After gaining access to one host we can use the compromised host to exploit other hosts on the same internal network to which we could not access previously.

Pivoting using proxychain tool

1. run autoroute -s <target_subnet> E.g. run autoroute -s 10.10.10.0/24 ## Now we can access this subnet via msfconsole...
2. now we want to use "proxychain" tool on our attacking machine or a MSF module: use auxiliary/server/socks_proxy
3. set VERSION 4a
4. set SRVPORT 9050 set it as what you did for socks4 tool. Our attacking machine will start listening on this port
5. so now we can nmap the second system from our main system: proxychain nmap <Second_target> -sT -Pn -sV -p 445

---

Another method:

1. In meterpreter use this: run autoroute -s <target_subnet>
2. Then just use portscan modules in msfconsole