Introduction
The SSH protocol enables three major classes of remote server activities: a) command execution (including a login shell), b) network forwarding and manipulation, and c) file transfer.
The OpenSSH maintainers have determined that sftp and scp have no legitimate use for port forwarding (via the -L and -R options). A flag to explicitly disable these features is unconditionally passed to the child SSH executable during file transfers with these utilities.
There may be users with a legitimate need for these features. An obvious subset are penetration testers tasked to verify that this capability is explicitly disabled on public SFTP servers.
Below are two techniques to enable these suppressed features, by either modifying strings in the sftp binary itself, or by redirection through shells that are able to easily edit the command line. Depending upon the capabilities of the platform, either technique might be required to achieve this goal.
Suppression Details
To begin, it is important to locate running processes of interest. The shell function below will reveal PIDs that match a shell pattern (and note this is not a regex). This runs under Debian dash (and most other common shells) and relies on BSD options to ps:
pps () { local a= b= c= IFS=$'\r'; ps ax | while read -r a
do [ "$b" ] || c=1; for b; do case "$a" in *"$b"*) c=1;;
esac; done; [ "$c" ] && printf '%s\n' "$a" && c=; done; }
A conventional SFTP session is launched, in order to examine the processes associated with it:
$ id uid=1001(aturing) gid=1001(aturing) groups=1001(aturing)... $ sftp aturing@sftp.victimandum.com aturing@sftp.victimandum.com's password: Connected to sftp.victimandum.com. sftp>
We assume above that the local UNIX user has an account on the remote SFTP server of the same username.
Once the session is running, a local process search for the username reveals the child SSH process that is spawned by SFTP:
