Pivoting and Lateral Movement

Pivoting and Lateral Movement: A Comprehensive Guide for GIAC GCIH Certification

Introduction to Pivoting and Lateral Movement

Pivoting and lateral movement are among the most critical concepts in post-exploitation, and they form a significant part of the GIAC GCIH (GIAC Certified Incident Handler) exam. Understanding these techniques is essential not only for passing the certification but also for effectively detecting, responding to, and preventing real-world attacks.

Why Are Pivoting and Lateral Movement Important?

Once an attacker gains initial access to a single system within a network, their goal is rarely limited to that one machine. Instead, they seek to expand their reach, access sensitive data, escalate privileges, and establish persistence across the environment. This is where pivoting and lateral movement become critical.

From a defensive perspective, understanding these techniques is vital because:

• They represent the phase where an attacker transitions from a limited foothold to a full-scale compromise.
• Detection at this stage can prevent a minor breach from becoming a catastrophic data loss event.
• Incident handlers must recognize the signs of lateral movement to contain threats effectively.
• Most advanced persistent threats (APTs) and ransomware campaigns rely heavily on lateral movement to maximize impact.

From an exam perspective, GCIH candidates must demonstrate knowledge of how attackers move through networks and how defenders can identify and mitigate these activities.

What Is Pivoting?

Pivoting is the technique of using an already compromised system as a launch point (or relay) to attack other systems on different network segments that are not directly accessible from the attacker's original position. The compromised system acts as a bridge or proxy between the attacker and the target network segment.

Key characteristics of pivoting:
• The attacker uses a compromised host's network connections to reach otherwise unreachable systems.
• It enables attackers to bypass firewall rules, network segmentation, and access controls.
• Pivoting can be achieved through port forwarding, SSH tunneling, VPN tunneling, SOCKS proxies, or specialized tools.
• The compromised system essentially becomes a "hop point" in the attack chain.

What Is Lateral Movement?

Lateral movement refers to the techniques an attacker uses to move from one compromised system to other systems within the same or connected network segments. While pivoting focuses on reaching new network segments, lateral movement is the broader concept of spreading across the environment.

Key characteristics of lateral movement:
• Uses legitimate credentials, tokens, or exploits to access additional systems.
• Often leverages built-in operating system tools and protocols (living off the land).
• Designed to be stealthy and blend in with normal network traffic.
• Enables attackers to find and access high-value targets such as domain controllers, databases, and file servers.

How Pivoting Works — Technical Details

1. SSH Tunneling (Port Forwarding)
SSH tunneling is one of the most common pivoting techniques. An attacker who has SSH access to a compromised host can create tunnels to forward traffic through that host.

• Local Port Forwarding: The attacker opens a local port on their machine that forwards traffic through the compromised host to a target system. For example: ssh -L 8080:target_ip:80 user@compromised_host — This forwards the attacker's local port 8080 through the compromised host to port 80 on the target.
• Remote Port Forwarding: The compromised host connects back to the attacker's machine and opens a port on the attacker's side. Useful when direct SSH from the attacker is not possible.
• Dynamic Port Forwarding (SOCKS Proxy): Creates a SOCKS proxy on the attacker's machine that routes all traffic through the compromised host: ssh -D 1080 user@compromised_host

2. Metasploit Pivoting
Metasploit provides built-in pivoting capabilities through Meterpreter sessions:

• autoroute: Adds routes through a Meterpreter session to reach otherwise inaccessible subnets. The command run autoroute -s 192.168.2.0/24 tells Metasploit to route traffic destined for the 192.168.2.0/24 subnet through the compromised session.
• portfwd: Forwards a local port on the attacker's system through the Meterpreter session to a remote target: portfwd add -l 3389 -p 3389 -r target_ip
• SOCKS proxy module: Metasploit can create a SOCKS4/5 proxy server that routes traffic through active sessions, allowing tools like proxychains to send traffic through the pivot.

3. Proxychains and SOCKS Proxies
Proxychains is a Linux tool that forces any TCP connection made by an application to go through a proxy (such as SOCKS4, SOCKS5, or HTTP proxies). When combined with an SSH dynamic tunnel or Metasploit SOCKS module, it allows the attacker to use nearly any tool through the pivot point.

4. Chisel, Ligolo, and Other Modern Tools
Modern tools like Chisel create reverse tunnels over HTTP/HTTPS, making them harder to detect. Ligolo-ng provides a TUN-based tunneling interface that allows seamless network access through compromised hosts without requiring SOCKS proxies.

How Lateral Movement Works — Technical Details

1. Pass-the-Hash (PtH)
Instead of cracking a password, the attacker uses the NTLM hash directly to authenticate to other systems. Tools like Mimikatz, pth-winexe, and Impacket's psexec.py enable this technique. This works because Windows NTLM authentication accepts hashes rather than requiring the plaintext password.

2. Pass-the-Ticket (PtT)
In Kerberos environments, attackers can steal Kerberos tickets (TGTs or TGSs) from memory and inject them into their session to authenticate as the ticket's owner. This is related to Golden Ticket and Silver Ticket attacks.

3. PsExec and SMB-based Movement
PsExec (both the Sysinternals tool and Metasploit/Impacket implementations) allows remote command execution using SMB and the Windows Service Control Manager. The attacker needs valid credentials or hashes and SMB access (port 445) to the target.

4. Windows Management Instrumentation (WMI)
WMI allows remote management and command execution. Attackers use wmic or Impacket's wmiexec.py to execute commands remotely. WMI-based lateral movement can be harder to detect because it uses legitimate Windows management infrastructure.

5. Remote Desktop Protocol (RDP)
If an attacker has valid credentials and RDP is enabled, they can directly connect to other systems. RDP lateral movement is often used when graphical access is needed.

6. PowerShell Remoting (WinRM)
PowerShell remoting over WinRM (ports 5985/5986) allows remote command execution. Attackers can use Enter-PSSession or Invoke-Command to execute commands on remote systems with valid credentials.

7. Token Impersonation and Credential Theft
Using tools like Mimikatz, attackers can extract plaintext passwords, hashes, and Kerberos tickets from memory (LSASS process). They can also impersonate tokens of logged-in users to gain their privileges.

8. Remote Services Exploitation
Attackers may exploit vulnerabilities in services running on other systems (e.g., EternalBlue/MS17-010 for SMB, BlueKeep for RDP) to move laterally without needing credentials.

The Attack Chain: How Pivoting and Lateral Movement Fit Together

1. Initial Access: Attacker compromises a single system (e.g., via phishing, exploit, or stolen credentials).
2. Reconnaissance: From the compromised host, the attacker enumerates the local network, identifies subnets, discovers hosts, and maps the Active Directory environment.
3. Credential Harvesting: The attacker dumps credentials, hashes, and tickets from the compromised system.
4. Lateral Movement: Using harvested credentials, the attacker authenticates to other systems on the same network segment.
5. Pivoting: If the target systems are on different network segments (e.g., DMZ to internal network, or IT network to OT network), the attacker establishes tunnels through compromised hosts to reach them.
6. Privilege Escalation: On newly compromised systems, the attacker escalates privileges, often targeting domain admin or enterprise admin accounts.
7. Objective Completion: The attacker reaches their ultimate target — data exfiltration, ransomware deployment, or persistent access.

Detection and Defense Strategies

Understanding how to detect and prevent pivoting and lateral movement is essential for the GCIH exam:

Detection:
• Monitor for unusual SMB, WMI, WinRM, and RDP connections between workstations (workstation-to-workstation traffic is often suspicious).
• Look for anomalous authentication events — same account logging into many systems in a short period.
• Monitor for Mimikatz signatures or LSASS access patterns.
• Use network segmentation monitoring to detect unexpected cross-segment traffic.
• Enable and review Windows Event Logs: Event IDs 4624 (logon), 4625 (failed logon), 4648 (explicit credentials), 4672 (special privileges), and 7045 (service installation for PsExec).
• Deploy honeypots and honey tokens to detect lateral movement attempts.
• Use Endpoint Detection and Response (EDR) tools to identify suspicious process execution and credential access.

Prevention:
• Implement strong network segmentation and micro-segmentation.
• Use the principle of least privilege for all accounts.
• Disable or restrict NTLM authentication in favor of Kerberos with strong protections.
• Implement Local Administrator Password Solution (LAPS) to ensure unique local admin passwords.
• Enable Credential Guard and Protected Users group in Active Directory.
• Restrict lateral movement by limiting admin account logon types and implementing tiered administration models.
• Disable unnecessary services like SMBv1, PowerShell remoting, and WMI where not needed.
• Use jump servers (bastion hosts) for administrative access rather than direct RDP to servers.

Key Tools to Know for the Exam

• Mimikatz: Credential theft, pass-the-hash, pass-the-ticket, Golden/Silver tickets
• Impacket: Suite of Python tools including psexec.py, wmiexec.py, smbexec.py, secretsdump.py
• Metasploit (Meterpreter): autoroute, portfwd, SOCKS proxy modules
• Proxychains: Route tools through SOCKS proxies for pivoting
• CrackMapExec (NetExec): SMB/WMI/WinRM lateral movement and credential validation
• Chisel: HTTP-based tunnel for pivoting
• BloodHound: Active Directory attack path mapping (identifies lateral movement opportunities)
• PsExec: Remote command execution via SMB
• SSH: Tunneling and port forwarding for pivoting

Exam Tips: Answering Questions on Pivoting and Lateral Movement

1. Understand the Difference Between Pivoting and Lateral Movement
The exam may test whether you can distinguish between these two concepts. Remember: pivoting is about reaching new network segments through a compromised host, while lateral movement is the broader concept of moving between systems. Pivoting is a subset or enabler of lateral movement.

2. Know Your Port Numbers
Be prepared to identify attacks based on ports and protocols:
• SMB: TCP 445 (and legacy TCP 139)
• RDP: TCP 3389
• WinRM: TCP 5985 (HTTP) and TCP 5986 (HTTPS)
• SSH: TCP 22
• WMI: TCP 135 + dynamic RPC ports

3. Associate Tools with Techniques
The exam frequently asks which tool is associated with which technique. Create a mental map: Mimikatz → credential dumping/PtH/PtT; Metasploit autoroute → pivoting; PsExec → remote execution via SMB; wmiexec → remote execution via WMI.

4. Focus on Detection Indicators
GCIH is an incident handling certification, so expect questions about how to detect these techniques. Know which Event IDs correspond to specific activities (e.g., 4624 Type 3 for network logon, 7045 for service creation from PsExec). Understand that workstation-to-workstation SMB connections are a strong indicator of lateral movement.

5. Understand the Attacker's Perspective AND the Defender's Perspective
Questions may present a scenario from either side. You might be asked what an attacker would do next after compromising a host, or what a defender should look for given certain log entries.

6. Read Scenario-Based Questions Carefully
Many GCIH questions present a scenario with network diagrams, log excerpts, or tool output. Read every detail carefully. Look for clues like: the source IP being an internal workstation connecting to another internal workstation on port 445 (lateral movement), or traffic from a DMZ host to an internal subnet (pivoting).

7. Remember the MITRE ATT&CK Framework Mapping
The GCIH exam aligns with MITRE ATT&CK tactics. Lateral Movement is a specific tactic (TA0008) with techniques including:
• T1021 — Remote Services (RDP, SMB/Windows Admin Shares, SSH, WinRM)
• T1550 — Use Alternate Authentication Material (Pass-the-Hash, Pass-the-Ticket)
• T1047 — Windows Management Instrumentation
• T1570 — Lateral Tool Transfer

8. Practice with Real Scenarios
If possible, practice setting up pivots with Metasploit and SSH in a lab environment. Hands-on experience makes it much easier to answer scenario-based questions because you understand the workflow intuitively.

9. Time Management
Pivoting and lateral movement questions can be complex and scenario-heavy. If a question is taking too long, flag it and return later. Often, answering other questions first gives you context that helps with difficult scenarios.

10. Use Your Index Effectively
The GCIH exam is open book. Build a thorough index that includes: tool names and their purposes, common ports for lateral movement, Windows Event IDs for detection, and the key differences between pivoting techniques (SSH tunneling vs. SOCKS proxy vs. Metasploit autoroute). Having a well-organized index with page references will save you critical time during the exam.

Summary

Pivoting and lateral movement represent a critical phase in the attack lifecycle where an initial compromise escalates into a full network breach. For the GCIH exam, you must understand both the offensive techniques (how attackers move through networks using tools like Mimikatz, PsExec, SSH tunnels, and Metasploit) and the defensive strategies (detection through log analysis, network monitoring, and endpoint detection; prevention through segmentation, least privilege, and credential protection). Mastering these concepts will not only help you pass the exam but also make you a more effective incident handler in real-world scenarios.