Question

During an internal engagement, you compromise a dual-homed Windows workstation that sits on both the 10.10.5.0/24 user VLAN and the 10.10.50.0/24 restricted server VLAN. Your attack host cannot route directly to 10.10.50.0/24, and outbound firewall rules from the workstation allow only TCP/443 to your attack host's public IP. You want to run Nmap and Metasploit modules from your attack host against multiple hosts and ports in the server VLAN, tunneling through the compromised workstation. Which approach best meets these constraints?

Accepted Answer

Use plink.exe on the workstation to create a reverse SSH connection over port 443 back to your attack host, establish a dynamic (SOCKS) port forward, and run your tools through proxychains

Answer

Configure a static local port forward on the workstation for each individual server IP and port you want to reach, then connect to those forwarded ports directly

Answer

Add a persistent static route on your attack host pointing 10.10.50.0/24 to the workstation's user-VLAN IP so traffic routes automatically

Answer

Enable IP forwarding on the workstation and run an ARP-spoofing MITM to relay your attack host's traffic into the server VLAN