Remote Port Forwarding

Remote port forwarding opens a port on the remote host that forwards traffic back to our machine (or to a service we can reach). It is the reverse of local port forwarding and solves the case where the pivot cannot initiate a connection toward us, but can accept ours.

Why it works. With ssh -R you ask the SSH server to listen on one of its ports and send everything it receives, through the already-established tunnel, to a destination we define on the client side. The typical use is to bring our handler or a service onto an internal host so its payload can "call home" even if the firewall blocks direct egress: the connection leaves over the SSH tunnel that is already allowed.

The abuse. You set up the reverse tunnel from the attacker to the pivot and point it at the service you want to expose.

# the pivot will listen on its 8080 and forward to our 80
ssh -R <pivot>:8080:0.0.0.0:80 <user>@<pivot> -vN
# expose an internal service (not just the pivot's) toward the attacker
ssh -R 8080:<internal-ip>:<rport> <user>@<pivot> -fN
# on Windows, with plink, for an equivalent reverse forward
plink -R 8080:127.0.0.1:80 <user>@<pivot>

With chisel (handy when the pivot cannot accept inbound SSH): the server runs on the attacker and the client on the pivot.

./chisel server -p 8000 --reverse                          # attacker
./chisel client <lhost>:8000 R:8080:<internal-ip>:<rport>  # pivot

Requirements. You need an SSH session between attacker and pivot and, for the remote port to listen on all interfaces, GatewayPorts enabled on the server. It only carries what you tell it (a single forwarded port), not a whole network like SOCKS.

How to detect it. The signal is a new listening port on the host tied to an SSH process with forwarding, and traffic "bouncing" from that port out through the tunnel. On the network it looks like an SSH connection that, instead of terminating at the pivot, channels traffic back. Auditing sshd with -R and unexpected listening ports on servers is the direct route.

Defence. Disable port forwarding in SSH where it is not needed (AllowTcpForwarding no, GatewayPorts no), filter the segment's egress so a tunnel finds no way back, and monitor new listening ports. It is the reverse face of local port forwarding and dynamic port forwarding, and is sometimes combined with a socat relay to chain hops.