N-CHISELLateral Movement

chisel / ligolo / sshuttle Tunnel

TCP/UDP tunnels over HTTP(S) when SSH is unavailable — chisel client to attacker, ligolo for L3 pivoting.

§ Where this technique fits

N-CHISEL is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

§ Dossiers chaining this technique

Ivanti Pulse Connect Secure → pre-auth RCE → corporate VPN takeover
Two-stage chain (auth bypass + command injection) lands root on the Pulse appliance. Exfil VPN configs, pivot through the tunnel into the corporate network.
step 6 / 6

§ Where this technique fits

§ Dossiers chaining this technique

Ivanti Pulse Connect Secure → pre-auth RCE → corporate VPN takeover