SSH Pivoting using Meterpreter

Pivoting is a technique to get inside an unreachable network with help of pivot (center point). In simple words, it is an attack through which an attacker can exploit that system which belongs to the different network. For this attack, the attacker needs to exploit the main server that helps the attacker to add himself inside its local network and then the attacker will able to target the client system for the attack.

This module will test ssh logins on a range of machines and report successful logins. If you have loaded a database plugin and connected to a database this module will record successful logins and hosts so you can track your access.

12345msf > use auxiliary/scanner/ssh/ssh_loginmsf auxiliary(ssh_login) > set rhosts auxiliary(ssh_login) > set username rajmsf auxiliary(ssh_login) > set password 123msf auxiliary(ssh_login) > exploit

From the given image you can observe that command shell session 1 opened

Now convert command shell into the meterpreter shell through the following command

1sessions –u 1

From the given image you can observe that Meterpreter session 2 opened


Hence if you will count then currently attacker has hold 2 sessions, 1st for command shell and 2nd for the meterpreter shell of the SSH server.

Check network interface using ifconfig command

From the given image you can observe two network interface in the victim’s system 1st for IP through which the attacker is connected and 2nd for IP through which SSH client (targets) is connected.

Since the attacker belongs to interface and client belongs to interface, therefore, it is not possible to directly make an attack on client network until unless the attacker acquires the same network connection. In order to achieve network attacker need to run the post exploitation “autoroute”.

This module manages session routing via an existing Meterpreter session. It enables other modules to ‘pivot’ through a compromised host when connecting to the named NETWORK and SUBMASK. Autoadd will search a session for valid subnets from the routing table and interface list then add routes to them. The default will add a default route so that all TCP/IP traffic not specified in the MSF routing table will be routed through the session when pivoting.

1234msf > use post/multi/manage/autoroute msf post(autoroute) > set subnet post(autoroute) > set session 2msf post(autoroute) > exploit

This time we are exploiting SSH ignite (local client) therefore we are going to use the same module for it that had used above for SSH raj, only need to change information inside exploit.

12345msf > use auxiliary/scanner/ssh/ssh_loginmsf auxiliary(ssh_login) > set rhosts auxiliary(ssh_login) > set username ignitemsf auxiliary(ssh_login) > set password 1234msf auxiliary(ssh_login) > exploit

From given image, you can see another command shell 3 opened if you will count then total attack has hold 3 sessions, two for SSH server and one for the SSH client.

  1. Command shell for SSH raj (
  2. Meterpreter shell for SSH raj (
  3. Command shell for SSH ignite (
1sessions 3

Now attacker is command shell of SSH ignite (client), let’s verify through network configuration.


From given, you can observe the network IP is