Pivoting

Overview#

Pivoting allows you to route agent communication through other compromised hosts, enabling access to network segments that aren’t directly reachable from the teamserver.

Pivot Concepts#

Parent-Child Agent Relationships#

In JustC2, pivoting creates parent-child relationships between agents:

• Parent agent — An agent with direct or relayed access to the teamserver
• Child agent — An agent that communicates through the parent

Teamserver ←── HTTP ──→ Agent A (Parent)
                             │
                          SMB/TCP
                             │
                        Agent B (Child)

Pivot Data#

Each pivot relationship is tracked with:

Setting Up a Pivot#

Scenario: HTTP → SMB Chain#

1. Agent A has a BeaconHTTP session on a host with access to the internal network
2. Start a BeaconSMB listener on the teamserver
3. Deploy Agent B on an internal host, configured to connect via SMB
4. Agent A relays Agent B’s SMB traffic to the teamserver
5. Both agents appear in the sessions table, with Agent B shown as a child of Agent A

Scenario: HTTP → TCP Chain#

1. Agent A has a BeaconHTTP session on the perimeter
2. Start a BeaconTCP listener
3. Use Agent A to deploy Agent B with TCP bind configuration on an internal host
4. The pivot forwards Agent B’s TCP traffic through Agent A’s HTTP channel

Data Flow#

Teamserver
    ↑↓ HTTP
Agent A (Parent - DMZ)
    ↑↓ SMB/TCP
Agent B (Child - Internal)
    ↑↓ SMB/TCP
Agent C (Grandchild - Secure Zone)

Each hop adds latency but extends your reach into the network.

Viewing Pivots in the Graph#

The Sessions Graph visualizes pivot relationships:

• Lines between nodes indicate pivot connections
• The direction shows parent → child relationships
• Color coding distinguishes direct and pivoted sessions

Managing Pivots#

Pivot Tasks#

When a parent agent packs tasks, it includes tasks for its child agents. The PivotPackData() function handles encoding child agent data for relay through the parent.

Pivot Reliability#

• If a parent agent goes offline, all child agents lose connectivity
• Consider redundant paths when possible
• Monitor parent agent health closely

Best Practices#

1. Plan your pivot chain before deploying — map the network segments you need to traverse
2. Keep chains short — Each hop adds latency and reduces reliability
3. Use appropriate protocols — SMB for Windows-to-Windows internal pivots, TCP for cross-platform
4. Monitor parent agents — Parent stability is critical for all child sessions
5. Consider redundancy — Deploy multiple paths to critical network segments
6. Match protocols to the environment — Use SMB where SMB traffic is normal, TCP where general TCP is expected