Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose I am doing a penetration test on a network that has a firewall that blocks all ports except 80, 110, and 443. I want to use a metasploit reverse-TCP backdoor executable written in msfpayload to initiate a connection with a remote server that has a listener running.

Since I can't set the backdoor to run on an blocked port because of the firewall, can I set the executable to run on one of the allowed ports assuming that the port is dormant at the time and no traffic is going through it? If not is there any way to get around a blocked port or make this scenario work?

share|improve this question
    
do you mean to say that there are services running on those ports on the computer you are exploiting? –  schroeder Nov 22 '12 at 20:13
1  
If the firewall allows traffic on a port, then there is nothing stopping you, dormant or not. –  schroeder Nov 22 '12 at 20:14
add comment

2 Answers

up vote 1 down vote accepted

If there's not an application listening on the port that you want to listen on, then you can use those ports. If not, you can make an outgoing connection which should make the firewall less of a problem (especially if you try to connect to a common port like 80 or 443).

share|improve this answer
add comment

Sure, if a port is free and you have the authorization to run the program you will be able to run it on whichever port you want, providing that the program itself allows you to define the port. Take apache for example, you can run it on any port you choose. Some software may have the port hard set in the code however, but that's pretty rare.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.