I am working on a student project with the goal to exploit navigator vulnerabilities on weak Windows XP SP2 and/or Linux computers using only Metasploit Browser Autopwn 1 & 2.

Seems trivial but there is a catch: I cannot succeed to execute my payload because the computers are behind a squid proxy and I cannot figure out how to bypass it (or more precisely how to successfully create a proxy-aware reverse shell).

I have tried using exploits using the reverse_http(s) payloads but I discovered that we need to create a payload before and copy it on the target machine. The aim of this project is to compromise a machine without a physical access so I cannot use it.

I have also tried to set different PAYLOAD_WIN32 reverse_http(s) with but it doesn't work either.

Does anyone have an idea on how to use Metasploit to bypass the proxy?

EDIT I have successfully opened sessions on the window's machine using various exploits when on the same local network. My problem only arises when I put the machine to attack behind a proxy. It seems that the proxy used by the window's machine forbids a remote sessions to be opened.

The proxy we use is a squid 3.4 and only allows access to port 80, 443 and 8080.

When trying to use some of the exploits using the the reverse_http(s) payloads on port 443, metasploit says that the exploit started as a background job but nothing happens. When using port 8080, the server starts and I can connect the Windows machine to it but the exploit does not work.

  • The machine is behind a vlan and I will not be able to set the RHOST. I have added more informations to my original post, I hope this is clearer. If not, do let me know and I will try to complete it. – rkouere Dec 8 '15 at 8:46
  • In it's current form this question is not sufficiently clear to be answered. By default the Windows XP firewall won't allow any incoming connections Further, the fact that Squid only allow the three mentioned ports to the XP machine, it means you need to exploit the XP's browser in order to gain access. Metasploit has lots of those exploits (browser_autopwn2). May be it is of help. – void_in Dec 8 '15 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.