Post Exploitation
sshuttle acts as a transparent proxy server that forwards traffic over an SSH connection, configuring local routing rules without requiring administrator privileges on the remote server host.
sudo apt install sshuttle
sshuttle -r [user@]sshserver[:port] <subnets>
sshuttle is a transparent proxy VPN that forwards traffic over SSH without requiring administrator access on the remote server. It provides a quick and easy way to access internal networks through a pivot host.
By modifying local routing rules, sshuttle transparently routes traffic for specified subnets through an encrypted SSH tunnel, making it an essential tool for network pivoting in penetration testing.
sshuttle -r <USER>@10.10.10.10 0/0Tunnel all IPv4 traffic through the remote SSH host (full VPN-over-SSH)sshuttle -r <USER>@10.10.10.10 192.168.1.0/24Route only the given subnet through the remote hostsshuttle -r <USER>@10.10.10.10 192.168.1.0/24 10.0.0.0/8Tunnel multiple subnets in a single sessionsshuttle -r <USER>@10.10.10.10 --dns 0/0Also intercept and forward DNS queries through the tunnelsshuttle -r <USER>@10.10.10.10 -NAuto-detect the remote networks (routes) and tunnel themsshuttle -r <USER>@10.10.10.10 -x 10.10.10.10 0/0Tunnel everything except the SSH host's own addresssshuttle -r <USER>@10.10.10.10 -x 192.168.1.5 192.168.1.0/24Tunnel a subnet but exclude a specific hostsshuttle -r <USER>@10.10.10.10 -X /path/to/exclude.txt 0/0Exclude subnets listed in a file from the tunnelsshuttle -r <USER>@10.10.10.10 -v 192.168.1.0/24Run with verbose output for troubleshootingsshuttle -r <USER>@10.10.10.10 -vv 192.168.1.0/24Run with very verbose (debug-level) outputsshuttle -r <USER>@10.10.10.10 -D 0/0Run as a background daemonsshuttle -r <USER>@10.10.10.10 -D --pidfile /path/to/sshuttle.pid 0/0Daemonize and write the PID to a file for later controlsshuttle -r <USER>@10.10.10.10:2222 192.168.1.0/24Connect to SSH on a non-default port via the remote specsshuttle -r <USER>@10.10.10.10 -e 'ssh -i /path/to/key.pem' 0/0Use a custom SSH command, e.g. to supply an identity keysshuttle -r <USER>@10.10.10.10 -l 0.0.0.0:12300 0/0Bind the local transparent proxy to a specific address/portRoute traffic through SSH jump host.
Nmap internal subnets through tunnel.
Access internal web/app servers transparently.
Transfer files via tunnel tools without proxy config.
Indicates when the secure tunnel is active. Once running, the terminal acts as a background process while network traffic is silently redirected.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.