Question
A penetration tester established an initial compromise on a host. The tester wants to pivot to other targets and set up an appropriate relay. The tester needs to enumerate through the compromised host as a relay from the tester's machine. Which of the following commands should the tester use to do this task from the tester's host?
Options:
A. attacker_host$ nmap -sT <target_cidr> | nc -n <compromised_host> 22
B. attacker_host$ mknod backpipe p
attacker_host$ nc -l -p 8000 | 0 <backpipe | nc <target_cidr> 80 | tee backpipe
C. attacker_host$ nc -nlp 8000 | nc -n <target_cidr>
attacker_host$ nmap -sT 127.0.0.1 8000
D. attacker_host$ proxychains nmap -sT <target_cidr>
- A. attacker_host$ nmap -sT <target_cidr> | nc -n <compromised_host> 22
- B. attacker_host$ mknod backpipe p attacker_host$ nc -l -p 8000 | 0 <backpipe | nc <target_cidr> 80 | tee backpipe
- C. attacker_host$ nc -nlp 8000 | nc -n <target_cidr> attacker_host$ nmap -sT 127.0.0.1 8000
- D. attacker_host$ proxychains nmap -sT <target_cidr> Correct
Explanation
Proxychains sends a program's TCP connections through a configured proxy, such as a SOCKS proxy opened on the compromised host, so running nmap -sT through it scans the internal targets with the compromised host as the relay. A TCP connect scan (-sT) is used because proxychains can relay only full TCP connections. Piping nmap output into netcat does not relay the scan. The netcat backpipe and listener options run on the attacker's own host and only forward one port, so they do not relay enumeration through the compromised host.
