daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE

05-double-pivot.mmd (1012B)


      1 %%{init: {'theme':'base','themeVariables':{'background':'#faf4ed','primaryColor':'#fffaf3','primaryTextColor':'#575279','primaryBorderColor':'#907aa9','lineColor':'#286983','secondaryColor':'#f2e9e1','tertiaryColor':'#f4ede8','edgeLabelBackground':'#fffaf3','fontSize':'15px'}}}%%
      2 flowchart TD
      3     ATT["๐Ÿ–ฅ๏ธ ATTACKER 10.10.14.68<br/>ligolo-proxy :11601"]
      4     P1["๐Ÿšช PIVOT 1 โ€” dmz01<br/>agent โ†’ proxy<br/>tun <b>ligolo</b> โ†’ 172.16.10.0/24"]
      5     P2["๐Ÿšช PIVOT 2 โ€” srv02<br/>agent โ†’ <b>dmz01:4444</b> (listener)<br/>tun <b>ligolo2</b> โ†’ 10.20.30.0/24"]
      6     DEEP["๐ŸŽฏ DEEP TARGET<br/>10.20.30.25"]
      7     ATT <-->|"tunnel 1"| P1
      8     P1 -.->|"listener :4444 relays<br/>agent 2's control back to proxy :11601"| ATT
      9     P1 -->|"reachable subnet"| P2
     10     P2 <-->|"tunnel 2"| DEEP
     11     style ATT fill:#fffaf3,stroke:#56949f,color:#56949f
     12     style P1 fill:#fffaf3,stroke:#ea9d34,color:#ea9d34
     13     style P2 fill:#fffaf3,stroke:#ea9d34,color:#ea9d34
     14     style DEEP fill:#fffaf3,stroke:#b4637a,color:#b4637a