Almost wrote off a segment as properly isolated because I scanned it from the wrong machine

Internal assume-breach engagement. I'm handed a foothold: a Meterpreter session on a workstation somebody already compromised, sitting on what turns out to be a segmented VLAN, guest network side, nothing sensitive on it directly. First move after landing the session is the usual one: point a scan at the ranges that actually matter, file servers, the domain controller. Nothing comes back. No response, ports closed or filtered across the board. My first read was "okay, decent segmentation here," and for about ten minutes I was ready to write it up that way and move to the next lead.

The read was wrong, and wrong in a way that's easy to miss under time pressure. The scan that came back empty was still running from my attacking machine's own network position, out my own interface, hitting the exact same boundary the compromised host sits behind, just from an unrelated path outside it. The actual question was never whether my machine could reach the internal segment. It was whether the machine I already controlled could reach it, and those aren't the same question, because the compromised host sits inside the boundary that's blocking me from outside.

Meterpreter's autoroute command is the fix and it's simpler than it sounds. Point it at the internal subnet through the existing session (run autoroute -s <subnet>/<mask>) and Metasploit routes anything else run through the framework, more port scans, exploit modules, additional sessions, out through the compromised host instead of out my own interface. The compromised machine becomes the actual vantage point going forward, not just the one session I already had.

Autoroute covers Metasploit's own modules, but it doesn't help an ordinary external tool reach that segment, my usual nmap invocation, a browser, whatever scanner I already know how to drive. For that, auxiliary/server/socks_proxy spins up a SOCKS proxy on my machine riding the same route, and proxychains in front of any normal tool lets it run through the pivot like it's sitting on the internal segment itself. The servers that returned nothing to a direct scan answered fine the moment the traffic actually originated from inside the boundary.

The engagements that go sideways here aren't the ones where the pivot doesn't work. They're the ones where "no direct route" gets written down as "not reachable" because nobody stopped to ask which machine the scan should actually be running from, and the real objective sitting one hop away never gets found.

Codelivly's Metasploit Post Exploitation Handbook & Automation Guide walks through autoroute, SOCKS pivoting and the .rc scripts to drive it without fumbling module names with the engagement clock running.