I am working on a student project with the goal to exploit navigator vulnerabilities on weak Windows XP SP2 and/or Linux computers using only Metasploit Browser Autopwn 1 & 2.
Seems trivial but there is a catch: I cannot succeed to execute my payload because the computers are behind a squid proxy and I cannot figure out how to bypass it (or more precisely how to successfully create a proxy-aware reverse shell).
I have tried using exploits using the reverse_http(s) payloads but I discovered that we need to create a payload before and copy it on the target machine. The aim of this project is to compromise a machine without a physical access so I cannot use it.
I have also tried to set different PAYLOAD_WIN32 reverse_http(s) with but it doesn't work either.
Does anyone have an idea on how to use Metasploit to bypass the proxy?
EDIT I have successfully opened sessions on the window's machine using various exploits when on the same local network. My problem only arises when I put the machine to attack behind a proxy. It seems that the proxy used by the window's machine forbids a remote sessions to be opened.
The proxy we use is a squid 3.4 and only allows access to port 80, 443 and 8080.
When trying to use some of the exploits using the the reverse_http(s) payloads on port 443, metasploit says that the exploit started as a background job but nothing happens. When using port 8080, the server starts and I can connect the Windows machine to it but the exploit does not work.