Everybody welcome to the next video.
We're going to be talking about another slightly complicated topic so this kind of builds off of the
SSA tumbling video so if you have not seen that go back and watch it.
If you don't understand how SS H tunnelling works more specifically when it comes to the dynamic tunneling.
Just go back and just double check and re watch it if you need an additional tutorial.
Go ahead and google it if not run over the Facebook group and anybody is more than happy to answer a
few questions or maybe somebody will hop on a private chat with you just kind of get a more one on one
time.
So just load.
Just depends on how everybody is doing.
But what we're gonna be doing of going over this video is pivoting.
So when you've gained access to a machine that's dual home and you want to take that a step further
and actually attack the machines on another network that you don't directly have access to leveraging
the machine you compromised.
This is called pivoting.
Now I'm gonna to show you two ways to do this.
Each of them have advantages and disadvantages but it's a pretty good idea to give you both sides of
the fence so you can decide which one works better for you in a particular instance.
Now the first thing I want to introduce you something called proxy chains.
We've kind of went over it in the previous video and it was a quick setup but I mean actually go over
a little bit more detail so proxy change is an application that allows you to use this command proxy
chains and then some other console or terminal command.
Now it doesn't have to be unmanned.
It could be an exploit it could be a python file.
It doesn't matter.
So whatever it is it's getting channeled through the proxy that gets created.
So the socks proxy that gets created with the SS H dynamic port tunnel that you created it that creates
a SoCs proxy and proxy chains does is in its config file it says what proxy do you want to use.
So you tell it what proxy you want to use in this case as the dynamic is the same storm that we already
built on a specific port.
We reference our local host with the port that we used in the SSA command and then that will tunnel
everything.
So proxy change will take all of the map traffic and push it through the proxy and then let the traffic
run through out the other side as if it came from our victim machine.
So what I want to do first is set up that tunnel.
So we've already gone through how to do this but I'll do it pretty quickly.
SS H dash D.
And we'll do a port for 4 4 4 and then admin at 1 9 2 0 1 6 8 that one dot holds a 22 22 and Edmund
Burke.
So we've got our tunnel up in port for 4 4 4.
Next thing we want to do is edit the proxy change config.
So that sets an ATC proxy gains.
Now there's a few things in here we're gonna want change.
The first thing is you can see right here where it says proxy DNS request.
We're going to go ahead and get rid of that.
We don't want to deal with that it causes problems with map.
If you want to learn exactly why.
Feel free to google it but just turn it off when you're working with a map when you're working with
other things feel free to leave it on and all the way at the bottom you'll see we have a SoCs for proxy.
Now if you need to change its socks 5 you can do so right here.
You can do that if you need to but we're going to leave his socks for and we're gonna change it from
90 50 to port 4 4 4 4 which is what we used during our configuration right here for our socks proxy
tunnel for the dynamic tunnel.
That's all we need.
All we need change next is when we use proxy chains.
We just append proxy chains or prevent proxy change to whatever command we want.
So in this case we're going to end map and there's a few commands you need with a map because any map
will use UDP and a few other ways to identify hosts see it they're alive and proxy changes downfall
as is TGP only once the Sox for proxy is a T C P only proxy so you can run into problems with using
anything other than TGP through proxy chains.
So just keep that in mind.
But what we can do is we can do dash p n which keeps it on T C P and we're going to s t just to scan
through the full connect again and then we'll give it a an address somewhere on our Ten Network so if
we look at has been if config
config we can see that we're on our local network here.
But we also have to do a whole machine tendered 0 2.5.
So in this case we're going to use a single host tend at zero to top four.
But in any example you can leave the whole network open and just do the whole never Grange.
But for sake of speed and time for the video we're going to do a specific hosts of 10 to 0 2 to 4.
So if we go ahead and run that we see that a tunneling all the traffic through our our SoCs proxy.
And then we get right here we get a win it looks like a Windows machine based on the ports open.
You see we've successfully scanned a host on a different network through our proxy and compromised the
machine because it was dual home.
So this is how you would use proxy change and if for example there was an exploit for and as RBC as
an example if this is an XP Service Pack 3 machine you could throw quite a few exploits at that and
you could actually use that through proxy chains and in turn gain yourself a shell through various exploits.
So this is this is how you use proxy chains.
But what I want to show you guys is something that I find a little bit more a little bit cooler but
it does require medicinally.
So the interesting part about this is that we can use Metis Boyd to compromise a machine and use that
compromise to gain a pivot point and then use auxiliary modules such as scanners to actually exploit
even further.
So we're going to do in this example is we're going to assume an initial compromise on a Windows machine
that we've compromised already.
So the one we gained all of our hashes from so we'll assume an initial interpreter shell on that machine
that is dual homed and we're going to attack another machine a Linux machine with SSA credentials that
we might that we think might be valid.
So I'm gonna go ahead and set up the mortar British shell and get that rolling and then I'll be right
back.
Perfect.
So now we've got on October we're going to go ahead and take a look at the machine and see what we have
here so we can see this machine is 1 9 2 1 6 8 that 1 9/11 and it looks like it's dual homed on tendered
0 to two point four.
So again if we just spawn a shell real quick and we do I think config we can see that that is indeed
true.
10 that 0 2 to 4 is our home machine.
So we want to scan an attack a machine that we think might be running SS H but to do that we need to
kind of know what we're doing but the problem is we can't run and map through interpreter with a normal
means.
So we can use an auxiliary port scanner from medicinally so we can go out and doing controls.
We'll bring it to the background and we'll hit yes here.
So now if we do sessions dash l we can see sessions
shins dash l we can see we still have our machine and everything looks good.
So now we can use auxiliary scanner port scan and we'll do a p port scanner and we're gonna set are
our hosts to 10 0 up to 5.
In this case we're going to scan this particular host but you could do a zero slash 24 and scan the
whole range again for sake of time.
We're going to do a single hosting and we do set ports that we want to scan to twenty two and we'll
do 80 then we're going to set threads How many threads we want we'll do 50 and we're gonna go ahead
run it so you can see nothing happened.
There's a very important reason for this is that we never set up our route so we never set up a pivot
point in the way you do that is if we look right here if we do run auto route or to route
do all run auto route with Dash P so it'll print the routes that we have set up.
We realize that there's nothing set.
So what we can do is we need to do order out run order out Dash.
S and then the network range so 10 not 0 2 0 slash 24.
So we want to be able to pivot through that range.
Auto route will automatically go through each interpreter shell and find out which Shell has the actual
pivot point.
So if we go ahead and do dash P again I apologize for that.
So we need to set the auto route inside the motorboat.
So if we do sessions dash I won we'll go back in the motor fritter and run auto routes order out dash
as Nintendo 0 2 0 slash 24.
So if we go ahead and run that it will go ahead and add the route and then we can use the dash P option
to show that the route has been added perfect so you can see Gateway is Section One and that is the
subnet and the mask correctly.
So sorry about that it is needing to be done inside the interpreter.
Then we go ahead and background it and we got our port scanner all set up.
So what we're gonna do is we're just going to run it.
So as you can see here are 10 does zero that 2.5 has port 80 open and 22.
So what we can do now that we have port twenty to open is we can use another auxiliary scanner so if
we can use use auxiliary scanner access H then SS H logon and what we're gonna do is we think that we
have valid SS H credentials on a different machine.
So we want to see if we can use and where we can attack the same machine or a different machine on different
network with using those credentials.
We want to see if they work.
So think of this as a password spring with a values an impasse with that we know is worked in other
places but keep in mind all of our attacks are going through the windows machine we compromised.
So we'll set our hosts to 10 of 0 2.5 which is not the same machine that we're working with before the
interpreter Shell is on 10 does 0 about 2 to 4.
So that's its network so 10 to zero not 2.5 is a different machine on that network.
So we're going run that and we do set username to admin and set password to add so we go and run that
we can see boom command shell session too.
So if we do sessions dash l we can see we do have two sessions.
But what's interesting here is we can see it's going from one dot 11 which is are our host up here.
That's going from our machine to one dot eleven which is the composite the compromised machine then
to the external address.
So we're compromised we just compromised a machine from the extract from another network.
So if we do sessions dash I and we want to interact with that session and we could do I.T. and we are
admin my admin.
So if we do s been slash if config we can see we are indeed on 10 to 0 about 2.5.
So what we've done is we've used medicinally to attack a Windows machine that's dual home.
Then we made a root and met a split on that return error session for medicinal to use that allows us
to migrate and start attacking.
It's another it's other network adapter which is the 10 dot 0 2 x range then we did a password spray
on SSA Loggins with admin admin as a username and password against the machines in that range.
In this case that was a single machine and then we were able to gain access to that machine that's inside
of a network only accessible by the 10 are the 1 9 2 1 6 8 1 eleven Windows machine that we just previously
explained.
So you can drill this down even farther.
So if you spawn now the initial axis would shell you can have you can migrate over a material shell
and get a full interactive shell back from there.
And if that machine is dual home you can repeat the whole process so you can get to a point where you
have four or five routes like ten or four or five networks deep and you're able to attack machines far
much much farther into the network than you were able before.
Now take a second re watch the video pivoting is a very very important role for a red team or because
you're going to find yourself running into different network segments that are dual homed and you need
to be able to understand how to traverse these types of networks.