In 05-01 we escalated privileges and in 05-02 we understood —in a controlled way— how access is maintained on a host. But TechNova's compromise is not measured on a single machine. The host we have taken (for example, the web server exposed in the DMZ) usually has access to internal segments that from our external attacker position were not directly reachable: the 10.10.10.0/24 network with the internal Linux server, the domain controller, the workstations. Pivoting is the technique of using the compromised host as a springboard to reach those networks; lateral movement is moving from one host to another within them using the credentials and access obtained. This is where a finding goes from "they compromised a web server" to "from that server the entire internal network was reachable"—exactly the kind of impact the report needs.

The framing stays firm: everything within TechNova's authorized scope and the RoE. Pivoting is especially delicate because it extends the reach of the compromise to new systems, so only what is explicitly in scope is touched—jumping to an unauthorized network or host, even if technically possible, is stepping outside the contract. As always, each offensive technique comes with its defensive counterpart (segmentation, microsegmentation, lateral traffic detection), because the goal is for TechNova to understand why its flat network is a risk and how to contain it. And we do not cover covering tracks (05-04): here we focus on reaching, not on erasing the trail.

1. Why pivot: the internal network behind the foothold
2. Tunnels and port forwarding (SSH)
3. Proxychains and dynamic SOCKS proxy
4. Pivoting with Metasploit (autoroute)
5. Lateral movement with obtained credentials
6. The defensive side: segmentation and lateral detection
7. Common mistakes and tips
8. Exercises
9. Conclusion

From outside, the attacker saw only TechNova's exposed surface: tienda.technova.lab and little more. Once inside the web server, the perspective changes completely: that host has a second leg on the internal network and sees machines we could not see. Pivoting takes advantage of that dual connectivity.

Kali only reaches the DMZ host; the 10.10.10.0/24 network is behind it. Pivoting turns that host into a gateway so our tools can reach the internal network. First step, once inside: discover what is on the new segment (host interfaces, routing table, a contained port sweep) to know what can be pivoted to—always within scope.

SSH is the pivoting Swiss army knife: it lets you tunnel traffic through the compromised host without installing anything unusual. Three modes, from simplest to most flexible:

Local forwarding — reaching a specific internal service, for example the MySQL database on the internal server 10.10.10.20:3306, which Kali cannot see:

The -L 3306:10.10.10.20:3306 says: "whatever arrives at my local port 3306, send it over the SSH session to 10.10.10.20:3306". This way we reach an internal service without exposing it and without touching more than necessary. Remote forwarding (-R) does the reverse, useful when the pivot cannot initiate connections toward us.

To explore the internal network with many tools, a single tunnel to one port is not enough. The dynamic tunnel (-D) sets up a local SOCKS proxy that routes any destination through the pivot; combined with proxychains, it makes tools that know nothing about proxies (like nmap) exit through it.

With this, an nmap launched from Kali reaches 10.10.10.20 as if it were inside the internal network, exiting via the pivot host. Important notes: SOCKS only tunnels TCP, so you must use -sT and -Pn, and it is best to narrow the scans (few ports, no unnecessary noise)—a massive sweep through a tunnel is slow and highly visible. Scan only what is in scope.

If the foothold was obtained with Metasploit (Module 4), the framework integrates pivoting via routes within the Meterpreter session: autoroute adds the internal network to Metasploit's routing table, so its modules reach that network through the existing session.

autoroute -s 10.10.10.0/24 tells Metasploit "to reach that network, go through this session". From there, scanners and auxiliary modules work against the internal network without a direct connection. A socks_proxy can be added so external tools benefit from the same route. As before: narrow and within scope.

Pivoting gives us network reach; lateral movement uses the credentials gathered along the way (from the 05-01 escalation, from dumps, from configurations) to authenticate on other hosts of the segment. Two high-level techniques, without detailed offensive recipes:

• Pass-the-Hash (PtH): in Windows environments, certain protocols accept the NTLM hash of the password instead of the plaintext password. If during escalation we obtained the hash of an administrative account, it can authenticate on other hosts that trust it without knowing the real password. It is the engine of lateral movement in Windows domains.
• Authenticated remote execution (PsExec / WinRM): with valid credentials (or a valid hash), legitimate remote administration tools allow running commands on another host. It is the same mechanism administrators use; that is why lateral movement is hard to distinguish from normal IT work.

The (Pwn3d!) marker demonstrates that the credential is valid on that host: that is the evidence. There is no need to deploy payloads or take over the whole machine; demonstrating the reach of credential reuse is enough. The methodological key: lateral movement in a pentest is demonstrative—you prove that "with this credential you could reach here" and document the chain, you do not conquer host after host for sport.

The message for TechNova. Pivoting and lateral movement thrive in flat networks where, once inside, you reach everything. The defenses attack exactly that:

• Network segmentation: separate the DMZ from the internal network with firewalls that only allow strictly necessary flows. If the web server does not need to talk to the workstations, then it should not be able to—that cuts the pivot at the root.
• Microsegmentation: take segmentation down to the host/workload level, so each machine only communicates with those it must. It contains lateral movement even within a single segment.
• Least privilege and a tiered administrative model: an administrative account for a workstation should not be valid on the domain controller. This breaks pass-the-hash across tiers.
• Lateral (east-west) traffic detection: monitor not only inbound/outbound traffic (north-south) but also traffic that goes between internal hosts. A web server scanning the internal network or authenticating against many workstations is a very clear signal.
• Credential hygiene: LAPS (unique local admin passwords), Credential Guard, and rotation reduce the value of a stolen hash for jumping to other hosts.

• [Ethical] Pivoting to networks or hosts out of scope. Pivoting makes technically reachable what segmentation kept apart; being able to reach it does not mean you may touch it. Only what the scope authorizes—each new host must be within the contract.
• Sweeping the internal network brute-force through the tunnel. A massive nmap over SOCKS is slow, very noisy, and risks saturating the pivot. Narrow ports and targets; use -sT -Pn.
• Forgetting -sT/-Pn with proxychains. SOCKS tunnels neither raw SYN nor ICMP; without those options the scan fails or lies. It is the most common technical mistake.
• Treating lateral movement as conquest. The goal is to demonstrate the reach of the compromise and document the chain, not to take every machine. Validate access and stop.
• Not documenting the pivot chain. The report needs the full path: "from X (DMZ), via a tunnel, Y was reached, and with credential Z, W was reached." That chain is the impact.
• Leaving tunnels or routes open when finished. Close the SSH sessions, remove the Metasploit routes, and note it. This ties in with the golden rule of 05-02: leave no live access.
• Tip: draw the map of the internal network as you pivot. A good diagram of the compromise chain is worth more in the report than ten loose screenshots.

Exercise 1. You have compromised TechNova's DMZ web server (10.10.10.5, reachable via SSH) and need to reach the MySQL on the internal server (10.10.10.20:3306), which Kali cannot see. Write the forwarding command that makes it possible, explain what each part does and why this demonstrates a segmentation failure. What network control would have prevented it?

Exercise 2. You want to scan specific ports on several hosts of the internal network 10.10.10.0/24 from Kali, through the pivot, with nmap. Describe the setup with a dynamic tunnel and proxychains, state the two mandatory nmap options and why, and one detection measure TechNova could use to spot you.

Exercise 3. During escalation you obtained the NTLM hash of an account svc-admin. Explain, at a high level, what pass-the-hash lateral movement consists of, how you would demonstrate it demonstratively (without conquering hosts), and two counterparts that would break this technique at TechNova.

Solution 1. Command: ssh -L 3306:10.10.10.20:3306 [email protected]. Parts: -L 3306:10.10.10.20:3306 opens local port 3306 on Kali and forwards everything that arrives, through the SSH session with the pivot 10.10.10.5, to 10.10.10.20:3306 (the internal MySQL); you then connect with mysql -h 127.0.0.1 -P 3306. It demonstrates a segmentation failure because the DMZ host has direct connectivity to the database port on the internal network: a compromise in the DMZ reaches internal data. It would have been prevented by a segmentation firewall that did not allow the web server to talk to the internal 3306 (only strictly necessary flows), or by isolating the database in its own segment.

Solution 2. Setup: (1) dynamic tunnel ssh -D 1080 [email protected], which creates a SOCKS proxy on 127.0.0.1:1080 exiting via the pivot; (2) configure proxychains with socks5 127.0.0.1 1080 in /etc/proxychains4.conf; (3) proxychains nmap -sT -Pn -p 22,80,445 10.10.10.20 (narrowing ports and targets). Mandatory options: -sT (TCP connect, because SOCKS does not tunnel raw SYN packets) and -Pn (no ICMP discovery, which also does not pass through SOCKS); without them the scan fails or gives false results. Detection: east-west traffic monitoring—a DMZ host scanning ports on the internal network is an anomalous pattern that an internal IDS or TechNova's NDR should alert on.

Solution 3. Pass-the-hash takes advantage of the fact that some Windows authentication protocols accept the NTLM hash of the password instead of the plaintext password; with the svc-admin hash obtained during escalation, one can authenticate on other hosts that trust that account without knowing its real password. Demonstrative demonstration: validate the credential against one in-scope host (e.g., proxychains crackmapexec smb 10.10.10.31 -u svc-admin -H <hash>) and, with access confirmed (Pwn3d!), document the chain and stop, without deploying payloads or taking the machine. Counterparts: (a) a tiered administrative model—so a workstation's admin account is not valid on the controller or other hosts, breaking the reuse; (b) LAPS/Credential Guard—unique local admin passwords and protection of credentials in memory—which reduce the value of the stolen hash; complemented with detection of anomalous lateral authentications.

We have measured the reach of the compromise beyond the first host. Pivoting turns a compromised machine into a gateway toward internal segments unreachable from outside —with SSH tunnels (local, remote, and dynamic), proxychains, and Metasploit's autoroute— and lateral movement uses the obtained credentials (pass-the-hash, WinRM/PsExec at a high level) to demonstrate how far access reuse reaches, always demonstratively, documenting the chain and never leaving the authorized scope. The counterpart was constant, and it is the message for TechNova: segmentation, microsegmentation, administrative tiering, credential hygiene, and lateral traffic detection—breaking the flat network that makes it possible to reach everything from a single point.

With escalation (05-01), controlled persistence (05-02), and now network reach (05-03), the impact of the compromise is practically measured and documented. One last piece of the module remains, and we will approach it with the defensive side as the protagonist: what an attacker would do to erase their trail and, above all, how the defender guarantees the integrity and traceability of their records. That is 05-04 Covering Tracks and Anti-Forensics, where we will also recall that the professional pentester does exactly the opposite: leaving an auditable trail of everything they have done.