Pivoting Techniques

Understanding Pivoting

Pivoting is a technique used to route traffic through a compromised machine to reach an otherwise inaccessible network. This is useful for post-exploitation, enumeration, and lateral movement.

SSH Pivoting

Establishing an SSH Connection

ssh -i pivot [email protected]

• -i: Identity file (private key used for authentication)

Understanding the Network

• The attacker has access to 10.10.155.5 but not 10.10.10.5
• A pivot is needed to access 10.10.10.5 through 10.10.155.5

ProxyChains

ProxyChains allows tunneling network traffic through an SSH connection, enabling tools like nmap, xfreerdp, and firefox to work through the pivoted machine.

Configuring ProxyChains

1. Open and edit the ProxyChains configuration file:

   sudo nano /etc/proxychains4.conf
   

2. Find the following line at the bottom:

   socks4 127.0.0.1 9050
   

   • socks4 → The type of proxy being used (SOCKS4 protocol).
   • 127.0.0.1 → The proxy is running locally on your machine (localhost).
   • 9050 → The port where the proxy is listening.

   This tells ProxyChains to route all connections through a SOCKS4 proxy running on localhost (127.0.0.1) at port 9050.

   By default, Tor uses this port for SOCKS proxying, but in your case, it is likely used for SSH dynamic port forwarding (ssh -D 9050), creating a pivot point into another network.