I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine.
This is what I have done so far:
Me(attacker): 184.108.40.206 (some public ip)
Web app (victim): 220.127.116.11 (some public ip)
Internal Machine(web server): 10.1.1.80
Web Server info:
I found a SQL Injection vulnerability in the web application at 18.104.22.168 and using sqlmap with the --os-shell option I was able to get a Web shell through this application as the apache user. Then I executed the 'ifconfig' command which gave me an internal ip 10.1.1.80.
My goal is to get an interactive shell so I have been trying to use a reverse shell to tunnel out of the internal network to my public attacking machine. I believe the problem I am running into is the firewall.
This is what I know (using the web shell):
Can't view firewall rules
I can upload files through the web shell but I can't download or use HTTP/HTTPS directly from the internal machine through the web shell so http reverse shell would not work.
I also tried to run 'host google.com > /tmp/output.txt' through the web shell which gives no output leading me to believe DNS is not allowed either.
I have also tried my reverse shell listening on numerous popular ports which makes me think the firewall is doing deep packet inspection which is why it won't allow it to be tunneled over these ports.
The one thing that worked is I was able to ping my public attacker machine from the internal machine through the webshell which makes me think i could tunnel a reverse shell using ICMP. I found a tool called 'icmpsh' but unfortunately the client that runs on the victim machine is written in C for Windows only. I thought I would use 'wine' to do this on the internal linux box but can't install any programs from the internet and uploading wine through the webshell led to a lot of dependency errors. So my next plan was to write my own ICMP reverse shell in pure python but using SOCK_RAW requires sudo.
My question is do you think that ICMP is the way to tunnel a reverse shell out or is there a different protocol that I could be using or testing for? Maybe there is portable version of wine or equivalent I can upload?
PS: This is for practice so it is setup to be achievable