Gray Hat SSH: SSHenanigans & Advanced Tunneling Tradecraft
Evan Anderson explores advanced SSH tunneling techniques, local/remote port forwarding, SOCKS proxies, and stealthy lateral movement strategies.
Summary
SSH as the Swiss Army Knife of Network Pivoting
Secure Shell (SSH) is universally trusted and enabled across enterprise servers, making it an ideal vehicle for red team lateral movement and tunneling.
Mastering Dynamic Port Forwarding and Reverse SOCKS Proxies
Evan Anderson demonstrates leveraging SSH's built-in `-D`, `-L`, and `-R` flags to establish multi-hop encrypted tunnels across segmented corporate enclaves.
Abusing SSH ControlMaster and Agent Forwarding
The speaker explains hijacking cached SSH agent sockets (`SSH_AUTH_SOCK`) and multiplexing sessions with ControlMaster to pivot without entering credentials.
Blue Team Telemetry and Hunting Anomalous SSH Tunnels
The presentation provides defenders with detection strategies to audit persistent SSH tunnels, anomalous port bindings, and suspicious client connection flags.
Related talks
Red Team Village·58 min
Corey Ham · Matt Eidelberg
Corey Ham and Matt Eidelberg analyze why targeted attack chains succeed, exploiting systemic blindspots between IT operations and security monitoring.
Red Team Village·1 hr
Sajal Thomas
Sajal Thomas examines the technical gap between commercial red teams and state-sponsored APT groups, sharing advanced tradecraft to elevate offensive testing.
Red Team Village·23 min
Álvaro Rueda
Álvaro Rueda explores covert egress techniques and data exfiltration channels designed to bypass strict enterprise perimeter firewalls and DLP sensors.