Leveraging ProxyChains when SSH Tunneling requires some set up, and im curious about the why aspect

Question

Given information: I have root access to a machine on ip 1.1.1.1 and open up port 22.

Instead of having to log into the machine again through an exploit to get root access AND to not install apps onto their machine (If i created a reverse shell on the machine, it could get detected), figured to try a new approach; port forwarding and proxy chains.

The idea I had was to set up a tunnel to the webserver and just forward the information along in order to start mapping out the internal network. I stumbled across proxychains, which is as simple as configuring the port, say 8080 in its conf file, then running commands: proxychains ifconfig and then proxychains nmap --script=discovery $ip

There seems to be some configuration needing to be done before you can use Proxy chains and this is where I think why?. I will append below.

So, firstly as root access on the webserver, I will open port 22 and make a user with admin permissions, say jakefromstatefarm.

Then I will from my attacking machine do the following:

ssh -f -N -R 2222:127.0.0.1:22 jakefromstatefarm@1.1.1.1
# Enter password for jakefromstatefarm
ssh -f -N -D 127.0.0.1:8080 -p 2222 atkMachineUser@127.0.0.1
# Enter password for atkMachineUser

Now I would use proxychains on port 8080 by editing the conf file

proxychains ifconfig

My question which confuses me is why do we need to set up these sets of tunnels prior to? Is it because of the required user credentials to speak to the different machines? That way, the machine will maintain the credentials and then from there proxychains doesnt need to maintain anything?

I was confused because i was not sure why I couldn't in theory set up proxychains to use port 22 to talk to the webserver at 1.1.1.1 directly and run its respective commands.

I am trying to make sure I understand SSH Tunneling correctly.

I read a bunch of information, wiki pages and books, and while i vaguely understand some concepts, i dont have a warm and fuzzy quite yet. That being said, Id love it if someone could explain it to me like i am 5, or well, with less mumbo jumbo.

Answer 1

SSH Explaination

Maybe someone can chime in if I misunderstood but this is how I understood this to work.

You're creating a listening port on the remote host and redirected it locally. This removes your machine from the equation of deciding where traffic needs to be routed which is why you don't need to configure routes afterwards. So the remote host makes the decision based on the traffic it receives as to where to send it.

proxychains sends traffic to 8080 -> Sending traffic to Listening port 2222 on remote victim which reverts back to loopback 22 on that host. Now that host is in control of determining where the traffic goes. Which is why you need to pivot this way.

Using this method leaves routing responsibility to fall on the victim host, which is how the pivot works.

[ATTACKER]8080 <--> 2222[VICTIM]<-->22[VICTIM:]

If you skip the first step your machine will end up deciding which route to take and give you undesired results by sending traffic to whatever network route it can obtain for that... usually routing through your ISPs network or some public server instead of the segmented network on the other side of the host.

[ATTACKER]8080 <--> 22[VICTIM:]