In this video you'll learn how to use Floyd to perform pivoting between a
system that's interconnected to two different IP subnets.
So let's iPhone in.
In this video we'll log into Carly Lenox and we will
compromise the meta exploitable tree virtual machine.
If you recall in section two when we were building our lab,
we had connected meta exploitable tree to Lennox version to meta exploitable
tree to windows version. So to put simply,
this virtual machine here is connected to two networks,
is connected to the pen test network,
which is on the 1 7 2 3 1 0 slash 24 network.
And it is also connected to the 10 11 12 0.0 slash 24 network.
So first actually perform any scanning on the hidden net network.
We need to first compromise meta exploitable tree,
the windows version and then pivot our attacks from meta exploitable tree
windows version to the hidden net network.
Before we get started with this exercise,
let's ensure that METAS exploitable tree,
the Windows virtual machine is connected to both the pen test network and the
hidden network. Simply select the meta exploitable tree windows virtual machine.
So click on settings,
then click on network and ensure adapter one,
it is connected to the pen test network and PROMIS smooth.
It is set to allow all next click on adapter two
where we,
we will see the hidden network is present and also ensure PROMIS
smooth is set to allow all simply click on. Okay, next,
let's check to see whether Meta exploitable Tree to Lenox version
is connected to the hidden network.
Simply select metas exploitable tree U B 1,404 like so
click on settings,
then click on network and ensure that hidden net is configured as a
network name. Simply expand,
advance and ensure PROMIS your mode.
It is set to allow all simply click on. Okay,
what we'll do is we'll power on both our metas exploitable three
virtual machines one at a time. We could power them on like so.
Great. So let's log into Meta Exploitable Tree,
the Lennox virtual machine and we can use the username as
vagrant and password as Vagrant as well.
Great to check to see whether we are receiving an IP address from the hidden net
network. Simply type IP space address like so.
And you should see the network adapter as E C H zero
and it has an INET address of 10 11 12 20
slash 24. Great.
So we know for certain that this virtual machine is receiving an IP address
from the Hidden Net network. Great. So let's minimize this one.
And now let's power on our meta suitable tree windows virtual machine.
Let's click on input keyboard insert Ctrl all delete.
And let's log in with the administrator account.
Remember the password is Vagrant like so
great. Let's open the Windows command prompt
and now let's type IP config and let's verify that there are two network
adapters,
one of which should be connected to the pest network and the others should be
connected to the hidden network. Great.
As you can see,
ether Adapter one is connected to the pest network where
Carli Docs could actually access this machine and we can also see Ether Adapter
local Area Connection two, it's actually connected to the hidden network.
So this means to say that this Windows virtual machine is able
to actually connect or communicate with the virtual machine in the hidden
network.
Let's minimize this and now it's time to power on our Carly Lux virtual machine.
Great. So now that we are in our Carly Lux virtual machine,
the first thing we need to do is actually gain administrative access
on the meta exploitable tree windows virtual machine.
We can gain administrative access on the meta exploitable tree windows virtual
machine by simply compromising the blue security flow on that system.
So it seems as though the exploiters fail.
Let's check our options one more time to ensure that everything is said
correctly.
Let's check the IP address of my Carli machine.
I'll simply type IP a DDR like so
on my Carli machine. It's actually using
uh 41, which was actual problem.
So I'm gonna fix this cuz I set my local host to be 40,
which is inaccurate. So I'll type set
L host
1 72, 31, 41.
Now gonna type exploit and hit enter.
Great.
Now we have him interpreter shell from this exploit let's
first C type A R P. What this will do,
it'll simply run the a R P command on the compromise system,
which is the current victim system and we'll see what it knows
IP address of any other device outside of the pen test
network. In other words,
what we are looking for is to see whether it had communicated with
a network that is other than 1 7 2 2 1 0 slash 24.
And the thing about it is we know the victim machine is connected to this
network, however
it knows about another network.
So what we can do next is execute I ffe command
on our session and actually determine whether
there's a available network adapter that is connected to the hidden
network.
And currently my MeToo shell has died going execute it one more time
and hopefully I'll actually get a reviewal again.
Great.
So I have another MeToo shell this time I'm gonna execute i f config
like Sue.
And let's take a look at the network adapters that are found on the remote
system.
What we are looking for is any sort of network address on any
additional network adapter. So currently we know that the target system,
while the currently compromised system,
it's on this network which is a 1 7 2 31 0 slash 24 network.
Let's screw it on a bit and let's see if there's another network adapter and
look at network adapter number 14.
This here indicates that the Windows version of Meta exploitable three
is connected to 10 11 12 0 slash
four network.
So let's say that we want to pivot our attacks or probably determine
if we can reach this network here and most likely there may be systems
on this additional network.
Hence we are trying to actually scan or probably compromise the meta exploitable
Tree Lenox virtual machine.
So now we can simply type route and see what routes are actually known
on this Windows vision of Metas exploitable tree.
And currently we can see that the Compromise system actually has a route
to another network which is the 10 11, 12 0.0
slash 24 network.
To perform pivoting we need to type run and we need to execute a
postex exploitation module.
So type run post slash multi like so
then we'll type manage and then we'll type auto route
or auto route. What this will do,
it'll simply allow Carli Lenox to inject a route to
perform any sort of pivoting attacks to any network that is unknown to Carli
but through the Compromise system. So in other words,
it will create a new network route to let's say send traffic to this network
through the Compromise system right now.
So great at this point Karli Lenox should be able to reach the 10
point 11, 12.0 slash 24 network.
Let's perform a simple network scan to any device that
is available on the 10, 11, 12 0 network.
So let's type background to send our material potential to the background and
it's currently operating as session two and let's perform a simple TP scan.
So let's do use, actually let's type back one more time.
Let's type use auxiliary,
let's type scanner port, scan
tcp. Great, let's type set R host,
and let's specify the entire subnet.
Great.
And let's scan for one particular port so the scan will actually complete a bit
quickly.
So let's do set ports and let's scan for port 80.
And when you're ready, simply type run.
This scan might take a few minutes to complete simply because it is pivoting
true the pest network,
which is on the meta exploitable tree windows virtual machine.
Great.
As you can see thus far it has detected the meta Exploitable
Tree Lennox virtual machine is open on port 80.
So therefore we are able to actually pivot our attacks through one system
to actually reach another network. During the course of this video,
you have learned how to use Metasploit to perform lateral movement and pivot
over two different networks where we have a single host machine that is
connected to two different IP subnets.
In the next video we'll cover some guidelines on how to control an entire
network as a penetration tester.
I hope this video has been informative for you and I'll see you in the next one.