In this lesson,
we're going to talk about pivoting and relay creation,
focusing on how to move laterally through an environment
during a penetration test.
We'll start by defining these concepts
and then we'll explain how they work.
Pivoting is a process of using a compromised system
to move to other systems within the same network.
This technique allows attackers or penetration testers
to navigate through network segments
that might otherwise be inaccessible.
There are two main types of pivoting:
network pivoting and application-level pivoting.
Network pivoting involves using the network capabilities
of a compromised machine to route traffic to other machines.
For example, suppose you have compromised a machine
and you want to access a web service
on an internal network that isn't directly accessible.
You can set up an SSH tunnel from your machine
to an internal network's target machine
using the compromised machine as a gateway.
After establishing the tunnel,
you can interact with the target's web interface
through your local machine
as if you were on the internal network.
Application-level pivoting uses a compromised machine
to interact with applications and services
on other machines.
Metasploit is a tool that provides the ability
to make this type of pivoting happen.
After compromising a machine
and obtaining a Meterpreter session,
you can create a pivot route through the compromised machine
to access another network segment.
You can then scan the internal network
to identify other potential targets.
Next, let's discuss relay creation.
Relay creation involves capturing
and forwarding authentication requests
to exploit trust relationships between systems.
This allows you to move laterally
by leveraging the captured authentication
to gain access to other systems.
Tools like Impacket are particularly useful
for relay attacks.
For instance, an SMB relay attack captures
and relays authentication requests
to gain unauthorized access to system.
You can set up an SMB relay
using Impacket's ntlmrelayx.py tool,
to forward captured SMB authentication request
to a target machine.
When successful, this grants you access
to the target system using the relayed credentials.
Similarly, an LDAP relay attack targets LDAP authentication.
You can start with an LDAP relay
with Impacket to forward capture NTLM authentication request
to an LDAP server.
Once authenticated, you can perform various LDAP operations,
such as querying user information
or modifying directory entries.
So remember,
pivoting and relay creation are essential techniques
for moving laterally through a network
during a penetration test.
By understanding how to use tools like SSH
for network pivoting,
Metasploit for application-level pivoting,
and Impacket for relay attacks,
you can effectively navigate through
and exploit network environments.
These skills will enhance your ability
to assess and attack complex network infrastructures.