2

I am a beginner and have just started working on pentesting engagements. I have a case where I have a victim IIS server (without PHP support) where I have aspx based web shell (https://github.com/samratashok/nishang/tree/master/Antak-WebShell) running with "iis apppool\defaultapppool" user rights. The victim server is behind NAT. Similary our ISP does not give us a dedicated IP for a given session of Internet use and we are also behind ISP's NAT (so dynamic DNS also would not work).Since we cannot afford a static IP or a private VPN Server because of the budget , technically reverse shell is also not possible in this situation with whatever I knowledge I have and googled. So I was just thinking if there is any aspx based web shell whose url in the victim server can be used as a communication channel for a session aware shell and then finally upgrade it to a meterpreter session retaining the same url as a communication channel to integrate with the metasploit for further post exploitation excercises.

Summary:-

Constraints :-

  1. No Dedicated Attacker Public IP.
  2. Attacker Behind NAT.
  3. Victim Behind NAT.
  4. Non-Session Aware ASPX Web Shell in the Victim Server with Normal IIS Service Account Privilege with no access rights to registry and system drives.
  5. Victim IIS Server without PHP support (so usage of weevely / meterpreter php shell not possible)

Requirement :-

An aspx web shell (to be uploaded to the victim server) acting as a communicating channel for a session aware shell in the victim server with a static URL which can be used for having an interactive terminal session from attacker's machine and finally upgrading to meterpreter for further post exploitation (having the same static url as a communicating channel without any other port's dependancy).

OR

Any other method that can be used to achieve a session aware shell satisfying these constraints.

Thanks in advance.

  • This question is too theoretical and vague to attract good answers. This site is not about challenging people to find ways to hack into a system but to guide users with concrete security concerns. – Julie Pelletier Aug 7 '16 at 15:59
  • How can it be that you don't have a public IP? Why can't you configure a NAT rule on your router that forwards all traffic on a given port to your machine? That should do the trick for the reverse shell. – kaidentity Aug 10 '16 at 14:55
  • hey Kaidentity , actually when i say no dedicated public ip , i mean that the same public ip is shared among various customers of my ISP in a given time. The IP that we get in our homes is a private IP from ISP which later gets translated to a shared public IP through the ISP's NAT. since i dont have control over their NAT , port-forwarding in my router wont make sense. And reverse shell would not work. – m0ksh4 Aug 11 '16 at 20:06
  • 1
    hey Julie , thanks for that. Actually I was just searching through the sites and found one of the solution that might work for a situation like mine (refer github.com/sensepost/reDuh). This is one of the practical difficulties I have personally faced in low budget engagements. Check that tool out . Please do share any info if you come across any tools like the one mentioned. Cheers mate :) – m0ksh4 Aug 11 '16 at 20:10
2

I know basically what you're saying, you need to tunnel your session.

try this:

https://github.com/SECFORCE/Tunna

It's designed to tunnel an installed meterpreter session, through a website. All you have to do is connect to the website with the tunna module.

Let me know if that is what you are looking for.

0

I suggest you purchase a Linux Droplet on Digital Ocean instead, cost friendly. And execute a netcat, ncat command to your Droplet from the shell from the shell uploaded server. In the case of a Droplet you will have a static IP.

0

Thank you all for your comments.

Though very late,posting the solution(s) that worked for me, so that anyone else facing the same problem can use the mentioned solution :-

1. Reduh (Link:- github.com/sensepost/reDuh)

2. Regeorg (Link:- github.com/sensepost/reGeorg)

3. Tuna (Link:- github.com/SECFORCE/Tunna) -

Thanks @standarduser, I had seen this when I started researching for the tools at the time when I was not getting reponse back then, but really appreciate your response. Cheers !!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.