Pearson's OSCP Notebook

sshuttle

Properties1
tagssshuttle, ssh, tunneling, pivoting, vpn, subnet-routing, oscp

2 min read

sshuttle — VPN-Like SSH Tunnel

sshuttle routes entire subnets through an SSH connection — like a lightweight VPN. Run on Kali; no extra binary on the pivot (uses SSH only).

Ctrl+F: sshuttle · 172.16 · subnet · sudo sshuttle · VPN pivot

OSCP use: You have SSH creds to a dual-homed pivot → sudo sshuttle -r user@PIVOT 172.16.0.0/24 → scan and interact with the internal network without proxychains. Easier than -D SOCKS for most tools.

Compare: Ligolo-ng (full TUN, no SSH needed) · SSH Tunneling > 📌 3) Dynamic Port Forwarding — SOCKS Proxy (`-D`) (proxychains) · SSH Tunneling

Install (Kali)

sudo apt update && sudo apt install -y sshuttle

Verify: sshuttle --help

Full install index → Installation - Kali Setup > 📌 Remote access & pivoting

Pivot requirement: SSH access + Python on pivot (most Linux boxes have both).

📌 Basic Usage

# Route one internal subnet through pivot
sudo sshuttle -r user@10.10.10.5 172.16.0.0/24
 
# With SSH key
sudo sshuttle -r user@10.10.10.5 172.16.0.0/24 --ssh-cmd "ssh -i id_rsa"
 
# Multiple subnets
sudo sshuttle -r user@10.10.10.5 172.16.0.0/24 192.168.1.0/24
 
# Verbose / debug
sudo sshuttle -r user@10.10.10.5 172.16.0.0/24 -v
 
# Non-standard SSH port on pivot
sudo sshuttle -r user@10.10.10.5:2222 172.16.0.0/24

While sshuttle runs, target internal IPs directly:

curl http://172.16.0.10
evil-winrm -i 172.16.0.10 -u admin -p password
crackmapexec smb 172.16.0.0/24 -u user -p pass

Press Ctrl+C to stop and remove routes.

📌 Advanced

# Auto-route remote subnets (exclude pivot's own network)
sudo sshuttle -r user@10.10.10.5 0/0 --exclude 10.10.10.0/24
 
# Through existing SSH local forward (tunnel already on port 2222)
ssh -L 2222:127.0.0.1:22 user@10.10.10.5 -N -f
sudo sshuttle -r user@127.0.0.1:2222 172.16.0.0/24
 
# DNS through tunnel
sudo sshuttle -r user@10.10.10.5 172.16.0.0/24 --dns

📌 sshuttle vs Other Pivot Tools

ToolNeedsProxychains?Nmap SYN?
sshuttleSSH + sudo on KaliNoLimited — prefer -sT
SSH -DSSHYes-sT only via proxychains
Ligolo-ngAgent binary on pivotNoYes (full TUN)
ChiselBinary on pivotOptional (SOCKS)-sT via proxychains

Tip: Use sshuttle for service interaction (curl, evil-winrm, nxc). For full subnet Nmap, prefer Ligolo-ng or proxychains + nmap -sT -Pn.

📌 Workflow

Land SSH on pivot → ip a shows 172.16.0.0/24
    ↓
sudo sshuttle -r user@PIVOT 172.16.0.0/24
    ↓
Scan / attack internal hosts directly

📌 Quick Cheat Sheet

sudo apt install -y sshuttle
sudo sshuttle -r user@PIVOT 172.16.0.0/24
sudo sshuttle -r user@PIVOT 172.16.0.0/24 --ssh-cmd "ssh -i id_rsa"
# Ctrl+C to stop

Graph View

Backlinks