CompTIA PenTest+ (PT0-003)Post-exploitation and Lateral MovementMedium
A penetration tester has compromised an internal Linux server and wants to move laterally to another machine on the same segment. The tester discovers that SSH is running on the target machine, but direct SSH access is restricted by firewall rules. However, the compromised server has outbound access to the internet. Which technique would be MOST effective for reaching the target machine?
- AUsing 'Metasploit's auxiliary/scanner/ssh/ssh_login' module from the compromised server.
- BEstablishing an SSH tunnel from the compromised server to an external C2 server, then pivoting back in.
- CBrute-forcing SMB shares on the target machine using 'CrackMapExec' from the compromised server.
- DAttempting a port scan with 'nmap -sV -p 22 <target_IP>' from the compromised server.
Show answer & explanationAnswer & explanation
Correct answer: B. Establishing an SSH tunnel from the compromised server to an external C2 server, then pivoting back in.
Establishing an SSH tunnel from the compromised server to an external C2 server allows the tester to pivot traffic through the C2, effectively bypassing the internal firewall rules that prevent direct access to the target machine's SSH service.
Why the other options are wrong
- A. Attempting SSH login directly will fail due to the firewall rules preventing direct access.
- C. Brute-forcing SMB shares is a different lateral movement technique and does not address the specific problem of reaching a firewall-protected SSH service.
- D. A port scan will confirm SSH is running but won't bypass the firewall for access.
SSH Tunneling for Pivoting
A technique where an SSH connection is used to create an encrypted tunnel, allowing network traffic to be forwarded between hosts that are not directly reachable.
- Bypasses firewall restrictions by relaying traffic through a compromised host.
- Can be used for port forwarding (local, remote, dynamic).
- Requires SSH access to at least one intermediary host.
Memory trick: To move laterally, sometimes you need to pivot and reroute.