I am a beginner and have just started working on pentesting engagements. I have a case where I have a victim IIS server (without PHP support) where I have aspx based web shell (https://github.com/samratashok/nishang/tree/master/Antak-WebShell) running with "iis apppool\defaultapppool" user rights. The victim server is behind NAT. Similary our ISP does not give us a dedicated IP for a given session of Internet use and we are also behind ISP's NAT (so dynamic DNS also would not work).Since we cannot afford a static IP or a private VPN Server because of the budget , technically reverse shell is also not possible in this situation with whatever I knowledge I have and googled. So I was just thinking if there is any aspx based web shell whose url in the victim server can be used as a communication channel for a session aware shell and then finally upgrade it to a meterpreter session retaining the same url as a communication channel to integrate with the metasploit for further post exploitation excercises.
Summary:-
Constraints :-
- No Dedicated Attacker Public IP.
- Attacker Behind NAT.
- Victim Behind NAT.
- Non-Session Aware ASPX Web Shell in the Victim Server with Normal IIS Service Account Privilege with no access rights to registry and system drives.
- Victim IIS Server without PHP support (so usage of weevely / meterpreter php shell not possible)
Requirement :-
An aspx web shell (to be uploaded to the victim server) acting as a communicating channel for a session aware shell in the victim server with a static URL which can be used for having an interactive terminal session from attacker's machine and finally upgrading to meterpreter for further post exploitation (having the same static url as a communicating channel without any other port's dependancy).
OR
Any other method that can be used to achieve a session aware shell satisfying these constraints.
Thanks in advance.