A Powerful Pivoting Technique That the OSCP Doesn't Teach You

[@elevatecyber5031]

Fast Track Yourself to Break Into Cyber Security: elevatecybersecurity.net/9f2j

[@JK-pb3vj]

Bruh. You legit saved my ass the day before the PWK exam - nothing was working and this solved it all. You are the goat!

[@elevatecyber5031]

Lol. Good to hear!

[@raveturk3711]

Finally i understand pivoting. Sir, thank you so much. This video explains it crystal clear.

[@iCyberVenom]

This video......is PHENOMENAL! It truly blows my mind that PWK 2022 and 2023 don't provide an in-depth review of chisel considering it's one of the most popular tools for pivoting and practically required knowledge for both the labs and exam. Instead, they REALLY dug deep into SSH tunneling which has it's place, but isn't nearly as versatile. I'm working through PWK 2023 labs right now, and I finally realized nowhere in the course is chisel covered like it should be. There's a single example provided that includes a web server exploit, but there are several other elements involved with the explanation, which left me a bit under-prepared for the labs. Because of your video, I finally fully understand how to effectively pivot with chisel. THANK YOU!🕶

[@MichalMati]

Chisel IS covered by the PWK material.

[@buII3tpr00f]

I did a pivoting like this and verified that port 80 is open on the target machine. Then I could not access the website running on port 80 using a browser. How can I do this?

[@MygenteTV]

​@@buII3tpr00fyou will need to jump to the machine and then from that machine do the same. This way you will have access to port 80. Because here you are only having access to see the box from the first box, but it doesn't mean that box have access to port 80 in that box. The only way you can know this is by login to the first box using RDP. Now open the browser and try to visiting the second box ip:80

[@TylerRamsbey]

Oh man. So much better than the way OSCP teaches it. Thank you!

[@elevatecyber5031]

Glad to hear this!

[@supersteve6772]

I trust Tyler. When he says this is better instruction than the oscp, I listen.

[@TylerRamsbey]

@@supersteve6772 Ha! Thank you friend!

[@mikedunn330]

Thank you! I've been advised to use this on the exam but I needed to learn how to use it.

[@sp4rtavus244]

You have a very good way of presenting and explaining.

[@kennystrawnmusic]

The OSCP course material may not teach this but the CPTS material definitely does.

[@Tathamet]

Golden content as all ways cheers bro

[@0xf0x]

Excellent video, exactly what I was looking for and explained super clearly

[@c4lex433]

Much appreciated for this awesome Pivoting technique! Thank you

[@0xrohit54]

Awesome Techniuqe for pivoting sir specially that sock5 mehod..thank you sir🔥🔥🔥🔥

[@colinrogers9927]

Great video. Thank you for sharing with us.

[@kadenhawley4368]

This is sweet! Thanks for the video

[@christopherthomas9047]

Thx for this vid!! Awesome demo.

[@dustinhxc]

Amazing video 🎉

[@AnnFranksUrn]

Another even better tool that offers simplicity is sshuttle

[@jonridpath1349]

Lovin me some chisel and crackmap exec thanks for your content- very excited to get into the weeds on this tool!!

[@arshdeeprobin1525]

Love you ❤

[@plushplush7635]

chisel is awesome, with ssh i use sshuttle for pivoting

[@abudi45]

Good presentation appriciate good job keep going... 👍👏

[@elevatecyber5031]

Thanks!

[@blackhatvisions]

I was thinking that this is not secure because it is using normal tcp/udp socks over HTTP. But then i realized it's actually doing SSH over the HTTP protocol, which provides the benefits of SSH encryption

[@Strivingtolearn6009]

there is a flaw with using chisel. ive had situations before when using chisel where chisel was too slow to enumerate effectively ie nmap scanning

[@retr0.1337]

Where is the flaw? The only flaw i see is liking your own comment.

[@presequel]

fantastic video, thx!

[@lezlydialidceronrodriguez1752]

Thank you! 💟

[@Zachsnotboard]

If you are in the DMZ how would you enumerate internal IPs to tunnel to ? Minus the dual home situation, or is that common ? Sorry just confused how common pivoting from DMZ to internal is IRL

[@akashpandey6470]

Nice... Really appreciated

[@liltoxicpain]

Just a question, why if we start a chisel server on port 8080 we have to put a socks5 on port 1080 in our proxychain? and not 8080? ( by the way thank you really much for this video that was really helpfull to me :) )

[@ontoshere]

Hey I love this! I was wondering, say you are behind NAT so your compromised machine can't call back. How could I go about this with chisel or even ssh? I'm not finding much online (maybe I'm just not searching something correctly?) so for now, I've settled with using metasploit bind meterpreter shells and autoroute. Then set up the proxy there. I really want a full on pivot like this though without meterpreter just for the sake of it. I'm sure I'm just missing something, but I really am not grasping how it's done. I tried a ssh -D with an ssh connection, but I'm fairly certain I did that wrong. But chisel obviously can't reach my IP due to the NAT. Thanks!

[@itsm3dud39]

how to use chisel on multiple internal machines??

[@liquidrope7063]

Offsec has been teaching people to use chisel for a while now

[@elevatecyber5031]

Oh nice. They didn't back during the time that video was recorded

[@liquidrope7063]

yeah, I believe they started when they released the 2023 version of their course@@elevatecyber5031

[@OhDearBabajan]

Under what circumstances would chisel not work? What if certain ports like 22 and 80 on the target are closed outbound?

[@the_terrorizer]

It doesn’t matter, you can specify the port. The only time it wouldn’t work would be like if you couldn’t execute or transfer executable files or something like that.

[@hottestnews1679]

u jsut got another subsciber

[@kingofthesummer5180]

Did you need the proxychains command for this ? I’m asking because of the speed concern. My internet is already slow

[@kevinkehoe9950]

Yes he did. No other way to really do it

[@zoewong-b6y]

6:43 kali | 222.131 win10 | 222.130 && 10.0.0.10 winsrv | 10.0.0.10

[@kkl5983]

How I download file from kali in DC?

[@buII3tpr00f]

Thanks for this great and informative content but I have a question. I did a pivoting like this and verified that port 80 is open on the target machine. Then I could not access the website running on port 80 using a browser. How can I do this?

[@kevinkehoe9950]

You could use Foxy Proxy and setup the proxy to access the webserver on your browser

[@elprquex]

Hi. can you tell me if windows antivirus is disabled and what conditions? Thank you.

[@younesmohssen8158]

Sickkk video! I loved it. I didn’t understand however how you initiated a server on port 8000 and then used proxychains port 1080 for the forwarding. Why don’t we put proxychains port as 8000, just like the server and the client ? Anything I’m missing?

[@younesmohssen8158]

Nvm got it. R:socks defaults to 1080 if anyone else is wondering.

[@odilonthibauttchouadjengue6149]

Hi, how would you find the ip of the DC (.100) which is connected to that network? since from the ipconfig of the remote machine you have access through code exec the ip shown is .10

[@elevatecyber5031]

There are a number of ways. Personally, I would just use nmap to scan the subnet to find all servers. Then I'd run a 2nd nmap scan against all ips from the first scan, scanning for TCP port 88 (Kerberos), which is likely to be only open on a domain controller.

[@CWLabs7209]

Thanks :)

[@AllenGamingYT]

how would you prtfwd with chisel? can you make video?

[@elevatecyber5031]

Sure!

[@stuarthook6226]

How to replicate this environment , can you point to any VM setup?

[@elevatecyber5031]

I can make a video showing how. It's some simple VMWare settings. Haven't tried it with Virtual Box but I'm sure it would be similar

[@TheBigJohny]

I think this tool is already in kali linux as of now

[@SavageScientist]

This is why OSCP is the foundation of hacking knowledge. Don't waste time on bullshit like CEH pay for pwk and once you get your foundation then you can move on to more advanced or alternative techniques like this.

[@ReligionAndMaterialismDebunked]

:3 This ethical hacker has a really nice place! Haha :3 🤓🧺🔥🤝😎