ptunnel-ng

ICMP tunneling

Setting up ptunnel-ng

$ git clone https://github.com/utoni/ptunnel-ng.git
$ sudo ./autogen.sh 

Starting ptunnel-ng at target host

ubuntu@WEB01:~/ptunnel-ng/src$ sudo ./ptunnel-ng -r10.129.202.64 -R22

-r is the ip of the victim (that you want to reach, in this case, it is the Pivot's own IP)

-R is the port of the victim that you want to connect to (in this case, its ssh)

Connecting from attack host

$ sudo ./ptunnel-ng -p10.129.202.64 -l2222 -r10.129.202.64 -R22

-r and -R are from the step above

-p is the ip of the pivot host

-l 2222 is the port that you will be accessing the ssh in your own machine (ssh user@127.0.0.1 -p2222)

Tunneling an SSH Connection

$ ssh -p2222 -lubuntu 127.0.0.1
$ ssh -D 9050 -p2222 -lubuntu 127.0.0.1 # or do dynamic port forwarding