In this lesson,
we're going to explore how to use sshuttle,
a tool that can be utilized
for lateral movement within a network.
Sshuttle is a transport proxy server that allows you
to create a VPN-like connection using SSH,
enabling you to route network traffic
through a remote server.
Sshuttle, commonly referred to as the poorman's VPN,
is a useful tool for penetration testers
because it allows you to route traffic
from your local machine through a remote network,
essentially giving you access to that network
as if you are physically connected to it.
This can be particularly advantageous
when you need to access internal resources
that are not directly accessible
from your current network location.
Let's start by understanding the basic concepts
of sshuttle.
Sshuttle uses SSH to forward traffic
through a remote server.
Unlike a traditional VPN, sshuttle does not require
administrative privileges on the remote server.
It uses user-level privileges to create a proxy,
making it an excellent choice for pen testers
who may have limited access rights.
To use sshuttle, you need SSH access to a remote server
that is part of the target network.
Keep in mind that sshuttle
is for Unix-like operating systems,
so it will not work on Windows systems natively.
For example, suppose you have compromised a server
within the target network and gained SSH access.
You can use sshuttle to route your traffic
through this compromised server,
effectively giving you access to other machines
and services within the same network.
The following command is the general syntax
used for sshuttle:
sshuttle, with the -r option selected,
user@remote_server 0.0.0.0/0.
Now, in this command,
sshuttle -r is used to specify the remote server,
which is indicated by the -r option option.
The user@remote_server portion is the SSH user
and the address of the remote server you have access to.
For example, it could be something like jkelly@10.0.0.2,
and the 0.0.0.0/0 indicates that you want to route
all traffic through the remote server.
If you only want to route specific subnets
through the remote server,
you can specify them with something like this,
sshuttle -r user@remote_server
192.168.1.0/24.
Now, this command routes only the traffic
destined for 192.168.1.0/24 subnet
through the remote server.
Using sshuttle, you can navigate the internal network
as if you were directly connected to it.
This allows you to perform
various penetration testing activities,
such as scanning for open ports, exporting services,
and accessing internal web applications.
For example, once you have set up sshuttle,
you can use tools like nmap to scan the internal network.
So you can use something like nmap with the -sT
and -Pn flag set with 192.168.1.0/24.
This command scans for TCP ports on
192.168.1.0/24 subnet,
providing you with valuable information about the services
running on the internal network.
Sshuttle also supports DNS forwarding,
which can be useful if you need to resolve
internal host names.
For example, imagine there's an internal server
named intranet.company.local you want to explore.
From the outside network,
you won't be able to find or access the server
because it's only known inside the company.
But with sshuttle's DNS forwarding,
you can connect to the internal network
and use the host name, intranet.company.local
to reach the web server directly.
This makes it easier to find
and interact with internal systems,
helping you discover more about the network
and potentially find more weaknesses to exploit.
You can enable DNS forwarding with the --dns option.
So for example, ssh --dns -r
user@remote_server 0.0.0.0/0.
So remember, sshuttle is a powerful tool
for lateral movement in a penetration test.
It allows you to route your network traffic
through a remote server,
providing access to internal resources
as if you are connected directly to the network.
By understanding and using sshuttle,
you can effectively extend your reach
within the target network
and perform more comprehensive security assessments.