I'd like to test a scenario where the user receives a mallicious attachment in a phishing email. The attachment is intended to open an HTTP or HTTPS reverse shell to the attacker who sits outside of the corporate network. The network topology looks like this:
Attacker --- Internet --- Firewall --- Proxy --- Victim
The firewall blocks every outbound traffic except web browsing through proxy and DNS requests. The proxy uses authentication.
As I've red through numerous post in this topic, i've got the impression that a basic metasploit reverse http meterpreter shell would do the trick in this environment, but I'm curious how the reverse shell could go through the proxy? First of all how does it detect that there is a proxy and what is its address?
It's maybe kind of a noob question. My only idea is that if the proxy settings are set in the registry, Windows routs all the HTTP and HTTPS traffic toward the proxy transparently.