multi-layer-network

Multi-layer network penetration methodology

⛔ In-depth reference (required reading)

• Need frp/chisel/Neo-reGeorg/SSH tunnel configuration commands, multi-hop proxy chains, proxychains usage → references/tunnel-tools.md

---

Phase 1: Perimeter breach and foothold

After obtaining a DMZ host shell, immediately collect network information:

ip addr && ip route && arp -a && cat /etc/hosts      # Linux
ipconfig /all && route print && arp -a                 # Windows

Key judgment：

• Dual NIC (eth0=external, eth1=10.x.x.x) → natural pivot
• Only internal IP → need to set up a reverse tunnel

Target network mapping

for i in $(seq 1 254); do ping -c 1 -W 1 10.0.0.$i &>/dev/null && echo "10.0.0.$i alive"; done
fscan -h 10.0.0.0/24 -nopoc

Phase 2: Tunnel selection decision tree

目标出网情况？
├─ 可出网（有外网访问）
│   ├─ 有 SSH 凭据？→ SSH -D 1080（零部署，最简单）
│   ├─ 需要长期稳定？→ frp（断线重连）
│   └─ 快速部署？→ chisel（单二进制）
├─ 仅 HTTP 出网 → Neo-reGeorg HTTP 隧道
└─ 完全不出网 → SSH 反向隧道 / 在跳板上中转

For detailed configuration commands of all tools, see → references/tunnel-tools.md

Tunnel tool selection quick reference

Scenario	Recommended tool	Reason
Has SSH credentials	SSH tunnel	Zero deployment, simplest
Target has outbound access + long-term use	frp	Most stable, supports reconnection after disconnection
Target has outbound access + rapid deployment	chisel	Single binary, no configuration file
Only HTTP outbound	Neo-reGeorg	HTTP tunnel traverses firewall
High performance requirements	ligolo-ng	TUN interface, close to native performance

Phase 3: Deep penetration

After entering the internal network through the proxy, by priority:

1. Internal network reconnaissance
2. Domain environment attack
3. Credential spraying
4. Lateral movement

Notes

• proxychains only supports TCP, does not support ICMP (ping unavailable, nmap uses -Pn -sT）
• After the tunnel is established, first proxychains curl test connectivity before doing large-scale scanning
• Tunnel processes are prone to interruption, use autossh or frp reconnection to maintain stability
• Record the credentials and tunnel commands for each hop to facilitate rebuilding

Proxychains limitations

• UDP not supported: proxychains only proxies TCP, UDP scanning (-sU) will fail