Chain footholds across three lab segments, in scope throughout

applied · 90 min · Objective 5.1

Task

Chain a multi-hop pivot across three lab segments you built, reaching a target only the deepest host can see, and keep a scope-and-route log proving every hop stayed inside the intended boundary — because on an engagement the pivot is a new position and the scope follows you to it. Objective 5.1 is post-exploitation and lateral movement.

Steps

  1. On the lab you own, build three segments in a chain — A reaches B, B reaches C, A cannot reach C — with a host in each. Snapshot them.
  2. From A, pivot through B to reach a target in C, building the two pivots.
  3. Keep /tmp/route.md: each hop with from:, to:, via:, and a check that the hop's reach is limited to the intended next segment, not beyond.
  4. Confirm at each stage that you are still inside scope — the deepest pivot is the easiest place to drift out of it.
  5. Read logs along the chain and note what a defender would see at each hop.
  6. Apply segmentation and egress filtering that break the chain, and confirm C is unreachable from A again. Revert snapshots.

Verify

grep -cE "^from:" /tmp/route.md
grep -cE "^via:" /tmp/route.md
grep -ciE "in scope|limited to|only reaches" /tmp/route.md
grep -ciE "segmentation|egress|unreachable|broke the chain" /tmp/fix.md

The first count must be at least 2 — a multi-hop chain. The second must equal it: every hop records the host it pivoted through. The third must be non-zero: you confirmed each hop stayed in scope, because the deepest pivot is where scope drifts. The fourth must be non-zero: segmentation and egress filtering broke the chain, which is the remediation.

Notes

A multi-hop pivot is where scope discipline is hardest and most important — each hop is a new position the scope still governs, and "the target was reachable from where I ended up" is not authorisation to reach it. Segmentation and egress filtering are the controls that break the chain, and reading the logs along it is what lets you write the defender's view. Everything ran on segments you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.