Linux Intranet penetration

During penetration testing, the following situations often occur: internal network hosts use routers or security devices to perform access control and cannot directly access locally open services through the Internet, for Windows, generally, lcx.exe is used for port forwarding. For applications, most people also choose parallel H for port forwarding. However, * nix rarely uses ssh and iptables that come with the system to handle such problems.
 
Due to the limited time, this article only describes the knowledge of ssh tunnel in detail, iptables is available in addition.
 
Three SSH port forwarding commands:
Ssh-C-f-N-g-L listen_port: DST_Host: DST_port user @ Tunnel_Host
Ssh-C-f-N-g-R listen_port: DST_Host: DST_port user @ Tunnel_Host
Ssh-C-f-N-g-D listen_port user @ Tunnel_Host
 
-F Fork into background after authentication.
The user/password for background authentication, usually used with-N. You do not need to log on to the remote host.
 
-P port Connect to this port. Server must be on the same port.
The sshd service port of the logged-on ssd server.
 
-L port: host: hostport
Forward a port of the Local Machine (client) to the specified port of the remote specified machine. the working principle is as follows: a socket listening port is allocated on the local machine. Once a connection is established on the port, the connection is forwarded through a secure channel, at the same time, the remote host establishes a connection with the host's hostport. you can specify port forwarding in the configuration file. only the root user can forward the privileged port. description of IPv6 address in another format: port/host/hostport
 
-R port: host: hostport
Forward a port of the remote host (server) to the specified port of the local host. the working principle is as follows: a socket listening port is assigned to the remote host. Once a connection is established on the port, the connection goes through the secure channel, establish a connection between the local host and the host's hostport. you can specify port forwarding in the configuration file. only the root user can log on to the remote host to forward the privileged port. description of IPv6 address in another format: port/host/hostport
 
-D port
Specifies a Local Machine "dynamic'' application port forwarding. the working principle is as follows: a socket listening port is allocated on the local machine. Once a connection is established on the port, the connection is forwarded through a secure channel, based on the application protocol, you can determine where the remote host will be connected. currently, the SOCKS4 protocol is supported and will act as the SOCKS4 server. only the root user can forward the privileged port. you can specify dynamic port forwarding in the configuration file.
 
-C Enable compression.
Compressed data transmission.
 
-N Do not execute a shell or command.
Do not execute scripts or commands, usually used with-f.
 
-G Allow remote hosts to connect to forwarded ports.
In the-L/-R/-D parameter, the remote host is allowed to connect to the forwarding port established. If this parameter is not added, only the local host is allowed to establish a connection. Note: This parameter does not seem to work in practice)
 
If you want to know