Welcome to the pivoting section of this course.
In this section, we're going to be focused
on the process of how to pivot from a compromised
system on a client's network onto other systems
on the client network.
Now, this is a phase that I've mentioned repeatedly
throughout most of this course.
And the reason I said that or the reason
I mentioned that is primarily because the local enumeration
sections of this course had information or were
very important or pertinent to this phase, which, again,
as I said, involves moving from one system
that you have compromised and using that system as a foothold
essentially to exploit or to gain access to other systems
on the target network.
All right.
Now, before we actually get started,
we need to understand what pivoting
is from a very high level, and we
need to get an understanding of the techniques
that we will be utilizing in order to facilitate
the pivoting process.
So pivoting is a post exploitation technique
that involves utilizing a compromised host that
is connected to multiple networks
to gain access to systems within other networks
or those internal networks that are the host of the system you
have compromised is a part of.
So an example of this would be if you compromise a Windows
system that is part of a network and when
you're performing local enumeration,
you're able to identify that this system is not just
part of one network, but it is a part
of another internal network that has
systems that you could not previously
access through the internet.
So it's an internal network where you can only
interact with those systems via other systems on that network.
And given the fact that you've compromised
one of these systems that was accessible through
the internet, you can now gain access
to these internal systems that you previously
could not access.
So after gaining access to one host,
we can use the compromised host to exploit other hosts
on a private internal network or other hosts on the same network
that the compromised system is a part of.
And, of course, the objective here is to move from one system
to another.
So that's the key point that I want you to take from here.
And as I said, pivoting can be quite confusing
because you might be thinking to yourself, well,
there's really two streams here.
There's two streams of thought.
One of which is if you gain access to a target system
and you find that it's only part of one network,
does that mean that you can perform--
that you cannot perform pivoting?
No, not at all.
What you need to do then is identify the other systems
that are part of that network and then pivot
to those systems.
Now, as I said, in some cases, you
will find that a system that you have compromised irregardless
of the operating system is part of more than one network.
So it could be part of one network that
is DMZ and can be accessed through the internet
or via the internet.
And it is also part of another internal network of computers
or systems that is not accessible via the internet
or publicly.
So there's two ways you can go about it,
and the process will remain the same.
The only thing that will change is the environment
that you're working on.
The key pieces of information and how to obtain them
have already been covered in this course.
So it's going to be relatively simple to understand.
Now, for the purpose of demonstrating pivoting,
we are going to be utilizing Meterpreter or the Metasploit
framework.
The reason I'm doing this is primarily
because the Metasploit framework and Meterpreter, in particular,
already have these commands or tools built into it
and makes it much simpler to understand
in terms of what's going on and how to do
or how to set up remote port forwarding and local port
forwarding.
So there's other techniques and tools
that you can use to do this, but we
are going to be covering those techniques
in an advanced certification that merits that.
However, for now, the objective here
is to explain what's happening.
Now, in order to understand pivoting,
you need to understand port forwarding.
So what is port forwarding?
Port forwarding is the process of redirecting traffic
from a specific port on a target system
to a specific port on our system, our local system.
This can be your penetration testing distribution.
It could be your Kali Linux system, [INAUDIBLE] OS
whatever.
What you're trying to do is say, I
want you to redirect the traffic from a specific port
on a target system that you'd like to compromise.
And I want you to forward that traffic
to a local port on our system, so that we
can access that service.
So in the context of pivoting, we
can forward a remote port on a previously inaccessible host
to a local port on our Kali Linux system,
so that we can remotely interact or exploit the service that
is running on that port.
Now, this diagram here, essentially
visualizes what pivoting is.
So you can see that this is our attacker system.
So in the context of the lab environment that we
will be using, this is our Kali Linux system
and it has its own IP address.
Do note that these IP addresses are just examples.
This is not the actual IP specification within the lab.
I've just set this up to explain the process.
So you can see that it has its own IP address,
and it is part of the internet.
Let's say, it's part of a network.
It could be the internet, it could be a local network,
whatever the case.
And we gained access to victim one.
Now, victim one is a part of this network
that the Kali Linux system is on,
which means that we can access victim one without any issues.
And we'll exploit it and gain access to it.
When performing local enumeration,
more specifically enumerating network information,
we're able to identify that victim one, in addition
to being part of this network, is
part of an internal network with its own subnet CIDR here.
And you can see that it has, in addition to having one IP
address for this network, it has another IP address
for this network.
So that devices within this particular network
can communicate with it and vice versa for the other network.
So we can use this system that we've
compromised as our foothold to essentially gain access
to victim two.
Now, the important thing to note here is we cannot access victim
two via our Kali Linux system.
We have to use the system that we've
compromised as an intermediary or a jumping point
to access this other system, and consequently, exploit
it, and gain access to it.
And this is a very simple example.
Of course, in a larger network, you're
going to have multiple systems that you can pivot to.
So you could have victim two, victim three, victim four, all
the way to hundreds of systems.
So this is just a simple example.
And in terms of gaining access to victim two,
we, of course, going to need to identify
what ports are open in victim two and what services
are running on those open ports.
And the way we can target that port
or identify what service is running on that port
is by performing port forwarding.
So port forwarding will essentially
allow us to perform or to forward a port, maybe port 80,
on victim two onto port 1234 on the Kali Linux system.
So that we can perform an Nmap scan on the Kali Linux system
on port 1234 to identify the service
that's running on port 80 on victim two.
This may be a little bit confusing,
but it will make sense in a couple of seconds
when we get started with the lab environment.
So this video has a lab environment attached to it,
and we're going to be going through a very simple flow.
I'm going to showcase the two target systems and their IP
addresses.
And you'll be able to see that we'll only
be able to access one IP address from our Kali Linux system.
So we'll be exploiting that system first.
Once we exploit that system, we will then
set up port forwarding or we'll essentially
be adding the root to that system,
and then we'll set up port forwarding,
identify the open ports on the second system,
and identify the vulnerable service that's
running on one of those ports, and then
will exploit it and gain access to the second system.
So fire up your lab environment, and I'll see you there
in a couple of seconds.
So I'm back in the lab environment.
And you can see that you'll be provided with two IP addresses.
So the IP address for victim machine one and the IP address
for victim machine two.
Now, do note in your lab environment,
these IP addresses are going to be different.
All you need to do is just follow
the process and the techniques that I'm showcasing
and make sure to replace your own lab environment IPs
when performing this practical demonstration.
So let me just show you what will happen.
So let's try and ping victim machine one,
and let's see whether we can access it from our Kali Linux
system.
So I'll open up a terminal here, and I'll say ping.
And I'll paste in the IP of the target one.
You can see that we receive a response, which
means that the system is up.
And in addition to that, it means
that we can access this system via
or we can communicate with the system via our Kali Linux
system.
Now, let's try and see whether we
can access victim machine two.
So I'll copy the IP address there for victim machine two,
and I'll say ping, paste it in there.
And you can see, what's this?
We don't get a response.
That's really weird.
Why aren't we getting a response?
Well, that essentially means that we cannot access this
target system from our Kali Linux system,
and can only access it from victim machine one.
So let's perform an Nmap scan on victim machine one
to identify the vulnerable service that's running on it.
So I'll open up a terminal again in here.
And I'll zoom in so you can see what's going on.
And I'll say Nmap sv and I'll perform or limit the port scan
to port 80, because that's the port that
has the vulnerable service, and I'll
paste in the target or victim one's IP address here.
So I'll hit Enter.
We'll give this a couple of seconds.
So the Nmap scan is complete, and we can
see that we have port 80 open.
And the service that's running on port 80
is the HTTP file server version 2.3.
We can, of course, confirm this by opening up or accessing
that port on victim one through our web browser.
And you can see, indeed it is running the HTTP file server
version 2.3 that is developed by Rejetto.
Now, this specific version of HTTP file server
is vulnerable to an exploit, and this exploit is also available
as a Metasploit framework exploit module.
So I'll just say Rejetto.
So exploit Rejetto and you can see there is a Metasploit
framework exploit module here, remote command execution
for version 2.3.
And, of course, we can open up MSF console now.
And we'll give this a couple of seconds.
We don't really need our browser.
So I'll just get rid of that there.
And we will say search Rejetto, there we go.
And I'll say use 0 and I'm specifying the module ID.
And then I'll say set our hosts or the target IP,
and I'll specify the IP address of victim one.
There we are.
If I show the additional options for this module,
I have the ability of setting up the payload option.
So the lhost option and the lport option, these
are already set for me.
And we have already set the target IP.
So I can type in exploit, and this
will provide us with a Meterpreter session
on the target system.
There we go.
So we get a Meterpreter session, and we'll
give this a couple of seconds.
There we are.
And we can perform some local enumeration.
So I'll say sysinfo.
You can see that this system, victim one,
and let me just open up the actual--
you can see this is victim machine one is running Windows
Server 2012 R2 build 9,600.
It is a 64-bit version of Windows Server.
And we say get user ID.
You can see that we currently have access to victim one
as the administrator user, which means that we
have an elevated session.
And that means that we do not need to elevate our privileges.
So the next step, of course, is to type in the IP config
command as you already remember.
And if we take a look at the interfaces,
we can see that we have the loopback interface, which
is fine.
We also have a Microsoft ISATAP adapter here.
And the current interface that this system is using
and the network that it is a part of is the following.
So this is the AWS PV network device.
And this is the IP address of victim one, which makes sense.
And this is the IPv4 netmask, which
gives us an idea as to the actual size
or range of the network.
In this case, the actual subnet is limited to, as you can see,
240 devices or IP addresses.
This will become very important.
So what we need to do now is we've
identified that it is only part of one network,
and this network has other devices on it.
So how do we scan for these other systems on that network?
Well, we already know the target IP address
of victim machine two.
But before we do that, we need to add a route.
Now, the route will essentially allow
us to access victim machine two from victim machine one.
So how do we add this route?
Well, we want to add the route for this entire--
or for this particular subnet.
So we can say run autoroute, and we're specifying the subnet.
So we specify the subnet.
So 10.0.29-- and instead of saying the-- or specifying
the IP address of the victim machine one, we say 0.0/20.
So we're essentially adding a route to this entire subnet.
And in your case, make sure to replace it
with the actual subnet of victim machine one in your lab
environment.
So I'll hit Enter.
And you can see it's going to tell
you right over here adding route to that particular subnet.
And it's added the route, and we can essentially say autoroute p
to list all the active routes.
And I can say autoroute--
let me just type that in correctly.
So autoroute-- let me just say, run autoroute.
And I can then say, p for example here.
And this will display the active routing table.
So the actual gateway is session one.
So what this means is that when we want--
we have already added a route within MSF console,
and that means that we can essentially perform a scan
or access any device on that subnet from within MSF console.
So now that we've added the route,
the next step, of course, is to put this Meterpreter session
in the background.
And because we can only access the victim machine two
from within MSF console, we need to utilize the in-built port
scanner, TCP port scanner module.
So we'll say search port scan.
And we are going to be using this one here.
So that has an ID of five.
So I'll say, use five.
I'll show the options here, and we can all
specify the target IP.
And in this case, we're going to say
we want to scan the following right over here.
And you can obviously tell that this device
is part of the same subnet that victim machine one is on.
So you can see that victim machine one has
an IP address of 10.0.29.148.
Victim machine two, 10.0.29.96.
However, it can only be accessed from victim machine one.
So we'll just copy that there, and I'll
say set our hosts because we want to perform
a scan on victim machine two.
Now, and because we've added the route,
we can actually communicate with it through victim machine one.
And we are going to set the port range.
So ports, we'll set that to 1 to 100,
and I'll just type in exploit or run.
And this will discover the open ports on victim machine two.
And remember, the scanning is being performed
through victim machine one.
Because we cannot do this.
We cannot access victim machine two through our Kali Linux
system.
So you can see that on victim machine two,
the only port that's open is TCP port 80, which is presumably
hosting a web server.
So the next step now is to identify the exact service
version that is running on port 80 on victim machine two.
Now, unfortunately, we can utilize
a couple of Metasploit modules to do this,
to enumerate the exact service version that's running.
However, it'll be much better if we can perform it with Nmap
to get an accurate idea.
And given the fact that we cannot run Nmap from within MSF
console.
And Nmap is a separate tool from the Metasploit framework,
we need to perform port forwarding
or rather we need to forward this particular remote port 80
to our Kali Linux system on port--
whatever port we specify.
And in this case, we'll use port 1234
for the sake of simplicity.
So if I list out my sessions, I'll
go back to our session on victim machine one.
So sessions one and to perform the port forwarding,
I'm going to say port forward.
So port fwd.
And I'm going to say add, so I'm adding a--
I'm performing port forwarding.
So first, we want to specify the local port, which in this case,
is port 1234.
And we then specify the remote port, which is port 80.
And the remote system that we're performing the port forwarding
on right and in this case, we want
to specify the IP address of the victim machine
two, because that's the system and the port
that we essentially performing port forwarding for.
So we're essentially saying I want
you to add the following port.
So this is the local port 120--
1234.
And we are forwarding port 80 on victim machine two
to port 1234 on the Kali Linux system.
So that means we will be able to access the service that's
running on victim machine two on port 80
on our Kali Linux system on port 1234.
And if we hit Enter, you can see it's
going to tell you that the local TCP relay is created.
So the local port 1234 on our Kali Linux system to the remote
or to victim machine two on port 80.
Now that is done, we can open up a new tab here.
And because that port is forwarded to port 1234
on our the Kali Linux system, we can say Nmap sv
for service version detection.
And the port that we want to scan is 1234.
And because we are doing this on our calendar next system,
we can simply say local host.
And the reason we are doing this is
to identify the exact service that's running.
So I'll hit Enter here.
And in a couple of seconds, it should tell us
what service is running on port 80 on victim machine two.
So we'll give this a couple of seconds.
The Nmap scan is complete.
And you can see that through our port forwarding,
it's able to identify that victim machine two has
the bad blue service running on port 80,
and this is bad blue version 2.7.
So that's really why we performed port forwarding.
So now, that we've identified that,
we can actually exploit victim machine two
from within MSF console.
So I'll put this in the background.
And we will search for the bad blue exploit
module for version 2.7.
So search bad blue, and this is the one here.
So that is the bad blue pass through overflow
for version 2.7.
So I'll say use 1, and I'll just show the options here.
And there's a few things that we need to customize.
So firstly, we actually need to set up the payload options.
And we are not going to be using a reverse TCP payload.
Instead, going to be using the bind
TCP Meterpreter payload, so I will say set payload.
So I'll just say set payload to--
or I can just type it in lowercase case.
So set payload to exploit, or rather in this case, Windows,
Meterpreter, find TCP.
There we are.
And we want to set the target IP.
So set our host to the IP address of victim machine two
because we can communicate with it
through or from within MSF console
through victim machine one.
So I'll paste it in there.
Set the target IP, and I'll hit exploit.
And we'll give this a couple of seconds.
As you can see, it's sending the stage,
and we receive a Meterpreter session on victim machine two
as denoted by the IP addresses here.
So we can say sysinfo, and you can
see this is a different operating system that's
running on victim machine two.
So Windows Server 2016, build 17763,
and it's a 64-bit version of Windows Server 2016.
We can then say get user ID.
And we also have access to victim machine two
as the administrator user.
So that is how to perform pivoting.
And if I put this in the background,
you can see that if I list out my sessions
these are sessions on different systems.
So you can see that--
you can actually tell that from the IP addresses.
So you can see right over here that these are the IP
addresses, and this is victim machine one and victim
machine two.
So just to summarize what we've done,
we firstly gained access to victim machine one,
which we could access through our Kali Linux system
without any issues.
Once we gain access to victim machine one,
we essentially added a route and we added a route
to the subnet of the network.
That victim machine one and victim machine two
are a part of, and that allowed us to access or to communicate
with victim machine two through victim machine
one within MSF console.
Once we were able to do that, we were
able to identify the open ports on victim machine two.
However, in order to identify the service version that
is running on port 80 on victim machine two,
we needed to forward that remote port
onto a local port on our Kali Linux system.
So that we can perform an Nmap scan
to identify the exact service version, which we did.
We then performed the Nmap scan and identify
that bad blue is running on port 80 on victim machine two.
And then utilize that exploit module to gain access
to victim machine two or to exploit the bad blue service
running on port 80 on victim machine two
through victim machine one.
So that concludes the practical demonstration side
of this video.
So you should now have an understanding of the pivoting
process, and how it can be performed,
how to perform port forwarding.
And, of course, in this video, we
focus primarily on how to do this
through the use of the Metasploit framework.
And again, that's a good starting point.
And this will give you an understanding
of what pivoting entails.
Now, the great thing about this particular section,
which we have actually come to a conclusion on,
is the fact that once you gain access to another system,
once you pivot onto another system,
you essentially go through the entire post exploitation
phase again.
So when we compromise victim machine two,
we would essentially need to perform local enumeration.
We could also automate it if we needed
to elevate our privileges, we could do that.
If we wanted to transfer files, we could also
do that et cetera, et cetera.
So that's the great thing about the pivoting phase of post
exploitation that I really like is that from that point
onwards, once you gain access to another system,
you then go through the post exploitation phases again.
And that process repeats once you
gain access to another system, and another system, et cetera,
et cetera.
So now, that we have explored pivoting,
we're going to move on to the final section of this course,
which will cover the process of how to clear your tracks
and artifacts from the exploitation and post
exploitation phase once you're done on the system
that you have compromised, how to get rid of all the tracks.
And this is not just pertinent to avoiding detection.
It is also pertinent to the rules of engagement
that you agreed upon with your client
before you began the penetration test.
So I'll be going through a few important factors
that you need to take into consideration regarding how
to clear any artifacts or remnants that you created
on the target systems during the post exploitation phase.
With that being said, I'll be seeing you in the next video.