Question

During an internal engagement, you compromise a dual-homed Linux jump host at 10.10.5.20. It has a second interface (192.168.50.5) connected to a segmented database VLAN that your Kali box cannot reach directly. You hold valid SSH credentials on the jump host and want to run your local tools against a MySQL server at 192.168.50.40:3306 without installing any binaries on the jump host. Which technique best accomplishes this?

Accepted Answer

Establish an SSH local port forward (ssh -L 3306:192.168.50.40:3306 user@10.10.5.20) and point your local MySQL client at 127.0.0.1:3306

Answer

Add a static route on Kali (ip route add 192.168.50.0/24 via 10.10.5.20) so traffic is routed through the jump host automatically

Answer

Upload a full port scanner to the jump host and run all enumeration from there, exfiltrating results back to Kali

Answer

Use an SSH remote port forward (ssh -R) so the jump host initiates the connection back to your Kali listener