eJPT Pivoting and Lateral Movement 2 — Questions and Answers
Question 1: You have a Meterpreter session on a compromised host with IP 10.10.10.5 that can reach the internal subnet 192.168.1.0/24. Which Metasploit command adds a route so subsequent modules can reach that internal subnet through this session?
- route add 192.168.1.0/24 [session_id] (Correct answer)
- portfwd add -l 4444 -r 192.168.1.1 -p 4444
- set RHOSTS 192.168.1.0/24
- use auxiliary/server/socks_proxy
Correct answer: route add 192.168.1.0/24 [session_id]
The `route add` command in Metasploit tells the framework to route traffic destined for the specified subnet through an existing session.
Question 2: When using proxychains for pivoting, which configuration file must be edited to specify the SOCKS proxy address and port?
- /etc/proxychains.conf (Correct answer)
- /etc/pivot.conf
- /etc/socks5.conf
- ~/.ssh/config
Correct answer: /etc/proxychains.conf
Proxychains reads its proxy chain configuration (type, address, port) from /etc/proxychains.conf by default.
Question 3: Which SSH command syntax creates a dynamic SOCKS proxy on local port 1080 through a remote SSH server at jump.example.com?
- ssh -D 1080 user@jump.example.com (Correct answer)
- ssh -L 1080:127.0.0.1:1080 user@jump.example.com
- ssh -R 1080:127.0.0.1:1080 user@jump.example.com
- ssh -N 1080 user@jump.example.com
Correct answer: ssh -D 1080 user@jump.example.com
The -D flag in SSH creates a dynamic application-level port forward (SOCKS proxy) on the specified local port.
Question 4: After setting up a Metasploit SOCKS proxy module (auxiliary/server/socks_proxy), what tool is typically used on the attacker machine to route other tools' traffic through it?
- proxychains (Correct answer)
- ncat
- socat
- tcpdump
Correct answer: proxychains
Proxychains wraps any tool's TCP connections and routes them through a configured SOCKS proxy, enabling tools like nmap to reach internal networks.
Question 5: A pentester compromises a dual-homed Linux host at 10.0.0.5 (eth0) and 172.16.0.5 (eth1). To scan the 172.16.0.0/24 network from their Kali machine, they set up a SOCKS5 proxy and prepend 'proxychains' before which tool?
- nmap (Correct answer)
- Wireshark
- Burp Suite
- Metasploit's db_nmap
Correct answer: nmap
Proxychains can wrap nmap so that TCP scans are routed through the SOCKS proxy to reach otherwise unreachable internal segments.
Question 6: Which Metasploit auxiliary module creates a SOCKS proxy that allows external tools to pivot into internal networks via an active session?
- auxiliary/server/socks_proxy (Correct answer)
- auxiliary/scanner/portscan/tcp
- post/multi/manage/portfwd
- exploit/multi/handler
Correct answer: auxiliary/server/socks_proxy
The auxiliary/server/socks_proxy module starts a SOCKS server that forwards traffic from the attacker machine through Metasploit's active session routes.
Question 7: In the context of eJPT pivoting labs, what does a 'dual-homed' host mean?
- A host connected to two different network segments (Correct answer)
- A host with two user accounts
- A host running two operating systems
- A host with two firewall rules
Correct answer: A host connected to two different network segments
A dual-homed host has network interfaces on two separate subnets, making it the ideal pivot point to reach otherwise isolated network segments.
eJPT Pivoting and Lateral Movement 2
You have a Meterpreter session on a compromised host with IP 10.10.10.5 that can reach the internal subnet 192.168.1.0/24.
Which Metasploit command adds a route so subsequent modules can reach that internal subnet through this session?