pivoting with bhnet is pretty handybut sometimes it' wise to encrypt your traffic to avoid detection common means of doing so is to tunnel the traffic using secure shell (sshbut what if your target doesn' have an ssh client (like percent of windows systems)while there are great ssh clients available for windowslike puttythis is book about python in pythonyou could use raw sockets and some crypto magic to create your own ssh client or server -but why create when you can reuseparamiko using pycrypto gives you simple access to the ssh protocol to learn about how this library workswe'll use paramiko to make connection and run command on an ssh systemconfigure an ssh server and ssh client to run remote commands on windows machineand finally puzzle out the reverse tunnel demo file included with paramiko to duplicate the proxy option of bhnet let' begin firstgrab paramiko using pip installer (or download it from pip install paramiko we'll use some of the demo files laterso make sure you download them from the paramiko website as well create new file called bh_sshcmd py and enter the followingimport threading import paramiko import subprocess def ssh_command(ipuserpasswdcommand)client paramiko sshclient(#client load_host_keys('/home/justinssh/known_hosts'client set_missing_host_key_policy(paramiko autoaddpolicy()client connect(ipusername=userpassword=passwdssh_session client get_transport(open_session(if ssh_session activessh_session exec_command(commandprint ssh_session recv( return ssh_command( ''justin''lovesthepython','id'this is fairly straightforward program we create function called ssh_command which makes connection to an ssh server and runs single command notice that paramiko supports authentication with keys instead of (or in addition topassword authentication using ssh key authentication is strongly recommended on real engagementbut for ease of use in this examplewe'll stick with the traditional username and password authentication because we're controlling both ends of this connectionwe set the policy to accept the ssh key for the ssh server we're connecting to and make the connection finallyassuming the connection is madewe run the command that we passed along in the call to the ssh_command function in our example the command id let' run quick test by connecting to our linux serverc:\tmppython bh_sshcmd py uid= (justingid= (justingroups= (justinyou'll see that it connects and then runs the command you can easily modify this script to run