Reach a segment only the compromised host can see

short · 55 min · Objective 5.1

Task

Build a two-hop path in your own lab — a compromised host that can reach a second segment you cannot reach directly — and pivot through it to a host on that segment, keeping the pivot inside your intended scope, then close it with egress filtering.

Steps

  1. On the lab you own, build two segments where the attacker cannot reach the second directly, and a pivot host that can reach both. Snapshot the hosts.
  2. From the attacker, establish a pivot through the compromised host — a port forward or a proxy — into the second segment.
  3. Reach a host on the second segment through the pivot, and record the path in /tmp/pivot.md.
  4. Keep the pivot inside scope: confirm it only reaches the intended second- segment hosts, not beyond.
  5. Apply egress filtering on the pivot host that would have prevented the tunnel, and confirm the pivot breaks.
  6. Revert snapshots.

Verify

grep -cE "^(hop|path|reached):" /tmp/pivot.md
grep -ciE "second segment|through the pivot|only reaches|in scope" /tmp/pivot.md
grep -ciE "egress|filter|broke|no longer" /tmp/fix.md

The first count must be non-zero: you recorded the two-hop path. The second must be non-zero: you confirmed the pivot reached the second segment and stayed within the intended scope — a pivot that wandered beyond its target is scope creep. The third must be non-zero: egress filtering broke the pivot, which is the remediation.

Notes

Pivoting reaches a network only the compromised host can see, through port forwarding or a proxy, and keeping it inside the agreed scope is the discipline — a pivot is a new position from which the scope still applies. Egress filtering is what would have stopped it, which is why it belongs in the remediation. Everything ran on segments you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.