Lateral Movement and Pivoting
Lateral Movement and Pivoting
This domain tests moving from a foothold into other network segments without losing access or corrupting evidence. CPTS expects clean tunnels, correct routing, and protocol-aware movement.
Core rules
- Map the network from the compromised host: ip a, ip route, ARP, DNS, and reachable services. Identify dual-homed hosts and internal-only subnets.
- Choose the tunnel by need: SSH local, remote, or dynamic forwarding for TCP; Chisel or Ligolo-ng for reverse tunnels; socat for relays; proxychains for SOCKS-aware tools. Know which direction the connection must initiate.
- Use native or low-noise movement: WinRM, SMB, WMI, PsExec, and RDP. Pass-the-Hash works for NTLM where the service accepts it; Kerberos needs a ticket and correct SPN.
- Keep a route and credential matrix. Note which host can reach which subnet and which account works where.
- Test the tunnel with a single command before scanning. A proxy that drops ICMP will make nmap -sn lie.
Worked example
You compromise a web server with two interfaces: 10.10.10.7 and 172.16.5.10. From your attack host, you start a Ligolo-ng proxy and agent on the web server. The agent reports the 172.16.5.0/24 route; you add it locally and access 172.16.5.20:445 directly. You confirm with nxc smb 172.16.5.20 using a hash from the web server. The reasoning is: discover the second interface, create a bidirectional tunnel, add the route, then use protocol-specific auth.
Traps
Scanning through proxychains with tools that need raw sockets, forgetting DNS resolution inside the tunnel, using a bind shell across NAT, losing the tunnel when the shell dies (use nohup or screen), and moving with domain admin before confirming the account is not monitored.