Pivoting and tunnelling

Objective 5.1 in this course covers post-exploitation activities — establishing persistence, performing lateral movement, and cleaning up artifacts. This is the applied lab for the objective, and the third of its lessons. Runs across a two-hop path you build, in the lab from lesson 2.

Why this matters

Pivoting is how you reach a network that only a compromised host can see. Lateral movement (lesson 37) is about which host to reach next; pivoting is about reaching hosts you have no direct network path to at all — the internal segment behind the machine you compromised.

It is where lesson 22's segmentation and this domain's movement meet: a compromised host that straddles two segments is exactly the bridge segmentation was meant to prevent, and pivoting through it is the proof.

The lesson

Reaching a network only the compromised host can see

The situation: you have compromised a host with two network connections — one to the segment you came from, one to an internal segment you cannot otherwise reach. The internal segment is the objective, and the compromised host is your only way in.

Pivoting uses that host as a relay. Your tools run from your own machine, and their traffic is routed through the compromised host onto the internal segment, so you can reach hosts there as though you were local to them.

Why this matters for the assessment: it is the concrete demonstration of a segmentation failure. If a host bridges the office network and the cardholder segment, and you can pivot through it, then the segmentation between them did not hold — which is a finding of exactly the kind lesson 22 sets up, proved rather than asserted.

Port forwarding, SOCKS proxies and their limits

The mechanisms, described for recognition:

• Port forwarding relays a single port from your side, through the pivot, to a specific internal host and port. Simple and precise, and limited to what you forward — one destination at a time.
• A proxy through the pivot (a SOCKS proxy is the common form) is more flexible: it lets many tools reach many internal hosts through the one pivot, rather than forwarding individual ports. This is what makes scanning and interacting with a whole internal segment through a single foothold practical.
• Chained pivots, where you pivot through one host to reach a second, then through that to reach a third — the network equivalent of lateral movement's compounding.

The limits worth knowing: pivoted traffic is slower and less reliable than direct access; some techniques do not survive being proxied; and every hop adds latency and fragility. A pivot is a workable path to an internal segment, not an equivalent to being on it.

Keeping a pivot inside the agreed scope

The scope discipline that pivoting makes easy to breach, because a pivot can reach places you did not intend.

• A pivot extends your reach into a new segment, and that segment may contain hosts that are not in scope. Reaching a segment does not authorise attacking everything on it — lesson 3's rule holds, and the internal segment needs the same scope check as anything else.
• Enumerate before acting. Having pivoted, map what is reachable and confirm which of it is in scope before touching anything — the resolve-and-confirm rule from lessons 9 and 14, on a newly-reached segment.
• The pivot host itself is now carrying your traffic, which is a change to it; it belongs on the cleanup list, and any forwarding or proxy you established is removed at the end.
• Watch the blast radius. Scanning an internal segment through a pivot carries all of lesson 8's availability risk, now against systems that may be more fragile than the perimeter — internal operational technology, for example.

Building a two-hop path in your own lab

The applied lab for objective 5.1, on the lab from lesson 2 with segments you build so you know the layout.

1. Build three segments: yours, a middle host with a foot in two segments, and an internal segment reachable only through that host.
2. Confirm you cannot reach the internal segment directly — the precondition.
3. Compromise the middle host (Domain 4).
4. Establish a pivot through it — a forward, then a proxy — and reach the internal segment.
5. Enumerate the internal segment through the pivot, noticing the slower, less reliable behaviour.
6. Log every hop and the pivot configuration, for the narrative and the cleanup.
7. Tear down the pivot and confirm the internal segment is unreachable again.

The lesson in step 7 is the same as the persistence and movement labs: demonstrate the fix, and confirm you removed what you built.

Egress filtering that would have stopped you

Remediation, from the defender's side, and it is a different control from segmentation:

• Egress filtering. A pivot's traffic ultimately has to leave the network to reach you, and outbound filtering that permits only necessary destinations breaks the pivot's connection back — the control that catches what inbound rules miss.
• Segmentation between the internal segment and the pivot host, so that a compromised bridge host still cannot reach the internal segment — the fix lesson 22 prescribes, seen from the pivot side.
• Monitoring for the pattern — a host suddenly relaying connections it never did before, unusual outbound sessions, a workstation behaving like a router.
• Least privilege on the bridge host, so compromising it yields as little as possible.

The client message: pivoting proves a bridge exists between segments that should be separate, and the fixes are segmentation to remove the bridge, egress filtering to break the path home, and detection of a host that starts behaving like a relay.

What to take into the exam

• Pivoting uses a compromised host to reach a segment only it can see; it is the proof of a segmentation failure.
• Port forwarding relays one destination; a proxy through the pivot reaches many internal hosts; pivots can be chained, with added latency and fragility.
• A pivot can reach out-of-scope hosts — enumerate and confirm scope on the new segment before acting, and mind the availability risk to internal systems.
• Egress filtering breaks the pivot's path home, segmentation removes the bridge, and a host behaving like a relay is a detectable pattern.