Given information: I have root access to a machine on ip 188.8.131.52 and open up port 22.
Instead of having to log into the machine again through an exploit to get root access AND to not install apps onto their machine (If i created a reverse shell on the machine, it could get detected), figured to try a new approach; port forwarding and proxy chains.
The idea I had was to set up a tunnel to the webserver and just forward the information along in order to start mapping out the internal network. I stumbled across proxychains, which is as simple as configuring the port, say 8080 in its conf file, then running commands:
proxychains ifconfig and then
proxychains nmap --script=discovery $ip
There seems to be some configuration needing to be done before you can use Proxy chains and this is where I think why?. I will append below.
So, firstly as root access on the webserver, I will open port 22 and make a user with admin permissions, say jakefromstatefarm.
Then I will from my attacking machine do the following:
ssh -f -N -R 2222:127.0.0.1:22 [email protected]
# Enter password for jakefromstatefarm
ssh -f -N -D 127.0.0.1:8080 -p 2222 [email protected]
# Enter password for atkMachineUser
Now I would use proxychains on port 8080 by editing the conf file
My question which confuses me is why do we need to set up these sets of tunnels prior to? Is it because of the required user credentials to speak to the different machines? That way, the machine will maintain the credentials and then from there proxychains doesnt need to maintain anything?
I was confused because i was not sure why I couldn't in theory set up proxychains to use port 22 to talk to the webserver at 184.108.40.206 directly and run its respective commands.
I am trying to make sure I understand SSH Tunneling correctly.
I read a bunch of information, wiki pages and books, and while i vaguely understand some concepts, i dont have a warm and fuzzy quite yet. That being said, Id love it if someone could explain it to me like i am 5, or well, with less mumbo jumbo.