Guide Demonstrates Six Port-Forwarding Techniques for Reaching Isolated Services

Summary

A hands-on lab demonstrates six ways to reach an Apache2 service bound to localhost through a compromised host, then outlines defenses including SSH restrictions, monitoring for tunnels and listeners, and network segmentation.

Key points

The lab isolates Apache2 on 127.0.0.1:8080 to demonstrate access to a service unavailable to remote connections.
SSH local forwarding, Ligolo-ng, Chisel, Meterpreter portfwd, socat, and Ligolo-MP are demonstrated for tunneling or relaying traffic through a compromised host.
Ligolo-ng and Ligolo-MP use TUN interfaces and routes for network pivoting; Ligolo-MP also supports port redirectors.
Chisel carries forwarding traffic over HTTP/WebSocket, while Meterpreter portfwd uses an existing session and socat creates a TCP relay.
Suggested defenses include disabling unnecessary SSH forwarding, monitoring unexpected TUN interfaces and listeners, and detecting unusual outbound connections and long-lived WebSocket sessions.
The guide also recommends strict egress controls, network segmentation, least privilege, centralized logging, and monitoring socat execution.

Article Details

Topic: Port forwarding and network pivoting techniques for accessing localhost-bound services, with detection and mitigation guidance.

MITRE ATT&CK

T1090.001 · Internal ProxyThe guide demonstrates relaying traffic through a compromised host to reach services on its loopback interface or internal network.T1572 · Protocol TunnelingThe guide demonstrates tunneling traffic through SSH, Chisel, and other port-forwarding methods, including HTTP/WebSocket-based and encrypted channels.

Products

Apache2This guide demonstrates multiple port forwarding and pivoting techniques used by penetration testers to reach a localhostâbound Apache2 service (127.0.0.1:8080) on a compromised host.

Tools

ChiselIt explains SSH local forwarding, Ligoloâng/LigoloâMP, Chisel, Metasploit Meterpreter portfwd, and socat, and outlines mitigations to detect and prevent these postâexploitation methods.Ligolo-MPPart 7: Network Pivoting through Ligolo-MP Ligolo-ngPart 3: Ligolo-ng — Advanced Port Forwarding and Network Pivoting Metasploit FrameworkPart 5: Metasploit Framework — Meterpreter portfwd MeterpreterIt explains SSH local forwarding, Ligoloâng/LigoloâMP, Chisel, Metasploit Meterpreter portfwd, and socat, and outlines mitigations to detect and prevent these postâexploitation methods.SocatIt explains SSH local forwarding, Ligoloâng/LigoloâMP, Chisel, Metasploit Meterpreter portfwd, and socat, and outlines mitigations to detect and prevent these postâexploitation methods.SSHIt explains SSH local forwarding, Ligoloâng/LigoloâMP, Chisel, Metasploit Meterpreter portfwd, and socat, and outlines mitigations to detect and prevent these postâexploitation methods.