Pivoting Enumeration
Last updated
Last updated
There are two main methods encompassed in this area of pentesting:
Tunnelling/Proxying: Creating a proxy type connection through a compromised machine in order to route all desired traffic into the targeted network. This could potentially also be tunneled inside another protocol (e.g. SSH tunneling), which can be useful for evading a basic Intrusion Detection System (IDS) or firewall
Port Forwarding: Creating a connection between a local port and a single port on a target, via a compromised host
A proxy is good if we want to redirect lots of different kinds of traffic into our target network -- for example, with an nmap scan, or to access multiple ports on multiple different machines.
Port Forwarding tends to be faster and more reliable, but only allows us to access a single port (or a small range) on a target device.
It would be sensible at this point to also start to draw up a layout of the network as you see it
As a general rule, if you have multiple possible entry-points, try to use a Linux/Unix target where possible, as these tend to be easier to pivot from. An outward facing Linux webserver is absolutely ideal.
There are five possible ways to enumerate a network through a compromised host:
Using material found on the machine. The hosts file or ARP cache, for example
Using pre-installed tools
Using statically compiled tools
Using scripting techniques
Using local tools through a proxy
Win and Lin see the arp cache
Static mapping Lin/Win
Local DNS server (zone transfer?)
Lin/Win ip address, interfaces, gateway etc
Alternative to reading /etc/resolv.conf
Finally, the dreaded scanning through a proxy. This should be an absolute last resort, as scanning through something like proxychains is very slow, and often limited (you cannot scan UDP ports through a TCP proxy, for example).
The one exception to this rule is when using the Nmap Scripting Engine (NSE), as the scripts library does not come with the statically compiled version of the tool.
As such, you can use a static copy of Nmap to sweep the network and find hosts with open ports, then use your local copy of Nmap through a proxy specifically against the found ports.
The following Bash one-liner would perform a full ping sweep of the 192.168.1.x network:
The equivalent of this command in Powershell is unbearably slow, so it's better to find an alternative option where possible.
If you suspect that a host is active but is blocking ICMP ping requests, you could also check some common ports using a tool like netcat.
All credit for this guide goes to:
https://tryhackme.com/room/wreath
The THM Room was created by MuirlandOracle, who puts out amazing content. The contents of this .md come from that room. Check it out!
