Gallopsled / pwntools / 14169348140 / 1

19%

dev: 19%

push

github

Add `ssh -L` / `ssh.connect_remote()` workaround when `AllowTcpForwarding` is disabled (#2538)

* Add `ssh -L` / `ssh.connect_remote()` workaround when `AllowTcpForwarding` is disabled

Use a netcat process on the remote to connect to the specified host:port and tunnel the traffic using normal `ssh.process` I/O.

This was inspired by the "Circumventing Disabled SSH Port-Forwarding with a Multiplexer" article by @guysv in the Paged Out! zine no. 5.

It allows to use `gdb.debug(arg, ssh=ssh)` to debug processes on pwn.college.

* Update CHANGELOG

* Lookup `netcat` command too

Co-authored-by: Xeonacid <h.dwwwwww@gmail.com>

* Try connecting using bash /dev/tcp too

---------

Co-authored-by: Xeonacid <h.dwwwwww@gmail.com>

3810 of 6422 branches covered (59.33%)

13351 of 18061 relevant lines covered (73.92%)

0.74 hits per line