An internal engagement scoped as assume-breach hands you a foothold: a Meterpreter session on an already-compromised, low-value workstation that turns out to sit on a segmented VLAN. First move after landing the session is the instinct everyone has: run your usual recon against the ranges you expect matter, the file servers, the domain controller. Nothing comes back. No response, ports closed or filtered across the board. The read is "not reachable from here," and it's tempting to write that up as a segmentation win for the client and move on to the next lead.
The read is wrong, in a specific and easy-to-miss way. The scan that came back empty was still running from your attacking machine's own network position, out your own interface, hitting the same firewall boundary the compromised host itself sits behind, just via a different, unrelated path. The question was never "can my machine reach the internal segment." It was always "can the machine I already control reach it," and those are two different questions with two different answers, because the compromised host sits inside the segmentation boundary that's blocking you.
Meterpreter's autoroute command is the fix, and it's simpler than it sounds. Point it at the internal subnet you want to reach through the current session (run autoroute -s <subnet>/<mask>), and Metasploit adds a route so that anything else you run through the framework, port scans, exploit modules, additional sessions, goes out through the compromised host instead of out your own interface. The compromised machine becomes the vantage point for every subsequent action, not just the one session you already have.
Autoroute gets Metasploit's own modules through, but it doesn't help an ordinary external tool, nmap, a browser, a scanner you already know how to drive, reach that same segment. For that, auxiliary/server/socks_proxy (or the older socks4a module) spins up a SOCKS proxy on your attacking machine that rides the same route, and pointing proxychains at it lets any normal tool you'd usually run externally instead run through the pivot. The segment that returned nothing to a direct scan is often fully reachable the moment the traffic actually originates from inside the boundary instead of trying to cross it from outside.
The engagements that go sideways here aren't the ones where the pivot fails. They're the ones where "no direct route" gets written down as "not reachable" because nobody thought to ask which vantage point actually matters, and the real objective sitting one hop away never gets found.
Codelivly's Metasploit Post Exploitation Handbook & Automation Guide walks through autoroute, SOCKS pivoting and the .rc automation to drive it without fumbling module names under a ticking engagement clock, along with the msfvenom and persistence side of the same post-exploitation phase.
If the exploitation basics underneath this, reverse shells, payload generation, are still the part that needs reps, the free Exploitation Fundamentals learning path on codelivly.com is worth working through first.
Top comments (0)