There's an old blogpost I wrote at the time I came up with this method [0]. I think it contains most of the technical details.

Let me know if anything is confusing, I'll answer it here.

[0] https://paskozdilar.github.io/blog/entries/zero_code_ssh_jum...