhost on port 20022 instead of 22, but you can also use the metasploit container for all testing.

A Metasploit image on the public network only.

A host running WebGoat vulnerable webapp on the private network only.

A gateway running SSH with access to public and private networks (like a jump host).

If you want to play around with the pivots I discuss below, I put together a simple docker environment to play with. I put together this list of common pivot techniques I have used, along with a quick to setup docker-compose environment to get you playing with each method quickly.ДЄt the end of the article is a quick look cheatsheet with all the key setup commands for each pivot type. I don't often come get a chance to use pivot techniques, so I sometimes find myself searching for reminders about various methods and their trade offs.

Netcat reverse shell cheat sheet