Post-exploitation and pivoting in Cybersecurity - Step-by-Step Execution

Concept Flow - Post-exploitation and pivoting

Gain initial access

↓

Establish control on target

↓

Gather information inside network

↓

Identify other systems to reach

↓

Use pivoting to move laterally

↓

Access new targets through pivot

↓

Repeat or escalate privileges

↓

Maintain persistence or exfiltrate data

This flow shows how after getting into one system, an attacker controls it, learns about the network, and moves sideways to other systems using pivoting.

Execution Sample

Cybersecurity

1. Access machine A
2. Run commands to find machines B and C
3. Use machine A as a pivot to connect to B
4. Access B and repeat

This sequence shows how an attacker uses one compromised machine to reach others inside a network.

Analysis Table

Step	Action	Target System	Result	Notes
1	Gain initial access	Machine A	Access granted	Entry point into network
2	Gather info	Machine A	Found Machines B and C	Network mapping
3	Setup pivot	Machine A	Pivot established	Allows connection to B via A
4	Connect via pivot	Machine B	Access granted	Lateral movement successful
5	Repeat process	Machine B	Further targets found	Potential for escalation
6	Exit	-	-	No more targets or stopped

💡 No more targets found or attacker stops after step 6

State Tracker

Variable	Start	After Step 2	After Step 4	Final
Accessed Systems	None	Machine A	Machines A and B	Machines A and B
Pivot Established	No	No	Yes	Yes
Targets Found	Unknown	Machines B and C	Machines B and C	Machines B and C

Key Insights - 2 Insights

Why does the attacker need to use pivoting instead of directly accessing other machines?

Because other machines may not be reachable directly from outside; pivoting uses the compromised machine as a bridge, as shown in step 3 and 4 of the execution_table.

What does 'gathering information' involve after initial access?

It means finding other machines and network details from the compromised system, as seen in step 2 where machines B and C are discovered.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the pivot established?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Check the 'Action' and 'Result' columns in the execution_table for when pivoting is set up.

According to variable_tracker, which systems are accessed after step 4?

A Machines A and B

B Machines B and C

C Only Machine A

D No machines accessed

💡 Hint

Look at the 'Accessed Systems' row after 'After Step 4' column.

If the attacker cannot find any other machines after step 2, what happens to the pivoting process?

A Attacker gains direct access to all machines

B Pivoting proceeds to other machines anyway

C Pivoting is not possible and stops

D Pivoting happens on the same machine

💡 Hint

Refer to the exit_note and the importance of finding targets in step 2.

Concept Snapshot

Post-exploitation means controlling a compromised system to explore and move inside a network.
Pivoting uses one compromised machine as a bridge to access others.
Steps: Access → Control → Gather info → Pivot → Access new targets.
Pivoting is needed when direct access to other machines is blocked.
It helps attackers move laterally and escalate their reach.

Full Transcript

Post-exploitation and pivoting is a process attackers use after breaking into one computer. First, they gain control of that machine. Then, they look around the network to find other computers. Because they often cannot reach these other computers directly, they use the first machine as a stepping stone. This is called pivoting. By connecting through the first machine, they can access others inside the network. They repeat this process to move deeper or get higher access. The execution table shows each step from initial access to pivoting and moving laterally. The variable tracker shows how accessed systems and pivot status change over time. Key moments clarify why pivoting is necessary and what gathering information means. The quiz tests understanding of when pivoting happens and what systems are accessed. Overall, this helps learners see how attackers move inside networks after initial entry.

Practice

1. What is the main purpose of post-exploitation in cybersecurity?

easy

A. To prevent unauthorized access to a network

B. To install antivirus software

C. To perform actions after gaining access to a system

D. To encrypt data before sending

Solution

1. Step 1: Understand post-exploitation context

   Post-exploitation refers to activities done after an attacker has gained access to a system.

2. Step 2: Identify main goal

   The main goal is to explore, gather information, and maintain control over the compromised system.

3. Final Answer:

   To perform actions after gaining access to a system -> Option C

4. Quick Check:

   Post-exploitation = actions after access [OK]

Hint: Post-exploitation happens after breaking in [OK]

Common Mistakes:

• Confusing post-exploitation with prevention
• Thinking it means installing security tools
• Mixing it with data encryption

2. Which of the following commands is commonly used to create a pivot in a compromised network?

easy

A. ssh -L 8080:target:80 user@compromised

B. netstat -an

C. ping 192.168.1.1

D. tracert google.com

Solution

1. Step 1: Identify pivoting command

   Pivoting often uses SSH tunneling to forward ports from a compromised system to reach other targets.

2. Step 2: Analyze options

   ssh -L 8080:target:80 user@compromised uses SSH local port forwarding, which is a common pivot technique.

3. Final Answer:

   ssh -L 8080:target:80 user@compromised -> Option A

4. Quick Check:

   SSH tunneling = pivoting method [OK]

Hint: Pivoting uses SSH tunnels like ssh -L [OK]

Common Mistakes:

• Choosing ping or tracert which are just network tests
• Confusing netstat with pivoting
• Not recognizing SSH port forwarding syntax

3. After compromising a machine inside a network, which command sequence best demonstrates pivoting to access another internal host on port 3389?

medium

A. ssh -D 3389 user@compromised

B. ssh -L 3389:192.168.10.5:3389 user@compromised

C. ssh -R 3389:192.168.10.5:3389 user@compromised

D. ssh user@192.168.10.5 -p 3389

Solution

1. Step 1: Understand SSH port forwarding types

   Local forwarding (-L) forwards a local port to a remote host:port, enabling pivoting.

2. Step 2: Match command to pivoting goal

   ssh -L 3389:192.168.10.5:3389 user@compromised forwards local port 3389 to internal host 192.168.10.5 port 3389 via compromised machine, enabling access.

3. Final Answer:

   ssh -L 3389:192.168.10.5:3389 user@compromised -> Option B

4. Quick Check:

   Local port forwarding = pivoting access [OK]

Hint: Use ssh -L for local port forwarding pivot [OK]

Common Mistakes:

• Confusing -L (local) with -R (remote) forwarding
• Using -D which is dynamic SOCKS proxy, not direct pivot
• Trying direct ssh to internal host without pivot

4. You tried to pivot using ssh -R 9000:10.0.0.5:80 user@compromised but cannot access the service on port 9000 locally. What is the most likely issue?

medium

A. You need to use -L instead of -R for local access

B. The target IP 10.0.0.5 is unreachable from compromised machine

C. Port 9000 is blocked by firewall on compromised machine

D. The remote port forwarding (-R) does not expose ports on the local machine

Solution

1. Step 1: Understand difference between -L and -R

   -L forwards local port to remote host; -R forwards remote port to local host.

2. Step 2: Identify access goal

   If you want to access the service locally on port 9000, you need local forwarding (-L), not remote (-R).

3. Final Answer:

   You need to use -L instead of -R for local access -> Option A

4. Quick Check:

   Local access requires -L, not -R [OK]

Hint: Use -L for local, -R for remote port forwarding [OK]

Common Mistakes:

• Mixing up -L and -R options
• Assuming remote forwarding exposes local ports
• Ignoring firewall or network reachability

5. During a penetration test, you have compromised a Linux server inside a network. You want to access a Windows machine on the internal network that only allows RDP on port 3389. Which sequence of actions best achieves pivoting to the Windows machine?

hard

A. Install antivirus on Linux server to monitor Windows traffic

B. Run a port scan from your machine directly on Windows IP to find open ports

C. Use remote desktop client to connect directly to Windows IP from your machine

D. Set up SSH local port forwarding from your machine to Windows RDP port via compromised Linux server

Solution

1. Step 1: Recognize network restrictions

   Direct access to Windows machine is blocked; only accessible via compromised Linux server inside network.

2. Step 2: Use SSH local port forwarding

   Set up SSH tunnel from your local machine forwarding a local port to Windows machine's RDP port through Linux server.

3. Step 3: Connect via forwarded port

   Use RDP client to connect to local forwarded port, effectively pivoting through Linux server.

4. Final Answer:

   Set up SSH local port forwarding from your machine to Windows RDP port via compromised Linux server -> Option D

5. Quick Check:

   Pivoting = SSH tunnel + local port forwarding [OK]

Hint: Pivot by tunneling RDP through compromised Linux server [OK]

Common Mistakes:

• Trying direct connection ignoring network restrictions
• Confusing port scanning with pivoting
• Installing unrelated software like antivirus