Skip to content

OSCP 06 - Pivoting, Tunneling, and Post-Exploitation

Reaching networks you cannot touch directly, and the reporting that turns a compromise into a pass.

Authorized testing only. Methodology as taught in PEN-200, for the exam, your lab, or authorized engagements.

Why pivoting matters

An OSCP network often has internal hosts that are not directly reachable from your attacking machine. A compromised host that can reach them becomes your route in. Pivoting is the skill of using one foothold to attack the next layer.

Core concepts

  • Pivot host - a compromised machine with access to a network segment you cannot reach directly.
  • Dual-homed host - one with interfaces on two networks; the classic pivot point.
  • Port forwarding - relaying a single port through the pivot to reach a service on the far side.
  • Tunneling - carrying arbitrary traffic through the pivot.
  • SOCKS proxy - a dynamic proxy allowing tools on your machine to reach the far network as if local.

Techniques

SSH-based (when SSH is available)

  • Local port forward - ssh -L maps a local port to a remote service reachable from the pivot. Use when you want one specific far-side service on your machine.
  • Remote port forward - ssh -R maps a port on the remote side back to you. Use when the target can reach you but you cannot reach it.
  • Dynamic port forward - ssh -D creates a SOCKS proxy, letting you reach the whole far network through the pivot. The most flexible option.

Without SSH on the target

  • Netcat relays - chaining listeners to forward traffic, when nothing better is available.
  • Portable tunneling tools - purpose-built proxy tools that create a SOCKS proxy through a compromised host. Confirm which are permitted by the exam.
  • proxychains - routes your local tools through a SOCKS proxy so they operate against the far network.

Choosing

  • One service, occasionally: local port forward.
  • The target cannot reach you: remote port forward.
  • Whole network, many tools: dynamic forward or a SOCKS proxy plus proxychains.

Post-exploitation

Once on a host, before moving on:

  • Situational awareness - who you are, what privileges you hold, the OS, and the network interfaces. A second interface signals a pivot opportunity.
  • Credential harvesting - the highest-value post-exploitation activity. Passwords, hashes, SSH keys, and tokens fuel lateral movement.
  • Sensitive files - configuration, backups, scripts, and history files.
  • Network discovery from the new vantage point - hosts and services visible from here that were not visible before.
  • Proof collection - the specific proof files the exam requires, from the specific locations it specifies.

Report writing

The OSCP is not passed until the report is accepted. It is a graded deliverable, not a formality.

  • Structure - executive summary, methodology, and a per-host walkthrough.
  • Reproducibility - every step documented so an assessor can reproduce the compromise. Missing a step can invalidate a machine you actually rooted.
  • Evidence - commands, output, and screenshots including the required proof files and, where mandated, your machine's IP visible in the shell.
  • Clarity - written for a reader who was not there. Describe what you did, why, and what resulted.
  • Time budget - reserve real time for the report. Candidates lose passes by rooting enough machines and then writing an inadequate report, or running out of time to write one at all.

The report requirement is why note-taking during the exam is not optional. You cannot reconstruct a clean walkthrough from memory at hour twenty-two.

Time management on the exam

  • The exam is long (24 hours of testing plus reporting time). Plan the block, do not improvise it.
  • Do not tunnel-vision on one host. If a target resists for too long, move to another and return with fresh eyes.
  • Bank points early: secure the machines you can, then attempt the harder ones.
  • Stabilize shells, take notes, and collect proof as you go, not at the end.
  • Take breaks. Fatigue causes the enumeration mistakes that lose exams.

Exam pointers

  • A second network interface on a compromised host is your pivot signal.
  • SSH dynamic forwarding plus proxychains reaches a whole internal network through one pivot.
  • Remote port forwarding is for when the target can reach you but not the reverse.
  • Harvest credentials on every host; they are the fuel for the next hop.
  • Collect the exact proof files the exam specifies, from the specified locations.
  • The report is graded. Write it as you go, and reserve time for it.

Official documentation

📖 OffSec PEN-200 syllabus - authoritative content list, including port redirection and tunneling 📖 OSCP exam guide - reporting - report and proof requirements 📖 OffSec reporting resources - report templates and examples