09. Lateral movement & internal recon — Expanding from a pivot 🌐¶

Once you've broken into one machine, the next stage is using it as a pivot to expand into the internal network. Lateral movement is how an attacker turns "a single compromised host" into "control of the entire organization."

The big picture¶

flowchart LR
    A["Attacker<br>(you)"] -->|intrusion| B["Compromised host<br>(pivot)"]
    B -.->|invisible from outside| C["Internal machine 1"]
    B -.->|internal network| D["Internal machine 2"]
    B -.-> E["Internal DB, etc."]
    style A fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    style B fill:#2d333b,stroke:#bc8cff,stroke-width:2px,color:#e6edf3
    style C fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style D fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style E fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3

The nmap you ran before the intrusion only saw "ports visible from outside." When you investigate from the inside after breaking in, you can see internal services and neighboring machines that were blocked off and invisible from outside.

STEP 1: Run reconnaissance again, from the inside¶

From inside the compromised host (meterpreter), look at the state of the internal network.

meterpreter > ipconfig

→ Tells you which internal IP and network the compromised host belongs to. You may discover that "only one port was visible from outside, but internally it's connected to a different network."

meterpreter > arp

→ A list of "machines the compromised host has recently communicated with (i.e., nearby machines)." Candidates for lateral movement come into view.

STEP 2: Pivoting (survey deeper through the pivot)¶

You scan the internal network — which you can't reach directly from your own machine — by routing through the compromised host. This is called pivoting.

flowchart LR
    A["Attacker"] -->|① already compromised| B["Pivot<br>(compromised host)"]
    B -->|② through here| C["Internal network<br>(not directly visible)"]
    A -.->|③ scan through<br>the pivot| C
    style A fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    style B fill:#2d333b,stroke:#bc8cff,stroke-width:2px,color:#e6edf3
    style C fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3

In Metasploit, you create a "route through the compromised host" with autoroute or portfwd.

# background meterpreter and return to the msf prompt
meterpreter > background

# automatically add a route into the compromised host's internal network
msf6 > use post/multi/manage/autoroute
msf6 post(multi/manage/autoroute) > set SESSION 1
msf6 post(multi/manage/autoroute) > run

Now, subsequent Metasploit modules will be able to reach the internal network by routing through the compromised host.

STEP 3: Attack another machine found internally¶

Once pivoting has established a route, you repeat the same flow (recon → exploit → payload) against the internal machines. This is "lateral movement" — the flow where a single intrusion spreads to a second machine, a third, and beyond.

flowchart LR
    S1["① 1st machine<br>intrusion"] --> S2["② Internal recon<br>discover another machine"]
    S2 --> S3["③ Pivoting<br>create a route"]
    S3 --> S4["④ 2nd machine<br>intrusion"]
    S4 --> S5["⑤ Repeat…"]
    style S1 fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
    style S4 fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3

Why "lateral movement" is scary (a lesson for the defenders)¶

Even when the external entry points are tightly guarded,
it's easy to let your guard down on the internal network, assuming "the inside is safe"
  → once one machine is compromised, lateral movement runs rampant internally
  → that's why "don't trust the inside either (zero trust)" is important

Attacker's side: from a single hole to the whole
Defender's side: monitor and segment internal traffic too (so that one compromised machine doesn't spread)

⚠️ A note on practice environments¶

To seriously practice lateral movement, you need "an environment with multiple machines on the same network." Since the experience is limited with this guide's single container, a setup that places a Kali VM plus multiple target VMs on the same virtual network is better for serious practice.

Always only within a practice environment you set up yourself. Lateral movement on someone else's network is a serious crime.

Next: 10. Tools for the defenders.