Home > Network Pentesting

Accessing Internal Services

Accessing internal services is a key phase of post-exploitation. Once a foothold is established inside a network, attackers must interact with internal applications, databases, remote management interfaces, and file-sharing services that are not exposed publicly. This chapter explains how pentesters discover, reach, and interact with internal services using tunnels, proxies, forwarded ports, and authenticated protocols.

Understanding Internal-Only Services

Internal services are resources restricted to private network segments. These typically include:

  • Web dashboards

  • Admin consoles

  • Database servers

  • SMB file shares

  • RDP and WinRM

  • SSH services

  • Internal APIs

  • Monitoring systems

  • CI/CD interfaces

  • Hypervisor and backup consoles

These services often contain sensitive data and privileged entry points.

Step 1: Discover Internal Services

Begin with port scanning through your pivot point.

Using Proxychains to Scan a Subnet

proxychains nmap -sT 10.10.20.0/24

Quick Service Scan

proxychains nmap -sV --top-ports 100 10.10.20.10

Full Port Scan

proxychains nmap -p- 10.10.20.15

Identify:

  • HTTP/HTTPS ports

  • RDP (3389)

  • SMB (445)

  • SQL ports (1433, 3306, 5432)

  • SSH (22)

  • WinRM (5985/5986)

Each open service becomes a potential lateral movement route.

Step 2: Accessing Internal Web Applications

Internal web apps often expose administrative functions.

Browsing Internal Sites via Firefox

Set browser proxy:

SOCKS Host:

127.0.0.1

Port:

1080

Enable DNS over SOCKS.

Then access:

http://10.10.20.5
https://10.10.20.7

Internal web apps often reveal:

  • Version numbers

  • Default credentials

  • Configuration endpoints

  • Backup service interfaces

  • Hidden admin panels

Step 3: Accessing RDP Sessions

Use proxychains or SSH local forwarding.

With Proxychains

proxychains xfreerdp /v:10.10.20.10

Via SSH Port Forwarding

ssh -L 3389:10.10.20.10:3389 user@pivot

Then connect:

xfreerdp /v:localhost

RDP provides full GUI access, often into privileged workstations.

Step 4: Accessing SMB File Shares

SMB reveals organizational structure and stored credentials.

List Shares

proxychains smbclient -L //10.10.20.5 -U user

Connect to a Share

proxychains smbclient //10.10.20.5/share -U user

Look for:

  • Password files

  • Scripts

  • Application configs

  • Backups

  • Deployments

SMB shares often enable lateral movement.

Step 5: Accessing WinRM for Remote Commands

WinRM allows command execution on remote Windows hosts.

Test Access

proxychains python3 wmiexec.py user:pass@10.10.20.10

Start PowerShell Remoting

proxychains python3 evil-winrm.py -i 10.10.20.10 -u user -p pass

WinRM is one of the most powerful remote execution paths.

Step 6: Accessing SSH Services

Linux servers often expose SSH only internally.

SSH Through Proxychains

proxychains ssh user@10.10.20.30

SSH via Port Forwarding

ssh -L 2222:10.10.20.30:22 user@pivot

Now connect:

ssh user@localhost -p 2222

SSH access provides control over internal Linux infrastructure.

Step 7: Accessing Internal Databases

Databases hold highly sensitive data and authentication material.

MySQL

proxychains mysql -h 10.10.20.50 -u root -p

MSSQL

proxychains python3 mssqlclient.py user@10.10.20.40

PostgreSQL

proxychains psql -h 10.10.20.35 -U postgres

Databases often reveal credentials, employee information, logs, and internal secrets.

Step 8: Accessing Internal APIs

Enumerate APIs discovered through scans or web servers.

Curl Through Proxy

proxychains curl http://10.10.20.5/api/v1/status

Look for:

  • API documentation

  • Default credentials

  • Authentication headers

  • Sensitive endpoints

Internal APIs frequently lack proper authentication.

Step 9: Accessing Hypervisors and Backup Systems

These systems are high-value targets.

Common Hypervisor Ports

  • vSphere: 443

  • Proxmox: 8006

  • Xen: 443

  • Hyper-V: 5985/5986

Example

proxychains firefox https://10.10.20.50:8006

Backup systems often contain passwords for entire domains.

Step 10: Using Port Forwarding for GUI Apps

Some tools require direct port access.

Forward Internal Web Port

ssh -L 8080:10.10.20.15:80 user@pivot

Visit:

http://localhost:8080

Forward a Database Port

ssh -L 5432:10.10.20.35:5432 user@pivot

Use native database clients locally.

Why Accessing Internal Services Matters

Internal services often reveal more valuable information than the initial foothold. They:

  • Contain admin interfaces

  • Leak internal usernames and passwords

  • Provide access to databases

  • Host configuration files

  • Allow remote execution

  • Enable privilege escalation

  • Support further lateral movement

Understanding how to reach and exploit internal services is essential for complete post-exploitation.

Intel Dump

  • Internal services accessed using proxychains, SSH tunnels, SOCKS proxies

  • RDP, SMB, WinRM, SSH, databases are common targets

  • Web apps and APIs expose sensitive internal info

  • Service access leads directly to privilege escalation and movement

  • Tunnels and port forwards bypass segmentation barriers

HOME LEARN COMMUNITY DASHBOARD