Hacking

VPN Pivoting

Pivoting refers to method used by penetration testers that uses compromised systems to attack other systems on the same network to avoid restrictions such as firewall configurations, which may prohibit direct access to all machines. For example, an attacker compromises a web server on a corporate network; the attacker can then use the compromised web server to attack other systems on the network.

These types of attacks are often called multi-layered attacks. Pivoting is also known as island hopping.

Earn two pentesting certifications at once!

Enroll in one boot camp to earn both your Certified Ethical Hacker (CEH) and CompTIA PenTest+ certifications — backed with an Exam Pass Guarantee.

View Pricing

Pivoting can further be distinguished into proxy pivoting and VPN pivoting:

• Proxy pivoting generally describes the practice channeling traffic through a compromised target using a proxy payload on the machine and launching attacks from this computer. This type of pivoting is restricted to certain TCP and UDP ports that are supported by the proxy. We will explore proxy pivoting techniques in a future article.
• VPN pivoting enables the attacker to create an encrypted layer 2 tunnel into the compromised machine to route network traffic through that target machine. This is done in order to run a vulnerability scan on the internal network through the compromised machine, effectively giving the attacker full network access as if they were behind the firewall.

Typically, the proxy or VPN applications enabling pivoting are executed on the target computer as the payload (software) of an exploit.

Once you're inside a network, there is a lot more you can do. You can sniff traffic and attempt to capture information that way. You can host a rogue smb server and use it to capture or relay the credentials of any system that touches your server. There's a lot of opportunities that then open up.

Unfortunately, these opportunities require being inside the network with Layer 2 access, as if your system is plugged into that network.

What is Cobalt Strike and What does it add to Armitage?

Cobalt Strike is a penetration testing software designed to execute targeted attacks.

Cobalt Strike adds social engineering features to get a foothold, covert command and control with Beacon, VPN pivoting, and reporting to Armitage's existing post-exploitation and team collaboration capabilities.

Covert VPN

Cover VPN bridges you into your targets network by using a compromised Windows workstation as a hop point. How does it work? Think of it as a two-way packet sniffer. Covert VPN sets up a network interface on your attacker system. Anything that passes through this interface is dumped as-is on your targets network. On the compromised host, acting as a relay, any frames it sees are made available to the network interface created by Covert VPN.

The covert part of Covert VPN is the ability to choose how it relays traffic back and forth. You can relay frames using a UDP transport. This is fast and works like a traditional VPN. You can relay frames using a reverse TCP connection. Or you can relay frames as HTTP, GET, and POST requests. This last option is useful if the only way out of a network is through a proxy server. None of these options is very quiet though, as a VPN is always chatty.

With Covert VPN, you have the option to bring other tools into your engagement. You're now in the target's network and can do what you need to do.

How to Deploy

To activate Covert VPN, right click a compromised host, go to Meterpreter ->Pivoting ->Deploy VPN. Select the remote interface you would like Covert VPN to bind to. If no local interface is present, press Add to create one.

Deploy VPN

Check Clone host MAC address to make your local interface have the same MAC address as the remote interface. It's recommended to leave this option checked.

Select Inject VPN client into memory to deploy Covert VPN directly into memory. If this box is not checked, Cobalt Strike will upload and execute the Covert VPN client for you. The 'inject into memory' option does not work reliably on Windows Vista, Windows 7, or 64-bit Windows XP.

Press Deploy to start the Covert VPN client on the target. Covert VPN requires SYSTEM access to deploy.

Once a Covert VPN interface is active, you may use it like any physical interface on your system. Use ifconfig to configure its IP address. If your target network has a DHCP server, you may request an IP address from it using your operating system's built-in tools.

Manage Interfaces

To manage your Covert VPN interfaces, go to Cobalt Strike ->Interfaces. Here, Cobalt Strike will show the Covert VPN interfaces, how they're configured, and how many bytes were transmitted and received through each interface.

Highlight an interface and press remove to destroy the interface and close the remote Covert VPN client. Covert VPN will remove its temporary files on reboot and it automatically undoes any system changes right away.

Press Add to configure a new Covert VPN interface.

Configure an Interface

The Covert VPN interfaces consists of a network tap and a channel to communicate ethernet frames through. To configure the interface, choose an Interface name (this is what you will manipulate through ifconfig later) and a MAC address.

VPN Interface Setup

You must also configure the Covert VPN communication channel for your interface. Covert VPN may communicate Ethernet frames over a UDP connection, TCP connection, or using the HTTP protocol. Cobalt Strike will setup and manage a server to receive a connection from the Covert VPN client based on the Local Port and Channel you select.

The Covert VPN HTTP channel makes use of the Cobalt Strike web server. You may host other Cobalt Strike web applications and multiple Covert VPN HTTP channels on the same port.

For best performance, use the UDP channel. The UDP channel has the least amount of overhead compared to the TCP and HTTP channels. Use the HTTP channel if you need to get past a restrictive firewall.

While Covert VPN has a flexibility advantage, your use of a VPN pivot over a proxy pivot depends on the situation. Covert VPN requires SYSTEM access while a proxy pivot does not.

Covert VPN creates a new communication channel while a proxy pivot, once again, does not. You should use a proxy pivot initially and move to a VPN pivot when it's needed.

Conclusion

The role of VPN pivoting is to pivot to other machines and network segments until they reach the domain controller. It's the same concept as a frog trying to cross a pond by jumping from lily pad to lily pad.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

You can deploy VPN pivots using social engineering attacks, such as email attachments and USB thumb-drives.