PEN-200 Port Redirection and Tunneling — 15 Questions

Question 1

You are performing a penetration test and have gained shell access to a Windows machine. You need to forward traffic to an internal database server at 10.0.0.5:3306. Which TWO of the following tools allow you to perform this task natively or via uploaded binaries on Windows?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PLINK. Port forwarding is essential when the target environment prevents direct network communication to sensitive infrastructure. Using reliable tools like PLINK or Chisel allows a penetration tester to establish tunnels through restrictive environments. Understanding which binaries are cross-platform or native is critical, as it dictates the stealth and efficiency of the pivot. These tools facilitate the movement from a low-privilege entry point to deeper, high-value assets within the internal segment.

Answer

Netcat

Answer

PowerShell Invoke-WebRequest

Answer

Ping

Question 2

Refer to the exhibit. You have executed Chisel on a compromised Windows host to establish a connection to your attacking machine. Based on the output, what is the current state of your proxy capability?

Accepted Answer

The attacker can now use proxychains to reach internal network targets.. The exhibit shows a successful connection to the Chisel server, with a dynamic SOCKS proxy enabled on the client side. By using the 'R:socks' directive, the tool opens a SOCKS listener on the server-side (attacker's machine). This allows the attacker to use tools like proxychains to route traffic through the compromised host into the internal network, effectively transforming the attacker's machine into a proxy client for the target environment.

Answer

The client is now acting as a SOCKS server for the attacker.

Answer

Traffic is being forwarded to port 8000 on the local host.

Answer

The connection failed because the server port is already in use.

Question 3

You need to pivot through a compromised host to reach an internal database. You are using SSH remote port forwarding. If you execute 'ssh -R 9000:localhost:3306 user@attacker-ip', which direction does the traffic flow for this tunnel?

Accepted Answer

Traffic originates at the attacker's machine and terminates on the compromised host.. Remote port forwarding (-R) maps a port on the remote (attacker) machine to a service accessible by the local (compromised) machine. Traffic directed to port 9000 on the attacker's machine is sent through the SSH tunnel to the compromised host, which then forwards the request to its own localhost on port 3306. This is essential when the attacker cannot initiate a direct connection to the compromised host, but the host can reach out.

Answer

Traffic goes from the compromised host to the attacker's machine.

Answer

Traffic flows directly from the internal database to the attacker.

Answer

The tunnel only supports UDP traffic for database queries.

Question 4

When setting up a pivot using SSH tunneling, which THREE factors are critical to ensure the tunnel remains stable and functional for long-term access?

Accepted Answer

Using the -N flag to prevent command execution.. Tunnel stability is a major challenge during penetration tests. If a connection times out or the process is killed, the pivot is lost. Proper flags like -N and -f help keep the background process alive, while keep-alive configurations prevent idle timeouts. These techniques ensure that once a foothold is established, the attacker can maintain persistent access to internal segments without needing to manually restart the tunnel after short periods of inactivity.

Answer

Disabling encryption to improve tunnel speed.

Answer

Opening port 22 on the internal target machine.

Question 5

When using SSH for port redirection, what is the significance of binding to the loopback address (127.0.0.1) versus the 'all interfaces' (0.0.0.0) address?

Accepted Answer

0.0.0.0 allows multi-user access to the tunnel.. Binding to the loopback address (127.0.0.1) restricts access to the forwarded port to only the local machine, which is a security best practice. Binding to 0.0.0.0 exposes the forwarded port to the entire network segment, potentially allowing unauthorized third parties to access the tunnel. In a penetration test, limiting exposure is critical to prevent accidental unauthorized access to the internal network through your established pivot point.

Answer

0.0.0.0 is faster because it uses less CPU for address filtering.

Answer

127.0.0.1 is required for SSH to successfully start.

Answer

127.0.0.1 prevents the tunnel from being encrypted.

Question 6

When setting up a SOCKS proxy via SSH, which TWO configurations on your local attacking machine are required for the proxy to work correctly with browser-based tools?

Accepted Answer

Setting the browser to use the SOCKS proxy at 127.0.0.1:port.. Setting up the tunnel is only the first step. To utilize the tunnel, the client application must be configured to send its traffic through the SOCKS proxy. This is why browser settings or proxy tools must be aligned with the local port opened by the SSH tunnel. Without this configuration, the application will attempt to use its default gateway, bypassing the tunnel entirely and failing to reach the internal target.

Answer

Modifying the remote server's /etc/hosts file.

Answer

Installing an SSH server on the target database machine.

Answer

Changing the system default gateway on the attacker machine.

Question 7

What is the primary function of the 'proxychains' tool when used in conjunction with a SOCKS proxy?

Accepted Answer

It forces application traffic through a proxy server.. Proxychains intercepts network-related system calls from any dynamically linked application and forces that traffic through a specified SOCKS proxy. This allows tools that do not natively support proxy settings to be used through a tunnel. It is indispensable for tools like Nmap, which need to send raw packets or establish connections through an SSH pivot, enabling complete network enumeration through a single proxy tunnel.

Answer

It encrypts the traffic before it reaches the SOCKS proxy.

Answer

It automatically authenticates to the internal target.

Answer

It converts raw TCP packets into HTTP traffic.

Question 8

You have compromised a Linux jump host and need to access an internal-only web application running on 192.168.1.50:8080. The jump host has SSH access to your Kali machine, but inbound connections are blocked. Which command allows you to access this internal service from your local browser?

Accepted Answer

ssh -R 8080:192.168.1.50:8080 kali@your-ip. Remote port forwarding with the -R flag is the correct technique here because the jump host can reach the target, but your machine cannot reach the jump host directly. By establishing a reverse tunnel, you force the jump host to listen on a local port and forward traffic back through the established SSH connection to the internal target. This is a critical skill for pivoting into segmented internal networks.

Answer

ssh -L 8080:192.168.1.50:8080 user@jump-host

Answer

ssh -D 8080 user@jump-host

Answer

ssh -f -N -L 8080:localhost:8080 user@jump-host

Question 9

Refer to the exhibit. You have successfully executed the SSH command, but when you browse to http://localhost:8080, the connection is refused. What is the most likely reason for this failure?

Accepted Answer

The jump host cannot reach the target 10.10.10.5 on port 80.. The exhibit shows that the local port forwarding is bound only to 127.0.0.1, preventing external access. However, the connection refusal implies the internal target 10.10.10.5 is not reachable by the jump host on port 80, or the service is not active. Troubleshooting tunnels requires verifying both the local binding and the hop-to-target connectivity, as a successful tunnel handshake does not guarantee the final service is listening.

Answer

The SSH client failed to authenticate the user.

Answer

The SSH daemon on the jump host is not running.

Answer

The SSH tunnel is using the wrong encryption algorithm.

Question 10

You are performing a pivoting operation and need to use Chisel. Which TWO of the following statements regarding Chisel's operation are correct?

Accepted Answer

The Chisel server should be started on the attacker's machine.. Chisel is a powerful tool for TCP/UDP tunneling over HTTP. Understanding its server-client architecture is vital for OSCP success. It operates by creating a lightweight tunnel that bypasses many standard firewall configurations. Knowing how to set up the server and client components is essential for successfully navigating restricted network environments during an engagement and ensuring the traffic is correctly proxied through the compromised host.

Answer

Chisel requires an SSH server to be installed on the victim machine.

Answer

The Chisel client runs on the attacker's machine.

Answer

Chisel traffic is unencrypted and easily detectable.

Question 11

You are configuring proxychains on your Kali Linux attacking machine to route Nmap scans through a SOCKS proxy established via SSH. Which configuration file parameter must you modify or verify to ensure TCP connect scans operate correctly through the proxy?

Accepted Answer

Switching Nmap to perform a TCP connect scan (-sT) rather than a default SYN stealth scan (-sS).. Proxychains intercepts TCP connection attempts made by tools and routes them through the specified proxy server. Ensuring that TCP connect scanning mode is enabled rather than raw SYN scans is crucial, because raw socket scans cannot be easily encapsulated through standard SOCKS proxy tunnels.

Answer

Enabling dynamic_chain to automatically skip dead proxies during execution.

Answer

Uncommenting or adding the socks4 or socks5 proxy IP address and listening port at the end of the file.

Answer

Modifying the proxy_dns setting to disable remote DNS resolution requests.

Question 12

You have obtained a foothold on a dual-homed Linux host at 10.10.10.5, which can reach an internal MySQL server at 172.16.5.20:3306. Your attacking machine cannot route to 172.16.5.20. You want a simple, tool-free way to make the MySQL service reachable through the pivot without installing anything on the compromised host. Which command best accomplishes this?

Accepted Answer

ssh -L 3306:172.16.5.20:3306 user@10.10.10.5. A local port forward is the right primitive when the attacker needs to reach an internal service through a pivot. The SSH client listens locally, and each connection is carried over the encrypted session to the pivot, which originates the connection to the internal target. Because SSH is preinstalled on virtually every Linux host, this satisfies the no-extra-tooling requirement while keeping the traffic inside an encrypted channel.

Answer

ssh -R 3306:172.16.5.20:3306 user@10.10.10.5

Answer

ssh -D 3306 user@10.10.10.5

Answer

socat TCP-LISTEN:3306,fork TCP:172.16.5.20:3306

Question 13

During a Windows penetration test, you gain access to a dual-homed host with interfaces on 10.10.10.0/24 and 172.16.1.0/24. The internal network 172.16.1.0/24 is only reachable through this host. You want to forward traffic from your attacking machine (192.168.0.50) to an internal web server at 172.16.1.100:80. You have administrative access to the Windows host and can upload tools. Which of the following commands, executed on the compromised Windows host, will create the necessary port forward?

Accepted Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.1.100. The netsh portproxy command creates a TCP proxy on the compromised Windows host, allowing traffic from the attacker to be forwarded to the internal web server. The correct syntax requires listenaddress=0.0.0.0 to accept connections on any interface, and connectaddress=172.16.1.100 with connectport=80 to reach the target. The other options either reverse the direction, bind to an incorrect interface, or use an SSH command that does not run on Windows.

Answer

ssh -L 8080:172.16.1.100:80 user@10.10.10.10

Answer

netsh interface portproxy add v4tov4 listenport=8080 listenaddress=10.10.10.10 connectport=80 connectaddress=172.16.1.100

Answer

netsh interface portproxy add v4tov4 listenport=80 listenaddress=172.16.1.100 connectport=8080 connectaddress=192.168.0.50

Question 14

You have compromised a Linux host that acts as a pivot into a segmented network. You want to use SSH remote port forwarding to expose an internal service (192.168.1.100:3389) to your attacking machine. You run the command: ssh -R 9001:192.168.1.100:3389 user@attacker.com. Which TWO statements about this setup are correct? (Choose two.)

Accepted Answer

The SSH server (attacker.com) will listen on port 9001 and forward connections to 192.168.1.100:3389 via the compromised host.. Remote port forwarding (-R) makes the SSH server listen on a specified port and forward incoming connections back through the tunnel to the SSH client, which then connects to the target. By default, the listening socket is bound to loopback on the server, limiting access. The client does not need a public IP; only outbound SSH connectivity is required.

Answer

The compromised host will listen on port 9001 and forward connections to attacker.com.

Answer

This setup requires the attacker to run a separate listener on port 9001.

Answer

The compromised host must have a public IP address for this to work.

Question 15

During an internal engagement you compromised a Windows host that has outbound HTTPS access to your team server but no inbound access from the internet. You plan to use ligolo-ng to pivot into the internal network. Which TWO statements about deploying ligolo-ng in this situation are correct? (Choose two.)

Accepted Answer

A TUN interface is created on the attacking machine, and routes for the internal subnets are added to direct traffic into the ligolo-ng tunnel.. Ligolo-ng suits egress-only environments because the agent dials out to the proxy, avoiding the need for inbound access to the victim network. On the attacking side, the proxy creates a TUN interface, and adding a route for the internal subnet makes that subnet reachable by ordinary tools. This routed-interface model removes the SOCKS dependency and the associated tooling constraints.

Answer

The compromised Windows host must have the TAP-Windows driver installed before the ligolo-ng agent can forward traffic.

Answer

All traffic from the agent is encapsulated inside a SOCKS5 proxy, so tools on the attacking machine must be used with proxychains.

Answer

Because the agent dials out, the proxy must be started with a certificate and the agent started with the matching -accept-fingerprint value.