---
description: >-
  Transparent proxy server that works as a poor man's VPN. Forwards over ssh.
  Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.
---

# Sshutle

Source: [https://github.com/sshuttle/sshuttle](https://github.com/sshuttle/sshuttle)

Source 2: [https://sshuttle.readthedocs.io/en/stable/how-it-works.html](https://sshuttle.readthedocs.io/en/stable/how-it-works.html)



## When to use sshutle?

Imagine this scenario:

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FixReG14AO5oQ08sf8t9i%2Fimage.png?alt=media&#x26;token=bd202d86-5f64-435f-b345-2b2ee840d9de" alt=""><figcaption><p>Diagram of the Scenario</p></figcaption></figure>

* **A** machine can connect to **B**
* **B** machine can connect to **C**
* **C** can't connect directly to **A**
* So, in this case, we can use sshutle from C to B proxying the access
* After that, we can access **A** directly from **C**



## Prerequisites

* We don't need to set up sshutle on the target, just on the attacker/Kali
* requirements: python +3.8



## Basic Usage

* We can choose which subnet we want to proxy
* Using 0.0.0.0/0 (or 0/0) proxies _everything_



```bash
sudo sshuttle -r username@sshserver 0/0 -vv
```



"_One some systems, you may also need to use the_ [_`sshuttle -x`_](https://sshuttle.readthedocs.io/en/stable/manpage.html#cmdoption-sshuttle-x) _parameter to exclude sshserver or sshserver:22 so that your local machine can communicate directly to sshserver without it being redirected by sshuttle_".

```bash
sudo sshuttle -r username@sshserver 0/0 -x sshserver:22
```

##

## Tunneling + Extracting Files

Here I've opened a netcat on the 3rd machine:

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FAVFkoNjoz7zQ7MYs1jVc%2Fimage.png?alt=media&#x26;token=1e4f82b7-9db1-4265-b23b-1ca255d75a14" alt=""><figcaption><p>3rd machine ( isolated )</p></figcaption></figure>

Then I connected from Kali (Attacker) to the Second Machine:

* The **0/0** means that All subnets available on the 2nd machine will be proxied to us
* **-x** means that we don't wanna proxy the IP of the server

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FOdAdUrcJkLQOBxM91DO4%2Fimage.png?alt=media&#x26;token=86f12ba6-1de2-4fc3-95fb-56b3053c6d9a" alt=""><figcaption><p>Open the sshutle connection </p></figcaption></figure>

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FAV32HTXTzS6RkDlCKlOr%2Fimage.png?alt=media&#x26;token=68fa75e8-9b8f-47ee-92b5-69ca656f0cb9" alt=""><figcaption><p>file extracted from the internal machine</p></figcaption></figure>

Wireshark doesn't even show the access to the 10.10.10.11 machine, cause we're accessing  through the sshuttle tunnel from Kali (192.168.0.72) to the 2nd machine (192.168.0.67)

<figure><img src="https://3593245608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkPEBr0Ohu5Y49JHmv4La%2Fuploads%2FhhWpY9sxoTxYNJPZUliU%2Fimage.png?alt=media&#x26;token=7053c29a-a2a2-4b94-8d44-d8d86c654c6b" alt=""><figcaption><p>Wireshark Results</p></figcaption></figure>
