Question

During an internal engagement, you have compromised a Linux jump host (10.10.1.5) that has SSH access to a second Linux host (10.10.2.9) in a segmented subnet. From 10.10.2.9 you can reach a database server (10.10.3.20) that is unreachable from both your attack box and the jump host. You need your attack box's tools to scan and interact with 10.10.3.20. Which approach correctly establishes reachability to the deepest target?

Accepted Answer

Set up an SSH dynamic (SOCKS) proxy from your attack box to 10.10.1.5, then chain a second SSH dynamic proxy from 10.10.1.5 to 10.10.2.9, and route tools through the final SOCKS proxy with proxychains

Answer

Add a static route on your attack box for 10.10.3.0/24 pointing to 10.10.1.5 as the gateway

Answer

Run an Nmap scan of 10.10.3.20 directly from your attack box using fragmented packets to bypass the segmentation

Answer

Establish a single SSH local port forward from your attack box to 10.10.1.5 mapping port 3306 and connect directly to 10.10.3.20:3306