01 / Scenario & problem
Segmentation works only while the systems that bridge network zones remain trustworthy.
The academic lab uses three virtual machines. Kali can reach the Ubuntu web server but cannot reach the Debian database server. Ubuntu has one interface in each zone and can communicate with both sides.
Demonstrate, in an isolated and intentionally vulnerable environment, how command execution on the public-facing server can be turned into indirect access to an internal network.
This is an authorized academic pentesting exercise. The page explains the architecture, the reasoning and the evidence without reproducing the command-injection payloads used in the lab.
02 / Initial architecture
Kali and Debian have no direct route; Ubuntu is the only machine connected to both sides.
192.168.56.103
192.168.56.102 / 10.10.10.20
10.10.10.30
Kali can communicate with the Ubuntu web server.
Ubuntu and Debian can communicate inside the private network.
The web server becomes security-critical because it touches both zones.
03 / Strategy & lab execution
The pivot is a chain of small steps, not a single tool action.
Verify the initial segmentation: Kali reaches Ubuntu, not Debian.
Use the intentionally vulnerable PHP form in the lab to execute commands on Ubuntu.
Start the Ligolo-ng agent on Ubuntu and connect it back to the proxy on Kali.
Create the virtual interface and route 10.10.10.0/24 through the pivot.
Use standard network tools to confirm that Debian is now reachable.
external tester
pivot host
internal host
04 / Result & evidence
The internal host changes from unreachable to reachable through the compromised intermediary.
Once the tunnel is active, Kali can reach 10.10.10.30. The lab then uses network reconnaissance to confirm that SSH (22) and MySQL (3306) are exposed, followed by an authorized SSH login to validate the path end to end.
Kali cannot reach Debian directly.
Traffic is routed through Ubuntu.
SSH and MySQL on the internal host.
05 / Real-world meaning & defense
The important lesson is not the tunnel itself; it is where the trust model breaks.
A segmented internal host can still become reachable when an exposed system is compromised and is allowed to communicate across zones. The lab therefore connects offensive understanding with defensive design.
Application layer
Validate input and remove command-injection paths so the public-facing server cannot be turned into a remote shell.
Network layer
Apply least-privilege inter-segment rules and restrict outbound connections from exposed servers.
Host monitoring
Watch for unexpected processes, tunnel agents, new virtual interfaces and unusual route changes.
Detection & response
Correlate unusual outbound sessions, internal reconnaissance and authentication activity across network zones.
It gives a concrete view of segmentation, Linux routing, tunneling and internal reconnaissance, while also showing why defense-in-depth matters when one intermediary host is compromised.
Main finding: the Ubuntu server does not create a new network weakness by itself; once compromised, an existing trust relationship between two zones becomes a pivot path.
06 / Limits & what I learned
The lab demonstrates one pivoting mechanism, not the full complexity of an enterprise network.
- Three virtual machines in an isolated environment.
- The PHP application is intentionally vulnerable for the exercise.
- No production systems, real users or uncontrolled networks are involved.
- The lab validates reachability and access, not persistence, stealth or enterprise-scale lateral movement.
What I learned
The most useful part was seeing segmentation from both sides: first as a barrier, then as something that can fail when a dual-homed host becomes a relay. The result connects the offensive mechanism directly to the defensive controls that matter: network least privilege, outbound restrictions and monitoring for unexpected routes, interfaces and tunnels.