Pivoting and Lateral Movement

Pivoting and Lateral Movement

What is pivoting?

Using a compromised system to reach otherwise inaccessible targets.

What is lateral movement?

Exploiting additional systems through established network pivot points.

Why does an attacker pivot after initial compromise?

To reach new hosts, privileges, or data resources.

What is a pivot point?

A compromised system used as an intermediary to access other systems.

What does C2 stand for?

Command and control.

Which Metasploit payload supports built-in pivoting features?

Meterpreter.

What can generate an independent Meterpreter payload?

MsfVenom.

Which Meterpreter command forwards a local port to a remote host and port?

portfwd add.

What does Meterpreter portfwd -l specify?

Local listening port on the attacker system.

What does Meterpreter portfwd -r specify?

Remote destination IP address.

What does Meterpreter portfwd -p specify?

Remote destination TCP port.

What does portfwd add -l 8000 -r 10.10.10.100 -p 80 accomplish?

Forwards local TCP port 8000 through the pivot to 10.10.10.100:80.

Where does a Meterpreter portfwd listener run in the course example?

On the attacking system.

What is the purpose of the auxiliary/server/socks4a module?

Provide a SOCKS proxy through a pivot.

From which internal IP does proxy traffic appear to originate in the example?

The compromised pivot host, 10.10.10.11.

What does Meterpreter background do?

Returns to the Metasploit console while retaining the session.

What does Meterpreter session 1 signify?

The first established Meterpreter session.

What is the purpose of the Metasploit route command?

Send traffic for a destination network through a chosen session.

What does route add 10.10.10.0/24 1 accomplish?

Routes Metasploit traffic to that network through Meterpreter session 1.

Which Metasploit setting selects a remote target host?

RHOST or RHOSTS, depending on the module.

Why does Metasploit route enable further internal exploitation?

Modules can send traffic through an existing Meterpreter connection.

What happens to the session identifier when a new Meterpreter session opens?

It increments to a new session number.

What does /32 mean in a Metasploit target route?

A route for one specific IPv4 address.

What does route add 10.10.20.150/32 1 do?

Sends traffic for that single host through session 1.

What does route del 10.10.20.150/32 1 do?

Removes that host route through session 1.

What does route add 10.10.20.150/32 2 do?

Routes traffic for that host through session 2.

Why did the first database-server pivot fail in the example?

A firewall blocked access from the first compromised host.

Why did the second database-server pivot succeed?

The firewall permitted access from the second compromised host.

What can an attacker learn by testing alternate pivot routes?

Which internal paths are permitted through firewalls.

What does Meterpreter run arp_scanner -r 10.10.10.0/24 do?

Discovers hosts on the specified local subnet using ARP.

Does Meterpreter have a built-in TCP port scanner?

No; Metasploit provides separate port-scanning modules.

Which Metasploit module performs TCP port scanning?

auxiliary/scanner/portscan/tcp.

Which command selects a Metasploit module?

use.

What does set RHOSTS do in the port-scanning example?

Specifies target hosts to scan.

What does set PORTS do in the port-scanning example?

Specifies TCP ports to check.

Which command executes the Metasploit port-scanning module?

run.

Why might an attacker scan through a Meterpreter pivot instead of directly?

Internal systems may be unreachable from the external attacker.

Which other Metasploit scanning interfaces are mentioned?

nmap and db_nmap.

What does LOL mean in the SSH pivoting section?

Living off the land: reusing built-in system capabilities.

What does SSH -L provide?

Local TCP port forwarding through an SSH connection.

What does SSH -L 8000:10.10.10.100:80 mean?

Listen locally on 8000 and forward to 10.10.10.100 port 80.

In SSH -L forwarding, where is the listener in the example?

On the attacking system.

What does SSH -D provide?

Dynamic port forwarding through a SOCKS proxy.

What does ssh -D 3128 establish?

A local SOCKS proxy listening on port 3128.

How does a SOCKS proxy differ from an HTTP proxy?

SOCKS can tunnel multiple protocols; HTTP proxies are HTTP-focused.

What software can use an SSH SOCKS proxy?

SOCKS proxy-aware client applications.

Can SSH -L appear more than once in one command?

Yes, for multiple local port forwards.

Which built-in Windows command provides TCP port forwarding?

netsh interface portproxy.

What privileges does netsh portproxy configuration require?

Administrator privileges.

Where does the netsh portproxy listener run in the example?

On the compromised Windows host.

What does listenaddress identify in netsh portproxy?

The local interface address to listen on.

What does listenport identify in netsh portproxy?

The local incoming TCP port.

What does connectaddress identify in netsh portproxy?

The destination IP address for forwarded traffic.

What does connectport identify in netsh portproxy?

The destination TCP port for forwarded traffic.

What does netsh interface portproxy add v4tov4 configure?

An IPv4-to-IPv4 TCP forwarding rule.

What does listenaddress=0.0.0.0 mean in the netsh example?

Listen on all local IPv4 interfaces.

Which command verifies the netsh listener on port 4444?

netstat -nato | findstr :4444

Which output state confirms a listening netsh proxy port?

LISTENING.

What is a major difference between netsh forwarding and Meterpreter portfwd?

netsh listens on the victim; the shown portfwd listens on the attacker.

What tool can show outbound TCP connections during Windows investigation?

Get-NetTCPConnection or Sysinternals TCPView.

Why can an internal netsh forwarder complicate incident response?

The destination may see another victim IP rather than the external attacker.

What does Metasploit LHOST represent in the reverse-pivot example?

The intermediary address the reverse payload connects to.

What do ReverseListenerBindAddress and ReverseListenerBindPort control?

The actual interface and port used by the Metasploit listener.

Which MITRE ATT&CK technique is associated with netsh port forwarding?

T1090: Proxy.

What is another Linux/UNIX approach to port forwarding mentioned?

Netcat together with named pipes.

What new attacks can internal network access enable?

Machine-in-the-middle or local password-harvesting attacks.

What is the defensive significance of a pivot point?

It identifies a compromised intermediary that must be investigated.

Which incident-response activity should expand to pivot hosts?

Scoping the compromise.

What is the goal of tracing a chain of forwarded connections?

Identify the true source and all compromised intermediary systems.

Are pivoted Metasploit scans necessarily faster than Nmap or Masscan?

No. The book notes they are generally less fast or capable.

Which built-in tools can aid lateral movement after a compromise?

PowerShell, smbclient, and Netcat.

What is the Book 5 Lab 5.2 title?

Pivot Exploitation.