sshLOLBIN
Remote access and tunnels (port forwarding with -L).
Legitimate system binary (LOLBIN): not an offensive tool as such, but an attacker leverages it because it is usually already installed and raises fewer suspicions than dropping a dedicated tool.
A secure-shell client for remote access, but also one of the best pivoting tools: with -L, -R and -D it sets up local, remote and dynamic SOCKS forwarding to reach the internal network without uploading extra binaries.
Family Access, shells & transfer
Flags -L -R -D -N -i
Concepts Local port forwarding (SSH tunnel), Dynamic Port Forwarding (SOCKS), Remote Port Forwarding, Credential reuse
Cheatsheet SSH forwarding
Installation
sudo apt install -y openssh-clientUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- AdmirerHackTheBox
- AlertHackTheBox
- AmaterasuProving Grounds Play
- AmbassadorHackTheBox
- BigPivotingDockerLabs
- BoardLightHackTheBox
- BookHackTheBox
- BountyHunterHackTheBox
- BreaksshDockerLabs
- BuscaloveDockerLabs
- ChemistryHackTheBox
- ClueProving Grounds Practice
- ConsolelogDockerLabs
- Dance-SambaDockerLabs
- Darkhole 2VulnHub
- DVR4Proving Grounds Practice
- ExpresswayHackTheBox
- FanatasticProving Grounds Practice
- HealHackTheBox
- HunitProving Grounds Practice
- Infovore 1VulnHub
- InstantHackTheBox
- LaboratoryHackTheBox
- LateHackTheBox
- LinkVortexHackTheBox
- NickelProving Grounds Practice
- NukemProving Grounds Practice
- OpenSourceHackTheBox
- PandoraHackTheBox
- PayDayProving Grounds Practice
- PeppoProving Grounds Practice
- PermXHackTheBox
- PhotobombHackTheBox
- PostfishProving Grounds Practice
- PsychoDockerLabs
- RedPandaHackTheBox
- ResourceHackTheBox
- ScrutinyProving Grounds Practice
- SeaHackTheBox
- ServmonHackTheBox
- ShoppyHackTheBox
- SightlessHackTheBox
- SorcererProving Grounds Practice
- SpiderSocietyProving Grounds Practice
- StaplerProving Grounds Play
- Symfonos 1 & 2VulnHub
- Symfonos 5VulnHub
- TricksterHackTheBox
- UnderPassHackTheBox
- VmdakProving Grounds Practice
- Vulnerable Lab (1 · 4 · 5)VulnHub
- WallpaperHubProving Grounds Practice
- WorkaholicProving Grounds Practice