本博客地址：https://blog.csdn.net/wutianxu123/article/details/125397313
一、场景当可以远程访问内网中的某台SSH服务器时，如果此时的目的是内网中一台web服务器，当无法访问那台web服务器，而这台可以访问的SSH服务器又没有安装一些工具，我们就可以配置一条反向SSH隧道连接（如果没有SSH服务的话）。
要搭建这种隧道，必须先像往常一样，从内网的Windows客户端连到外网的SSH服务器上。通过这条SSH连接，我们可以在服务器上的某个远程端口和本地端口之间建立一条隧道。通过这个本地端口，我们可以暴露某个内部系统的3389端口并通过远程桌面协议访问，或者访问这台Windows设备能访问的任何系统。
二、代码Paramiko的官方示例中有个rforward.py程序，位置在：paramiko-maindemosrforward.py，可以直接使用。
已经对核心部分做了中文注释。代码如下：
#!/usr/bin/python
#-*- coding:utf8 -*-
import getpass
import os
import socket
import select
import sys
import threading
from optparse import OptionParser
import paramiko
SSH_PORT = 22
DEFAULT_PORT = 4000
g_verbose = True
# 管理每个线程的通信
def handler(chan, host, port):
sock = socket.socket()
try:
sock.connect((host, port))
except Exception as e:
verbose("Forwarding request to %s:%d failed: %r" % (host, port, e))
return
verbose(
"Connected! Tunnel open %r -> %r -> %r"
% (chan.origin_addr, chan.getpeername(), (host, port))
)
# 完成数据的收发
while True:
r, w, x = select.select([sock, chan], [], [])
if sock in r:
data = sock.recv(1024)
if len(data) == 0:
break
chan.send(data)
if chan in r:
data = chan.recv(1024)
if len(data) == 0:
break
sock.send(data)
chan.close()
sock.close()
verbose("Tunnel closed from %r" % (chan.origin_addr,))
def reverse_forward_tunnel(server_port, remote_host, remote_port, transport):
# transport负责建立和维持加密通信
# request_port_forward将服务器上某个端口的TCP连接全部转发过来
transport.request_port_forward("", server_port)
while True:
# channel加密transport会话中收发的数据
# 建立一个新的channel
chan = transport.accept(1000)
if chan is None:
continue
# 调用handler函数处理这个channel
thr = threading.Thread(
target=handler, args=(chan, remote_host, remote_port)
)
thr.setDaemon(True)
thr.start()
def verbose(s):
if g_verbose:
print(s)
HELP = """
Set up a reverse forwarding tunnel across an SSH server, using paramiko. A
port on the SSH server (given with -p) is forwarded across an SSH session
back to the local machine, and out to a remote site reachable from this
network. This is similar to the openssh -R option.
"""
def get_host_port(spec, default_port):
"parse 'hostname:22' into a host and port, with the port optional"
args = (spec.split(":", 1) + [default_port])[:2]
args[1] = int(args[1])
return args[0], args[1]
# 参数声明
def parse_options():
global g_verbose
parser = OptionParser(
usage="usage: %prog [options] [:]",
version="%prog 1.0",
description=HELP,
)
parser.add_option(
"-q",
"--quiet",
action="store_false",
dest="verbose",
default=True,
help="squelch all informational output",
)
parser.add_option(
"-p",
"--remote-port",
action="store",
type="int",
dest="port",
default=DEFAULT_PORT,
help="port on server to forward (default: %d)" % DEFAULT_PORT,
)
parser.add_option(
"-u",
"--user",
action="store",
type="string",
dest="user",
default=getpass.getuser(),
help="username for SSH authentication (default: %s)"
% getpass.getuser(),
)
parser.add_option(
"-K",
"--key",
action="store",
type="string",
dest="keyfile",
default=None,
help="private key file to use for SSH authentication",
)
parser.add_option(
"",
"--no-key",
action="store_false",
dest="look_for_keys",
default=True,
help="don't look for or use a private key file",
)
parser.add_option(
"-P",
"--password",
action="store_true",
dest="readpass",
default=False,
help="read password (for key or password auth) from stdin",
)
parser.add_option(
"-r",
"--remote",
action="store",
type="string",
dest="remote",
default=None,
metavar="host:port",
help="remote host and port to forward to",
)
options, args = parser.parse_args()
if len(args) != 1:
parser.error("Incorrect number of arguments.")
if options.remote is None:
parser.error("Remote address required (-r).")
g_verbose = options.verbose
server_host, server_port = get_host_port(args[0], SSH_PORT)
remote_host, remote_port = get_host_port(options.remote, SSH_PORT)
return options, (server_host, server_port), (remote_host, remote_port)
def main():
# 会检查必需的几个参数是否都传进来了
options, server, remote = parse_options()
password = None
if options.readpass:
password = getpass.getpass("Enter SSH password: ")
# 创建一个Paramiko的SSH客户端连接
client = paramiko.SSHClient()
client.load_system_host_keys()
client.set_missing_host_key_policy(paramiko.WarningPolicy())
verbose("Connecting to ssh host %s:%d ..." % (server[0], server[1]))
try:
client.connect(
server[0],
server[1],
username=options.user,
key_filename=options.keyfile,
look_for_keys=options.look_for_keys,
password=password,
)
except Exception as e:
print("*** Failed to connect to %s:%d: %r" % (server[0], server[1], e))
sys.exit(1)
verbose(
"Now forwarding remote port %d to %s:%d ..."
% (options.port, remote[0], remote[1])
)
try:
reverse_forward_tunnel(
options.port, remote[0], remote[1], client.get_transport()
)
except KeyboardInterrupt:
print("C-c: Port forwarding stopped.")
sys.exit(0)
if __name__ == "__main__":
main()
三、运行
命令：
python rforward.py 192.168.153.141 -p 8081 -r 192.168.153.140:3000 --user=kali --password 备注： 192.168.153.141，是SSH服务器的IP 192.168.153.140，是web服务器的IP --user，是SSH服务器的用户名 --password，是SSH服务器的密码
运行效果：
我们连接了SSH服务器，并在上面打开了8081端口，这个端口会将流量都转发到web服务器的3000端口上，现在在SSH服务器上访问http://127.0.0.1:8081，会通过SSH隧道连接到位于web服务器上的3000端口上的web服务。
