Instructor: Pivoting. 2 2
Now, as I mentioned previously, 3 3
there is a difference between pivoting and lateral movement. 4 4
And so in this lesson, 5 5
we are going to focus on exactly what pivoting is 6 6
and how it distinctly is different from lateral movement. 7 7
Now, when we talk about pivoting, 8 8
this is when an attacker uses a compromised host, the pivot, 9 9
as a platform from which to spread an attack 10 10
to other points in the network. 11 11
When I talk more about lateral movement, 12 12
this is more focused on when an attacker 13 13
hops from one host to another 14 14
in search of vulnerabilities for them to exploit. 15 15
But once they start running those attacks from one point, 16 16
that is the pivot point. 17 17
Now again, let me give you a quick word of warning here. 18 18
Lateral movement and pivoting, 19 19
while they are different 20 20
and we talk about them as separate concepts in this lesson, 21 21
they are used interchangeably 22 22
by a lot of cybersecurity professionals. 23 23
So when you're talking about this in the field, 24 24
people will say lateral movement or pivoting 25 25
to mean the same thing oftentimes, 26 26
but for the exam, there is a difference. 27 27
And so you need to remember, 28 28
the difference really comes down to, 29 29
if you have an attack point established 30 30
and then you're conducting your attacks 31 31
from that point in the network, that is your pivot point, 32 32
and I'll go into that a little bit more in this lesson. 33 33
Now, when we do pivoting, 34 34
one of the main things we have to do 35 35
is we use port forwarding. 36 36
With port forwarding, 37 37
this allows the attacker to use a host as a pivot 38 38
and then we'll be able to access 39 39
one of its open TCP ports to send traffic from this port 40 40
to the port of another host on a different subnet. 41 41
Now, I know that sounds a little complicated, 42 42
so I'm going to go ahead and show you graphically 43 43
what this means. 44 44
First, we have a host. 45 45
This is host A inside the victim network. 46 46
As an attacker, I'm going to find some way to exploit host A 47 47
through some kind of exploit. 48 48
Maybe I used a phishing campaign, 49 49
or maybe I found a vulnerability that I was able to exploit 50 50
with some kind of zero-day code or something like that. 51 51
However, I got in, let's just say host A 52 52
has been had by an attacker and is now victimized. 53 53
Then we have host B. 54 54
The attacker might be conducting reconnaissance 55 55
and identifying another target. 56 56
So as I got into host A, I now start looking around 57 57
and identified there's this other host, B. 58 58
This is my looking out as a way of looking forward 59 59
as the lateral movement that I may want to achieve later. 60 60
And then I keep searching 61 61
and I find that there's also this host C 62 62
depicted here as a server, 63 63
and so I have access to host A 64 64
because I have control over it 65 65
due to my initial exploitation. 66 66
Then as part of my reconnaissance, 67 67
I might find that I can reach host B, 68 68
but I can't reach host C because it's on a different subnet. 69 69
If this is the case, I may decide to exploit host B instead. 70 70
By doing this, I now can have some kind of an exploit shell 71 71
between host A and B. 72 72
For instance, I may have gotten into host B 73 73
and set up a listener on it 74 74
and then had a Netcat connection between host A and B. 75 75
Now that doesn't give me access to C yet, 76 76
but I might be able to find that host B 77 77
is on the same subnet as host C 78 78
and has the ability to reach it 79 79
because of its network configuration. 80 80
For example, the firewall might trust host B, 81 81
but doesn't trust host A, 82 82
so host B can get into that subnet. 83 83
Now, as the attacker, I want to be able to get into host C. 84 84
So how can I do that? 85 85
Well, maybe I'm going to set up a port forwarder on host B. 86 86
For example, if I wanted to use RDP, 87 87
the remote desktop protocol, 88 88
I would set up a port forwarder of 3389 on host B. 89 89
That will forward the port 3389 from B over to C. 90 90
Now, I would have the ability from B 91 91
to establish a connection, 92 92
but that still won't get it all the way back to host A, 93 93
which is where I actually have my footprint. 94 94
So I would want to set up a listener on host A 95 95
for port 3389, which again is RDP. 96 96
This way, anything received on host B for port 3389 97 97
will get forwarded from B over to C, 98 98
and we're going to use it 99 99
as a pass-through point or a pivot point. 100 100
So now as an attacker, I can initiate an RDP session 101 101
with host C from host A by going through host B 102 102
and, essentially, I'm playing a telephone game. 103 103
Anything I send to B is going to get redirected to C. 104 104
Anything that goes from C to B gets redirected back to A, 105 105
and so we're just passing through B on our way to C. 106 106
This allows the attacker to successfully pivot 107 107
from host A through host B into host C, 108 108
and that way we have a full RDP connection ongoing. 109 109
Now, that's the way it looks 110 110
when you're doing this inside of a network graphically, 111 111
and again, this is a very simplified diagram, 112 112
but it gives you the idea 113 113
of going through one host to another, 114 114
and we're pivoting through that host 115 115
by doing that port forwarding. 116 116
In addition to that, 117 117
we can do this instead of using RDP, we could use SSH. 118 118
With SSH, it's actually really easy to use it for pivoting 119 119
because you can use the -D flag, 120 120
which sets up a local proxy and port forwarding 121 121
on a given target. 122 122
And so this is something that is used a lot by attackers. 123 123
For instance, you might have, again, host A, 124 124
host B and host C. 125 125
Now, host A can't get to host C 126 126
because it's being blocked by the firewall, 127 127
but host B can get to host C. 128 128
So what will we do? 129 129
Well, we'll create an SSH channel between A to B, 130 130
and then we'll pivot from B through the firewall 131 131
over to host C, 132 132
creating that connection 133 133
and allowing host A to connect to host C through host B. 134 134
Now, in both of my examples, 135 135
I showed you where we used a single pivot point, 136 136
but attackers can actually chain 137 137
their proxy servers together 138 138
in order to continue pivoting from host to host 139 139
until they reach a mission critical host or server. 140 140
For example, in one network I worked in, 141 141
we had a very complex network setup 142 142
with multiple different subnets 143 143
where only certain ones could trust each other, 144 144
and we had an attacker 145 145
that actually found their way through 146 146
three or four different subnetworks 147 147
pivoting through until they got to the thing 148 148
they were looking for. 149 149
For example, some networks may be built 150 150
in a very complex manner, 151 151
and you may have certain areas 152 152
that are dedicated on certain subnets, 153 153
like the accounting subnet, 154 154
your credit card databases, 155 155
maybe you have some ICS or SCADA 156 156
that's going to be on another network 157 157
and an attacker can actually pivot 158 158
through multiple pivot points 159 159
until they get into the particular networks they need to 160 160
for the attack they're trying to run. 161 161
And so this is important to consider 162 162
as people start chaining these proxy servers together 163 163
to reach their end goal and into their end state.