Linux Pivoting
Accessing obtained over one machine to exploit another machine deeper in the network.
After entering remote machine, we can enumerate and search other networks.
Before that if the target machine does not have nmap, we can upload the binary to target machine.
# Linux 64-bit
wget https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/nmap
Copied!When we're ready, let's investigate the network as follow.
# ARP cache
arp -a
# Network hosts, ip addresses
cat /etc/hosts
cat /etc/resolv.conf
nmcli dev show
# Network ranges
nmap 10.0.0.1-255
nmap 172.17.0.1-255
for i in {1..255}; do (ping -c 1 10.0.0.${i} | grep "bytes from" &); done
# Port scan
nmap 10.0.0.2
nmap 172.17.0.2
for i in {1..65535}; do (echo > /dev/tcp/172.17.0.2/$i) >/dev/null 2>&1 && echo $i is open; done
Copied!
If we find host and port but cannot directly access from local machine, we can accomplish that by reverse port forwarding. For example, assume we found another host 172.16.22.2 and port 5985 in remote machine, then we want to connect the port on the host. Execute the following commands on each machine.
Now we can access to 172.16.22.2:5985 from local machine as follow.
After that we can connect to the service.
For details, please refer to Port Forwarding with Chisel.
After modifying the routing table, you can fetch information using the IP (e.g. 172.28.101.51) in msfconsole. For example:
Socks Proxy
It is an intermediate server that supports relaying networking traffic between two machines.
After that, you can use the localhost using tools like curl, proxychains.
Last updated