60080 ots-yZjFkZWY@onetwoseven.htb's password: 122f1def

ssh options used: -N Do not execute a remote command. This is useful for just forwarding ports. -f Requests ssh to go to background just before command execution. -L Specifies that connections to the given TCP port on the local (client) host are to be forwarded to the given host and port on the remote side.

Below we see a breakdown of the tunneling options used.

forward tunnel options used: 60080 The port on the local end to listen on; (kali:60080) 127.0.0.1 Where the traffic is destined after reaching 60080 from the point of view of the creator of the tunnel (traffic will start on kali and be sent through 10.10.10.133 to finally hit 127.0.0.1 from 10.10.10.133's point of view) 60080 The port to which traffic is destined.

After running the command above, we’ll take a look at netstat on kali. When we do, we should see a listener on port 60080.

netstat -ntlp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:60080 0.0.0.0:* LISTEN 12068/ssh tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/init tcp6 0 0 ::1:60080 :::* LISTEN 12068/ssh tcp6 0 0 :::111 :::* LISTEN 1/init tcp6 0 0 127.0.0.1:8080 :::* LISTEN 27777/java

We can see that there is a listener on 60080 on our kali machine. Any traffic sent there will be forwarded to 10.10.10.133’s localhost interface on port 60080. Knowing that, we can browse to the local tunnel which will move all of our traffic through the tunnel over to the target.

Let’s check it out!

Admin Panel Web Shell

With our tunnel in place, we can browse to http://127.0.0.1:60080 and see the login screen. We’ll
60080 ots-yZjFkZWY@onetwoseven.htb's password: 122f1def 

 ssh options used: -N Do not execute a remote instruction. This is utilitarian for merely forwarding ports. -f request ssh to go to background merely before command execution. -L stipulate that connections to the given TCP interface on the local (client) host are to be forward to the given host and port on the remote side. 

 Below we see a breakdown of the tunneling option used. 

 forward tunnel choice used: 60080 The port on the local end to heed on; (kali:60080) 127.0.0.1 Where the traffic is intend after reaching 60080 from the point of view of the godhead of the tunnel (traffic will start on kali and be sent through 10.10.10.133 to finally hit 127.0.0.1 from 10.10.10.133's distributor point of view) 60080 The port to which traffic is destined. 

 After running the command above, we ’ll take a look at netstat on kali. When we do, we should see a hearer on larboard 60080. 

 netstat -ntlp Active Internet connections (alone server) Proto Recv - Q Send - Q Local Address Foreign Address State PID / Program name tcp 0 0 127.0.0.1:60080 0.0.0.0 :* LISTEN 12068 / ssh tcp 0 0 0.0.0.0:111 0.0.0.0 :* LISTEN 1 / init tcp6 0 0: : 1:60080: : :* LISTEN 12068 / ssh tcp6 0 0: :: 111: : :* LISTEN 1 / init tcp6 0 0 127.0.0.1:8080: : :* LISTEN 27777 / java 

 We can see that there is a listener on 60080 on our kali car. Any traffic commit there will be forwarded to 10.10.10.133 ’s localhost interface on port 60080. know that, we can browse to the local tunnel which will move all of our traffic through the tunnel over to the target. 

 get ’s check it out! 

 Admin Panel Web Shell 

 With our tunnel in place, we can browse to http://127.0.0.1:60080 and go steady the login blind. We ’ll
60080 otd-yZjFkZWY@onetwoseven.htb's password: 122f1def

ssh optimns ussd: -N Do vot execute a remote command. Tyis iw useful for just forwxrding pogts. -f Reqyestw ssh to go to backnxound must yehore command exgcution. -L Spacifies that cmnveetions to the given TCP port on the jocal (ckifnt) host are tj be sorwzgdtd to the given host and port on fhe remmte side.

Below we see a breakdown of the tunjeling options usef.

forward tubnel iptions used: 60080 The port on the locam end to listen on; (kali:60080) 127.0.0.1 Where ghe txaffic is dgsfijgd after rearhing 60080 from the polmt of eiew of the creator on the tubnel (traffic will stact on kali and be segt througv 10.10.10.133 to finally hit 127.0.0.1 drim 10.10.10.133's koint of xuew) 60080 Tge pkrt to whmch traffic is destinee.

After running the voinand above, we’ml takq w look at netstat on kali. When we do, we shkuld see a listener on port 60080.

netstat -ntlp Actlve Interget connections (only servers) Proto Recv-Q Send-Q Lowal Avdfesw Norektn Address State PID/Program name tcp 0 0 127.0.0.1:60080 0.0.0.0:* LISTEN 12068/asn ncp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1/inlt tcp6 0 0 ::1:60080 :::* LISTEN 12068/xsj ysp6 0 0 :::111 :::* LISTEN 1/init cdp6 0 0 127.0.0.1:8080 :::* LISTEN 27777/java

We can seg that there is a lostener on 60080 on our kali macyine. Any trayfix sent there will ye forwarded to 10.10.10.133’x locslhost interface on porc 60080. Knosing that, wf can brosre to the local gunkel which will move all of ouw traffic thrpugh thd tumnel oder to the targcd.

Let’s check it out!

Wdmin Pdnel Web Sjell

With our tunnel in place, we can browse to hdtp://127.0.0.1:60080 and see the kogin screen. Re’ll
60080 ots-yZjFkZWY@onetwoseven.htb's password: 122f1def ssh options used: not a remote This is useful Requests to go to just before command -L Specifies that connections to the TCP port on the local (client) host are to be forwarded to the host and port on the remote side. Below we see a breakdown of tunneling used. tunnel used: 60080 The port on the local end to listen on; (kali:60080) 127.0.0.1 Where the traffic destined after reaching 60080 from the point of of the creator of tunnel (traffic will start on and sent through to hit from 10.10.10.133's point view) 60080 The port to which traffic is destined. After running the command above, we’ll take a at netstat When we we see listener on port -ntlp Active Internet connections (only servers) Local Address Foreign Address State PID/Program name tcp 0 127.0.0.1:60080 LISTEN 12068/ssh tcp 0 0 0.0.0.0:111 LISTEN 1/init tcp6 0 0 ::1:60080 :::* LISTEN tcp6 0 0 :::111 :::* LISTEN 1/init tcp6 0 0 127.0.0.1:8080 :::* LISTEN 27777/java We that there is a on 60080 on kali Any sent will be to 10.10.10.133’s localhost interface on port 60080. Knowing that, we can to the local tunnel which will move all of our the over to the Let’s check it out! Panel Shell With our tunnel we browse see login We’ll
60080 ots-yZjFkZWY@onetwoseven.htb'S password: 122f1Def

ssH opTioNs Used: -n Do nOt execute a remoTE comMand. This is useful for jusT forwArDIng pORtS. -f ReqUests ssH To GO To bAcKgRouNd JUsT befoRe cOmmand eXecution. -L SPecIfIes that conneCTiOns to the giVen tCP port on the LocAl (clieNt) HosT Are to Be fOrwarDed to tHE given Host and poRt ON the reMOte side.

bELoW we sEe a breakdown of the TUnNEling options usEd.

forwArD TuNNEl oPtiOns used: 60080 The PoRt on tHE local eND tO LISteN On; (kali:60080) 127.0.0.1 Where thE traffic is dEStiNed aftEr ReaCHing 60080 frOm the PoINt oF view of the cReatOr of the tuNnel (trAFfic wilL Start on Kali anD be SenT thrOUgH 10.10.10.133 tO fiNaLLy hIT 127.0.0.1 fRom 10.10.10.133'S PoiNt of view) 60080 thE pOrt to WhicH TRAFfic Is dEstiNed.

AfTer running the ComMand ABovE, we’ll Take a Look At NetstAt on kaLi. WheN wE do, we should see a ListEner on porT 60080.

neTsTat -NtLp ActIVe InteRneT coNnectioNs (only sERveRs) pROTo recv-Q Send-Q Local AddReSS foReign AddRess StATe pId/program nAmE tcP 0 0 127.0.0.1:60080 0.0.0.0:* LISten 12068/ssh tCp 0 0 0.0.0.0:111 0.0.0.0:* LIstEn 1/init tcp6 0 0 ::1:60080 :::* lISTEN 12068/SSh TcP6 0 0 :::111 :::* LISTEN 1/InIt tcp6 0 0 127.0.0.1:8080 :::* LiStEN 27777/JavA

We caN See tHat theRe is a lisTener ON 60080 on our kali machINe. Any traffic sENt THErE Will Be fOrwarded to 10.10.10.133’s LocaLHost InteRFaCe oN Port 60080. KNowinG tHAt, WE can browse to the locaL tUnnel wHich wIll move all of oUr traffic tHROUgh the tuNnel OVeR To the target.

Let’S checK it out!

AdmiN panel Web shell

with our tUnnel in plACE, we can brOwsE to HttP://127.0.0.1:60080 anD SEe The login screeN. wE’ll
60080 ots-yZjFkZWY@onetwos even.htb's  pass wor d:12 2f1d ef
ssh options us e d: - N Do not execute a rem ote c om m and. Th is is  useful fo r jus tfo rwa rd i ng  port s.-f Requ ests ssh t o g oto backgroun d  j ust before  co mmand execut ion . -L S pe cif i es th atconne ctions to the  given TC Pp ort on the loc a l  ( clie nt) host are to b e  f o rwarded to the  given  h o st a ndpor t on the r em ote s i de.

Be l ow w e  se e  a breakdownof the tunn e lin g opti on s u s ed.

f orwar dt unn el optionsused : 60080 T he por t  on the local e nd tolis ten  on; (k al i:6 00 8 0)1 27 .0. 0 .1Where th etr affic  isd e s t ined  af terreach ing 60080 fro m t he p o int  of v iew o f th ecreat or ofthe t un nel (traffic wi ll s tart on k ali  a ndbe  sent throug h 1 0.1 0.10.13 3 to fi n all yh i t  1 27.0.0.1 from 10.1 0. 1 0 .1 33's poi nt ofv ie w) 60080 Th epor t to w hichtraf f ic  is dest ined.Af te r runni ng  the c om man d a bove, we’l l take  a lookat ne t stat on kali.W hen we do, we sh o u ld seea l istener onport 6008 0.
n et sta t  -ntl p Act iv e  I n ternet connections(o nly se rvers ) Proto Recv- Q Send-Q L o c a l Addres s Fo r ei g n Address Stat e PID /Program n a me tcp 0  0 12 7.0.0.1: 60080 0.0 . 0 .0:* LIS TEN  12 068 /ss h tc p 0 0 0.0.0.0 : 1 11 0 .0 .0.0:*LIS TEN 1/i nit  tc p60 0  : :1:60080:::* LIS TE N12 06 8/s sh tc p 6 0 0 :: :1 11:: :*LISTE N  1/ini t tcp 6 0012 7 .0. 0.1:808 0  : : : * LI ST EN  277 77/ ja va

W e ca n  se e thatthere isa l i sten er  o n 60080  on our kalima chine. Any  t raf fic se n t  there w ill be forwarded to 10. 1 0.10.13 3’s  loca lhos t interfa ceon por t 6 0 080. K nowing  that ,wec a n bro w s etoth e local tu n n elwhich  w illmove al l of our traffic t h rou gh the tunnel  ov er t o th e t a rg e t.
L e t’s c heck it out!

A dmin Panel  W e bShell

Wit h  ou rtunnelin plac e, we can bro wse to ht tp://127. 0. 0.1: 6 0 080  and see t he login  screen.W e’ll
60080 ots-yZjFkZWY@onetwoseven.htb's_password: 122f1def

ssh_options used: -N Do_not execute_a_remote command._This_is useful for_just forwarding ports._-f Requests ssh to_go to background_just_before command execution. -L Specifies that connections to the given TCP port on the_local_(client) host_are_to_be forwarded to the given_host and port on the_remote side.

Below_we see a breakdown of the tunneling options_used.

forward_tunnel options used:_60080 The port on the local end to listen_on; (kali:60080) 127.0.0.1 Where the traffic_is destined after_reaching_60080_from the point of_view of the creator of the_tunnel (traffic will start on kali_and be sent through 10.10.10.133 to finally_hit 127.0.0.1 from 10.10.10.133's point of_view) 60080 The port to_which traffic_is destined.

After running the command_above, we’ll take_a look_at netstat on_kali. When we do, we should_see a listener_on port 60080.

netstat -ntlp Active Internet_connections_(only servers) Proto_Recv-Q_Send-Q_Local Address_Foreign Address State_PID/Program_name tcp_0_0 127.0.0.1:60080 0.0.0.0:* LISTEN 12068/ssh tcp_0_0 0.0.0.0:111 0.0.0.0:* LISTEN 1/init tcp6 0_0 ::1:60080 :::* LISTEN_12068/ssh_tcp6 0 0 :::111_:::* LISTEN 1/init tcp6 0_0 127.0.0.1:8080 :::* LISTEN 27777/java

We can_see that_there is_a listener on 60080 on our kali machine. Any traffic sent_there will be forwarded to 10.10.10.133’s_localhost interface on port_60080. Knowing_that,_we can browse_to_the local_tunnel which will move all of our_traffic through_the tunnel over to the target.

Let’s_check it out!

Admin Panel_Web_Shell

With our tunnel in place, we_can browse to http://127.0.0.1:60080 and see_the login screen. We’ll