Pivoting

Once we have gained access to a system using either a web application or service exploitation, our next goal is to gain access to the internal network that the system might be connected to. Before we explore the details of this, let's first try to understand a bit about port forwarding. Port forwarding is a method which is used to authorize an external device's access to an internal network.

This is most commonly used by gamers. For example, imagine you're playing Counter Strike and you want to play with your friends by creating a game server. However, those friends are not on the same network as you. To overcome this, you port forward an external port of your public IP to your machine's local port number:

Source: https://superuser.com/questions/284051/what-is-port-forwarding-and-what-is-it-used-for

The simplest method of port forwarding is through...

Technical requirements

• Metasploit Framework (MSF)
• PGSQL (Postgres)
• Oracle Java 1.7 or latest
• Armitage
• Cobalt Strike

Pivoting via SSH

This technique can be used to access the local ports on a machine which are not accessible from outside. Also known as SSH port forwarding or SSH tunneling, this technique allows us to establish an SSH session and then tunnel TCP connections through it.

Let's take a look at an example scenario in which we have SSH access to a Linux system. This system has a VNC service running on the machine locally, but is not visible or accessible from outside the network/system. By performing netstat on the machine, we can see that the machine has a VNC service running on port 5901:

However, by running an nmap scan from outside, we can see that the port is not open:

This is where SSH pivoting comes into use. We can use the following command on our system to forward the port of the remote system onto our system using the SSH tunnel:

ssh -L <local port >:<local...

Meterpreter port forwarding

Meterpreter also has a built-in feature which allows direct access to the systems/services inside the network which are otherwise unreachable. The main difference between this and SSH tunneling is that SSH tunneling uses RSA encryption, whereas Meterpreter port forwarding happens over TLS.

Let's look at an example of port forwarding using Meterpreter. The command used for port forwarding using Meterpreter is portfwd. To view the options of the command, you can type portfwd --help into Meterpreter:

In this example, we have access to a host, as shown in the following screenshot:

We can now access the Meterpreter shell by right-clicking on the host via Meterpreter | Interact | Meterpreter Shell, as shown in the following screenshot:

In our example, we have a system with IP 192.168.0.5 running on port 443, which we want to access from outside:

...

Pivoting via Armitage

So far, we have seen methods for pivoting in scenarios in which the machines are in the same subnet and are reachable. However, during a RedTeam activity, we may come across a network which has different subnets that we know exist but are not reachable by the system we have a Meterpreter shell on. In this section, we will look at an example of how to pivot to those networks.

The Windows system has a command-line tool that makes it possible to view the routing table. This tool is called route. The routing table consists of destinations, routes, and next hops. These entries define a route to a destination network.

To view a routing table of the system, we have to do the following:

1. Right-click on the host and go to Meterpreter | Interact | Command Shell, as shown in the following screenshot:

This will open a CMD of our host. We will then run the route print...

Multi-level pivoting

In a RedTeam activity, we may often find more networks which are further accessible from one of the internal systems. In our case, this was the 172.19.4.0/24 network. Multi-level pivoting occurs when we achieve further access into a different subnet. Let's look at an example of this:

In the preceding diagram, the attacker exploits the network and sets up a pivot on 192.168.0.10 to gain further visibility into the internal network. Upon doing more recon, the attacker comes across a system that has two NICs:

Once the attacker gains access to 192.168.0.11, they can then add a pivot again which will allow them access to 172.4.19.0 subnet. This is known as multi-level pivoting. The following diagram explains this:

As explained previously, we found a system in the 172.4.19.0 system which has another IP assigned to it. We exploited that system and added a...

Summary

At the beginning of this chapter, we learned about port forwarding and its uses. We also learned about pivoting and its uses, followed by methods of port forwarding via SSH. Then we learned about Meterpreter pivoting via Armitage, as well as the concept of multi-level pivoting.

There are multiple ways to pivot. In further chapters, we will discuss pivoting via both Empire and Cobalt Strike. If you do not recognize these terms right now, there's no need to worry. We will cover everything in detail soon.

Further reading

For more information on the topics discussed in this chapter, please visit the following links:

• https://artkond.com/2017/03/23/pivoting-guide/
• https://highon.coffee/blog/ssh-meterpreter-pivoting-techniques/