Welcome back to Basic Exploit Development.
And today, I'm going to show you a fun tool called our Pivot.
So what is our pivot archive as a repository on GitHub that allows the creation of dynamic SoCs for
proxies that functions in reverse.
Normally against a conquest like system that you literally credentials for.
You can create a local proxy port to attack additional machines in the victim's subnet in routing tables
by using the command association nfd or dynamic port forwarding 1080 route at midterm.
However, when those machines versions 8.1 and above come with an optional feature to install it, open
a siege server, not install by default.
And if we have a Windows XP 2000 Vista or seven machine, how can you create a reverse proxy without
having open SDK?
Install our pivot as a Python module that turns the victim's machine into a reverse dynamic soc's proxy
by having a ARC server listed on the attacker and featuring a draft for our pivot.
That excu file client aren't actually that could be installed on the victim.
Our pivot or client actually dates next back to the specified attacker's IP address and listener server
port.
On the attacker side, it buys a new port of your specification to use proxy chains to allow the attacker
to scan through this proxy through the initial victim's network.
In this exercise, we will be using one compromised Windows machine as a proxy to attack additional
machines within the network.
One, we're going to compromise the initial target and gain access to.
We're going to drop client execute on the victim.
Three Run a run client out and the victim's command line for use a newly bound local porchester through
the initial victim to attack additional machines.
So let's go into our penetration testing boxes.
Here's my directory.
We're going to drop, cleaned out, execute on the dome, and we're going to show you how to start the
server.
This just a simple script I made for reference.
So it's python server, not pie server.
Port 999.
Server.
IP.
Myself.
Proxy.
IP.
Local host.
Proxy.
Port 1080.
Now we're going to our desktop into one of our hack machines that we did before.
Several solutions, a 600 by 900 an IP address was 125, I believe.
It's important that we create a HTP server to serve the file to the victim.
So we're going to Python Dash and simple HDP server 80.
And then our victim.
We're going to navigate to our directory.
And then we're going to download client data execute.
So let's look at the documentation again.
On the victim we need to run client that execute sobriety might have the IP address and server report
19999.
So windows are for command line.
Let's see if we can find it.
Yes, we do.
I really wish I could maximize the tax on this, guys.
I'm sorry.
I thought.
Excuse.
Server IP 1921681 2110.
Server 49999.
We now have a new connection from our victim.
And now we're to play around with proxy chains to show you different ways of how I can do it.
Make sure you change that, too.
This sucks for local host 1080.
They don't want to do pricey chains fast and that 422 no pain.
12168 122 one.
We noticed that our host hypervisor has a portal open for proxy chains.
S6 Edge.
192168 122 one.
Look here, this is coming from the windowsills and it's going into the guest.
And now we formed a lateral movement between the initial Windows Hack machine to the host hypervisor.
So let's try it again and see if it takes up the IP address.
See it travels from our Windows had Windows XP machine, which is this IP address and we compromised
the host hypervisor using proxy chains and our pivot.
This is very, very useful in the event that you're exploiting windows machines that do not have open
isolation stock, allowing you to pivot to other windows machines on the network or to look for other
targets to attack.