pivoting, own one box and reach the hidden subnet

you own one box. it's not the crown jewels, just some forgotten web server or a jump box someone left ssh open on. but behind it, on a subnet your scanner can't even see, sits the domain controller, the file server, the good stuff. that jump from "one box" to "the whole internal network" is called pivoting, and understanding how attackers do it is the fastest way to figure out why your network segmentation isn't actually segmenting anything.

what pivoting actually is

pivoting means using a compromised machine as a relay. your laptop can't talk to the internal subnet directly because of a firewall or nat, but the box you already own can, because it lives on both networks. so instead of routing traffic yourself, you route it through that box. your tools think they're talking directly to the internal network, but every packet is actually tunneling through the machine you popped first.

this matters for defenders because most internal segmentation assumes attackers need direct network access to reach a subnet. pivoting proves that assumption wrong. if one dual-homed box gets compromised, your "isolated" network isn't isolated anymore, it's one hop away.

the ssh dynamic tunnel

ssh -D 1080 user@target

this command turns an ssh connection into a socks proxy. -D 1080 tells ssh to open a local socks port on 1080 and forward any traffic sent to it through the ssh session to the target box. once that's running, any tool that supports socks proxies (or gets forced through one) can reach whatever the target box can reach, including internal subnets it's connected to.

the reason this is scary is also the reason it's so common: it uses nothing but standard ssh, a protocol that's allowed almost everywhere. no custom malware, no weird ports, just a normal-looking encrypted ssh session doing double duty as a tunnel.

proxychains and routing tools through it

ssh -D gives you a socks proxy, but most tools like nmap or metasploit don't know how to use one natively. that's where proxychains comes in. it wraps a tool's network calls and forces them through the socks proxy you just built. so an attacker can run nmap against the hidden subnet, and every scan packet routes through the compromised box first, letting them map out internal hosts they'd otherwise never see.

chisel and ligolo, when ssh isn't available

not every compromised box has ssh access or an ssh server running. tools like chisel and ligolo-ng solve that by building their own encrypted tunnel over http or a custom protocol, then adding full network-level routing on top, not just a socks proxy for one app at a time. this means an attacker can push an entire routing table through the compromised host and reach the internal subnet almost like they're plugged into it directly, letting frameworks like metasploit operate as if there's no boundary at all.

how you actually catch and stop this

the fix isn't "block ssh," it's reducing what one compromised box can reach and watching for the behavior pivoting produces.

segment for real. if a web server sits in a dmz, it should not have routable access to your internal file servers or domain controllers. test this yourself, not just on paper. from that dmz box, try to reach internal subnets. if you can, your segmentation is theoretical.

watch for long-lived outbound ssh sessions from servers that have no business making them, especially ones with unusual data volume or lasting hours. a socks tunnel looks like one boring connection carrying a lot of activity.

monitor for chisel and ligolo signatures. both have known process names, default ports, and network patterns that edr and ids tools can flag. if you don't have edr on your internal boxes, that's the actual gap, not the tunneling technique.

restrict outbound traffic by default. internal servers rarely need unrestricted outbound access to arbitrary destinations. a default-deny egress policy breaks most pivoting tools immediately because they can't even establish the tunnel back out.

log and alert on new routes and unusual socks-proxy-looking traffic on hosts that shouldn't be relaying anything for anyone.

the takeaway

pivoting isn't a fancy exploit, it's just using the access you already have to reach the access you don't. that's exactly why it works so well against networks that trust their own perimeter too much. the defense isn't a single control, it's making sure that owning one box doesn't quietly mean owning your whole network. segment hard, log outbound traffic, and assume every internal host might one day be the "one box" someone starts from.