SSH Tunneling Guide Demonstrates Port Forwarding and RDP Pivoting
Summary
A lab walkthrough demonstrates SSH local, dynamic, and remote forwarding to reach loopback-bound services and tunnel RDP, including how GatewayPorts can expose a forwarded port across a network. It also recommends controls for limiting and monitoring SSH tunnels.
Key points
- Demonstrates local SSH forwarding to access an Apache2 service bound to the target's loopback interface.
- Shows dynamic forwarding with a SOCKS proxy and proxychains to route browser and RDP traffic through an SSH host.
- Explains remote forwarding to make a Windows RDP service reachable through a pivot host.
- Shows that enabling GatewayPorts can bind a remote forward to all network interfaces, exposing the forwarded RDP port beyond loopback.
- Recommends restricting SSH access and forwarding, using key-based authentication and MFA, and keeping GatewayPorts disabled unless needed.
- Suggests monitoring long-lived SSH sessions, unusual data volumes, and unexpected connection sources.
Article Details
- Topic
- SSH port forwarding and tunneling techniques for accessing loopback-bound services and RDP through pivot hosts, with mitigation guidance
MITRE ATT&CK
T1090 · ProxyThe article demonstrates using an SSH dynamic forward as a SOCKS proxy, with proxychains routing application and RDP traffic through a pivot host.T1572 · Protocol TunnelingThe article demonstrates Local, Dynamic, and Remote SSH port forwarding to tunnel traffic between hosts and access otherwise unreachable services.
Products
Apache2It includes step-by-step commands, configuration changes, and verification methods using Apache2, proxychains, netstat, and rdesktop so practitioners can reproduce the scenarios in authorized environments.Kali LinuxWhen attempting to access the Apache2 service from the remote Kali Linux machine using the target’s actual network IP address (192.168.1.9) and port 8080.UbuntuInitiating Remote Port Forward from Ubuntu to KaliWindows 10After entering the correct credentials, the full Windows 10 desktop is presented, confirming complete RDP access through the SSH dynamic tunnel.
Tools
NmapVerifying the Tunnel with NmapproxychainsIt includes step-by-step commands, configuration changes, and verification methods using Apache2, proxychains, netstat, and rdesktop so practitioners can reproduce the scenarios in authorized environments.rdesktopIt includes step-by-step commands, configuration changes, and verification methods using Apache2, proxychains, netstat, and rdesktop so practitioners can reproduce the scenarios in authorized environments.