Instructor: In today's lecture, 2 2
and the next few lectures, 3 3
we're going to talk about pivoting. 4 4
We're going to assume 5 5
that our target is this Metasploitable device. 6 6
Now, each one of these circles, 7 7
the big circles, we're going to assume is a network 8 8
and as you can see, 9 9
the Metasploitable device 10 10
is not visible by the hacker. 11 11
So the hacker cannot see this device. 12 12
This device is hidden either behind the network 13 13
or for some other reason, the hacker is not able 14 14
to ping or access the IP address 15 15
of this device. 16 16
So we're assuming in our example 17 17
that it exists in a different internal network. 18 18
So we can see that this big network 19 19
has four devices. 20 20
It has the Metasploitable device, 21 21
it has an iPhone, another device 22 22
and the Windows device which we hacked 23 23
and we can see that it's in red. 24 24
And the hacker exists in this smaller network 25 25
and there's only two devices. 26 26
There the hacker and the red device, 27 27
the Windows 10 device which we hacked. 28 28
So the target of pivoting 29 29
is we use the device that we hacked, 30 30
the common device in the middle 31 31
to compromise other devices 32 32
that only this device has access to. 33 33
So our target, the hacker cannot see the target 34 34
which is the Metasploit device. 35 35
But the device that we just hacked, 36 36
the Windows device, can see that device 37 37
because they're in the same network. 38 38
So in our next videos, 39 39
we're going to try to hack into the Metasploitable device 40 40
while the Metasploitable device is not gonna be visible 41 41
to the hacker 42 42
which is the Kali device. 43 43
The only way to access the Metasploitable 44 44
is through the Windows device 45 45
which we are going to use as a pivot 46 46
in order to hack this device right there. 47 47
So to set up my networks or my lab, 48 48
I'm going to go to the VirtualBox Settings 49 49
and I'm gonna go to the Preferences. 50 50
And I'm gonna go to Network. 51 51
And we can see that we have this network here 52 52
that we've been using as the internal NAT network. 53 53
This is the one in which my Windows 54 54
and my Kali devices are connected to, 55 55
the 10.20.14-NAT. 56 56
I'm going to create another NAT network 57 57
by clicking on the plus here 58 58
and we can see that this one's called NatNetwork. 59 59
Now, I'm gonna click on this icon 60 60
to edit the settings and we can set the network IP. 61 61
I'm gonna set it to 10.20. 62 62
The other one was 14, so we'll set this one to 15. 63 63
Zero up to 24. 64 64
And I'm gonna change the name 65 65
so we have the same kinda naming pattern 66 66
and I'm gonna call it 10.20. 67 67
So we created another network 68 68
and the Kali machine is not connected to this network. 69 69
Okay, so I'm gonna click OK. 70 70
This network is created. 71 71
So I'm going to modify the settings of the Windows device 72 72
to get it to be connected to the two networks. 73 73
So the Windows device as we can see in this, 74 74
it's the common device 75 75
and it's gonna be connected to the NAT network 76 76
that the Kali's connected to 77 77
and the one that is the Metasploit is connected to. 78 78
Metasploitable. 79 79
So in my Windows machine, 80 80
the Settings, I'm gonna go to Networks 81 81
and I'm gonna go to Adapter 2. 82 82
I'm gonna enable that adapter 83 83
and I'm going to connect it to a NAT network 84 84
and I'm gonna select the 10.20.15-NAT. 85 85
So the Windows device now uses two adapters, 86 86
one of them is connected to the 14-NAT 87 87
and the other one's connected to the 15-NAT. 88 88
Then I'm gonna go to my Metasploitable device. 89 89
I'm gonna under Settings, Network 90 90
and instead of connecting it to the 10.20.14, 91 91
I'm gonna connect it to the 10.20.15. 92 92
So this way, the Metasploitable is only connected 93 93
to the network which the Windows is connected to 94 94
and the Kali's connected to the network 95 95
which the Windows is connected to 96 96
and Windows is connected to the two networks 97 97
that I have right now in my devices 98 98
so it's connected to this one and this one. 99 99
Now, to verify that I have the right settings, 100 100
I'm just gonna start my Metasploitable. 101 101
And I'm gonna start the Windows 102 102
and I'm just gonna do some ping commands 103 103
to make sure that everything is set up correctly. 104 104
Okay, so my machines have started 105 105
and the main thing now is my Windows machine 106 106
should be able to ping both of my Metasploitable 107 107
and my Kali. 108 108
So let's get the IP of the Metasploitable. 109 109
And it's 10.20.15.4. 110 110
So I'm gonna do ping 10.20.15.4. 111 111
And as you can see now, 112 112
the Windows machine can see the Metasploitable machine. 113 113
Now, let's see if it can see the Kali machine 114 114
which is on 14.203. 115 115
And again, so the Windows can see both machines 116 116
which means that it is the machine in the middle. 117 117
Now let's see if the Metasploitable machine 118 118
can see the Kali machine. 119 119
It shouldn't be able to see it 120 120
because we said the Kali machine 121 121
and the Metasploitable machine are connected 122 122
to two different networks. 123 123
So I'm gonna do ping 10.20.14.203. 124 124
Now, as you can see now, I got nothing 125 125
and we can see that six packets 126 126
were transmitted, zero received 127 127
so my Metasploitable cannot see the Kali machine 128 128
and the Kali cannot see the Metasploitable either. 129 129
So if I do ping 10.20.15.4, 130 130
you'll see that it's sent three packets, zero received. 131 131
Again, these two devices cannot see each other 132 132
because they're in two different networks. 133 133
So what we're gonna do in the next videos 134 134
is we already have an access to the Windows machine 135 135
which can see both 136 136
and we're gonna try to hack into the Metasploit 137 137
using the Windows machine that we just hacked into 138 138
because it's the common machine 139 139
that is connected to both networks.