Hands-On Red Team Tactics

Multi-level pivoting

In a RedTeam activity, we may often find more networks which are further accessible from one of the internal systems. In our case, this was the 172.19.4.0/24 network. Multi-level pivoting occurs when we achieve further access into a different subnet. Let's look at an example of this:

In the preceding diagram, the attacker exploits the network and sets up a pivot on 192.168.0.10 to gain further visibility into the internal network. Upon doing more recon, the attacker comes across a system that has two NICs:

Once the attacker ...