Pivoting with sshuttle

sshuttle is transparent pivoting over SSH, a kind of "poor man's VPN": with a single command it routes all traffic toward an internal subnet, without proxychains and without touching each tool. It only needs SSH access to the pivot and Python on the far end.

Why it works. sshuttle opens an SSH session to the pivot, uploads a small Python script that acts as the remote end, and on the attacker intercepts traffic destined for the given subnet (with iptables/nfqueue) to forward it through the tunnel. To the tools it is invisible: they believe they talk directly to the internal network, so tools that ignore proxychains work, including DNS resolution with --dns.

The abuse. A single command routes the internal subnet; 0/0 routes everything (except what you exclude with -x).

# route the internal subnet through the pivot
sudo sshuttle -r <user>@<pivot> <internal-network>/24 -v
# several subnets at once
sudo sshuttle -r <user>@<pivot> <internal-network>/24 <other-network>/24
# specific SSH port and key
sudo sshuttle -r <user>@<pivot>:2222 <internal-network>/24 --ssh-cmd 'ssh -i id_rsa'
# route ALL traffic and DNS through the tunnel, in the background
sudo sshuttle -r <user>@<pivot> --dns 0/0 -x <pivot> -x <lhost> -D

Requirements. You need SSH to the pivot and Python on the pivot; on the attacker, root privileges to manipulate routing. It is convenient but only for Linux targets as the remote end and carries TCP (and DNS with --dns), not arbitrary raw protocols.

How to detect it. From the pivot, the signature is an SSH session running a Python interpreter that receives and forwards traffic to the internal network: a python child of sshd moving packets is very unusual on a server. On the network it looks, like other tunnels, like an encrypted SSH connection channelling traffic to many internal destinations.

Defence. Restrict outbound SSH and interpreter execution on servers, segment the network, and monitor SSH sessions that spawn Python and move anomalous volume. It plays the same role as SSH SOCKS and ligolo-ng, but transparently and without proxychains; it rests on the same conceptual port forwarding.