0

I'm using the Amazon marketplace Kali and I'm trying to test CVE-2017-0199 to see if my proxy settings to block application/hta content are working.

There is a module in metasploit that allows me to test this.

exploits/windows/fileformat/office_word_hta (or something like that)

However i need to set the reverse shell LHOST = External IP, for the payload to do a reverse callback to the kali box. At the moment it will only allow me to set the LHOST = internal IP (172.X.X.X).

Everytime i try to set the LHOST = external IP or domain name pointing to the external IP i get bind error and it wont let me. I am also running metasploit as root. There are no apache2 instances running on it.

I am owner of both the AWS instance and the endpoint i am testing on.

Is this an amazon restriction? Can anyone advise on this please?

Without me being able to set the payload to my external AWS IP, the payload will never call back to the AWS metasploit listener..

Improve this question
4
  • "it will only allow me" - how does it limit you? Can you show the bind error (the text, not a screenshot)
    – schroeder ♦
    Commented May 19, 2017 at 8:01
  • Are you able to map ports from public ip to the Kali machine? if yes, is what you need to do.
    – OscarAkaElvis
    Commented May 19, 2017 at 9:35
  • is this what you are talking about: null-byte.wonderhowto.com/forum/…
    – schroeder ♦
    Commented May 19, 2017 at 21:08
  • no i am using the AWS as the "attacker" and my windows box as the "victim" and making sure the traffic goes external from my window box out via proxy to internet to AWS attacker, i am testing a proxy rule. But AWS wont allow me to set external ip as payload callback address
    – wifiuk
    Commented May 20, 2017 at 8:54

1 Answer 1

Reset to default
1

AWS has very specific rules in place to help prevent their boxes from being abused. Running Kali or streaming to an ec2 instance is very restricted if not impossible. I don't know exactly how they are enforcing these rules (firewall rules on their end, something in their Virtual Machine Setup, etc), but if you are trying to test a vulnerability on a AWS box I doubt you'll have any luck.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .