HTB Funnel: SSH Tunneling Used to Access Internal PostgreSQL Service

A Hack The Box challenge on a Linux machine exposed two open ports — FTP and SSH — with the FTP server permitting anonymous login. Files retrieved via FTP revealed a default password and a list of new employees, one of whom, Christine, had not changed her credentials, allowing SSH access. Once logged in, a locally running PostgreSQL service was discovered on port 5432 using the ss -tl command, but direct access was blocked as the psql client was not installed. SSH local port forwarding was then used to tunnel traffic from a local Kali machine port to the target's PostgreSQL port, bypassing the restriction. This tunneled connection allowed successful database access as Christine, ultimately yielding the challenge flag.