A penetration tester has obtained code execution on a web server in the DMZ and wants to pivot to the internal network. The web server can only reach internal hosts on TCP port 3389. Which technique allows the tester to pivot through this connection?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a SOCKS proxy or port-forward tunnel through the compromised web server allows the attacker to route traffic from their attack system to internal hosts via the web server's allowed outbound connection on TCP 3389, effectively pivoting through the network boundary. A is wrong because EternalBlue exploits SMB (TCP 445), not RDP (TCP 3389), and the web server can only reach internal hosts on 3389.
Full explanation below image
Full Explanation
B is correct because a SOCKS proxy or port-forward tunnel through the compromised web server allows the attacker to route traffic from their attack system to internal hosts via the web server's allowed outbound connection on TCP 3389, effectively pivoting through the network boundary. A is wrong because EternalBlue exploits SMB (TCP 445), not RDP (TCP 3389), and the web server can only reach internal hosts on 3389. C is wrong because ARP spoofing affects traffic within the same Layer 2 segment and would not help pivot from the DMZ to the internal network. D is wrong because DNS-based techniques use port 53; the constraint is that only port 3389 is allowed, so DNS shells would be blocked.