Pivoting is a kind of post exploitation technique that allows you to move around different networks
by using a compromise target.
So you're going to access other networks that is reachable by the compromise target.
Now, to understand how this works, I'll give you a simple example.
So assume that you compromise a target on the network and you have an interpreter session open.
And then you move on to collect internal information gathering on that target.
Oh, what's that you say you used IP config or IAFF config, and there is a second network that your
victim can reach, but you can't.
That's when pivoting comes in particularly handy.
So what you'll do is you'll use your compromise target to jump in the second network that you can't
get to otherwise.
So you'll use an interpreter to add routes to reach a second network.
The whole flow is called pivoting.
And your first compromise machine is your pivot point.
So here I already have a session on Métis Voidable three using the Yes exact module.
But before starting up, I think it's important to understand the logic.
If config.
So this is my IP address to understand to one six.
And I have a session on the machine 10 that tend to court one seven, which is just voidable three.
So then when I use my session on Metters voidable three to connect to one, seven to eight to eight,
that one to eight five Windows seven, which is in another network that.
Well, I just can't reach.
Right.
So when I.
Ping 10 dot and two one seven.
I can reach.
When I ping one seven two two eight one two eight six, which is an other interface of Métis voidable
three I can reach out to.
But when I ping 172 to a one two eight dot five, which is Windows seven, I can't reach it.
Right.
So I think that's pretty clear.
So what I'm going to do is interact with my session.
Let me check just once more who I am and where I am, it's always a good thing to know.
All right, so I have the system level mateparae to show on Métis voidable three.
So after gaining an interpreter show, you have many things to do.
And getting the network configuration of the target is one of the most important things you can do.
So IP config or if config.
That'll bring up and display the basic IP information of the target.
Now, when you look at these results carefully.
You're going to find that the target has another interface, which has the IP address of one seven two
two eight one two eight dot six.
But you are not in that network.
So in order to get more from your penetration test.
You can also try to access that network.
By the way, it is possible to use an interpreter, get local subnet script.
And it will also display the subnets of the target.
Amateur amateur has a man named Rupert.
And as the helpful help menu suggests.
It displays the round table of the target.
But it not only displays it, but also you can add and delete and list this table.
So route without any parameter displays, all routes on Métis voidable three.
And you can get local subnets and the networks that are reached by the target from this result as well.
So now that we have all the network information.
We can go ahead and run Métis Boit Auto Route as our post module to create a route to Windows seven
over Métis voidable three.
And here's the info command for Auto Round.
So let's go ahead and use that.
To view the roots, run post multi manege auto root.
With a parameter, ACMD equals print.
And what this will do is print the route information.
If you've done it before.
So there's no route.
So the same command, but this time change the command value to add.
And then define the subnet value, so subnet equals one seven to dot to eight that one two eight zero.
Hit enter.
And the route is added, so let's print the route information again.
And now you see you have a round two network, one seven two two eight, not one two eight nine zero
over interpretor session one.
So you're going step by step.
So you can send this session to the background or B.G..
And outside of them, interpretor session, you can also observe the route information, but this route
command is it belongs to motorsport itself.
So when you display the help menu, you can find the syntax of it.
It's going to be a little different.
And you can also add the route from here, whichever way it's up to you, but either way, I'll work.
So let's try to ping Windows seven once more.
New denied and the results the same, I can't reach it, so I'll go back.
Now, because you have a route to the other network, you can discover the new targets by scanning for
open ports and detecting services.
So I'm first going to start with a simple sin port, Skåne.
Use auxiliary scanner.
Port, Skåne, sin.
Show me the options.
Said our hosts.
To 172 to 281 to eight, not five and six.
Now, because it is so slow, I'm not going to do this for the whole network.
Said ports.
From one to a thousand.
And set thread's to 50.
So the options again.
And everything seems OK.
So let's run the module.
And the execution of the module is slow due to routing issues, so I'll just pause a recording here
and I'll come back to you in a second.
All right, so we can stop execution at this point, I don't want to wait too much longer.
And as you can see, port for four or five is open on Windows seven.
Was that mean?
It means you can try to piece exact to it with the credentials that you've already gathered from the
beginning of the course.
So use exploit windows SMB Pipes exec.
Show me the options.
Set our host to Windows seven at.
I don't think there's anything else to change.
All right, so XPoint.
Seems good.
Oh, something went wrong.
So options.
Aha, I found it.
Did you have a look, it's the wrong payload.
Now, because you can reach that network over a route, the network still can't connect back to us,
so you need to change the payload to a bind payload.
Makes sense.
Set payload.
To Windows Mature Peter.
Binde PXP.
Show me the options.
All right, so this time it's all OK to me.
Then exploit.
Perfecta Mundoo, you get the session.
Get UUID system level shell this info.
OK, you have an interpreter session on Windows seven.
What time is it?
Hey, it's time to dig into this target and infiltrate the network.