Pivoting and Lateral Movement Flashcards

In the context of a penetration test, which of the following best defines the term 'pivoting'?

Answer: The technique of using a compromised system to attack other systems on different, non-directly accessible network segments.

Pivoting is the technique of using a compromised machine as a 'pivot point' or foothold to attack other systems within a network. This allows a penetration tester to access internal network segments that are not directly reachable from their own machine.

A penetration tester has compromised a public-facing web server and wants to scan the internal network (192.168.10.0/24) from their attack machine. They set up a SOCKS proxy on the compromised server. Which tool is specifically designed to force other applications, like Nmap, to route their traffic through this SOCKS proxy?

Answer: ProxyChains

ProxyChains is a tool that allows a user to force any TCP connection made by a given application to pass through a series of proxy servers. It is commonly used in penetration testing to pivot into internal networks by routing tools like Nmap or Metasploit through a SOCKS proxy on a compromised host.

After gaining an initial foothold on a user's workstation inside a corporate network, what is the primary objective of performing lateral movement?

Answer: To expand access by compromising other systems, locating valuable assets, and escalating privileges throughout the network.

The primary goal of lateral movement is to move beyond the initial point of compromise to explore the network, gain access to more systems, find high-value targets (like domain controllers or databases), and escalate privileges. This expands the attacker's control and gets them closer to their ultimate objective.

A tester has SSH access to a bastion host at `203.0.113.10`. This host can access an internal database server at `10.10.20.5` on port `3306`. To manage the database from their local machine, the tester needs to forward their local port `3307` to the database server through the bastion host. Which command will achieve this?

Answer: ssh -L 3307:10.10.20.5:3306 user@203.0.113.10

The `ssh -L` option creates a local port forward. The command `ssh -L 3307:10.10.20.5:3306 user@203.0.113.10` tells the SSH client to listen on local port 3307 and forward any connections to that port through the SSH server (`203.0.113.10`) to the destination host (`10.10.20.5`) on port `3306`.

A penetration tester is on an internal network and uses a tool to intercept an NTLM authentication attempt from a victim client. The tester then forwards this authentication request to a target file server to gain access. What is this lateral movement technique called?

Answer: SMB Relay

An SMB Relay attack involves an attacker placing themselves between a client and a server, intercepting an authentication request (like NTLM), and relaying it to a target server. If successful, the attacker gains access to the target server with the victim's privileges, without ever needing to crack the password hash.

A penetration tester has established a foothold on a Windows machine in a DMZ. They discover this machine has a second network interface connected to an internal network segment (e.g., 172.18.0.0/24). Which of the following techniques would allow the tester to redirect traffic from their attacking machine through the compromised host to access services on the internal network?

Answer: Port Forwarding

Port forwarding is a technique used to redirect traffic from one network address and port number combination to another. In this scenario, the tester would set up port forwarding on the compromised DMZ machine to relay traffic from a port they can access to a target IP and port on the internal, otherwise unreachable network segment.