1

I'm looking for ideas on how to run lab environment from "victim" test PC at work and "attacker" - my home PC.

Both are on separate ISPs, but it seems that my ISP at home blocks anyone trying to connect (I may be wrong though!).

My thoughts:

  1. Try it via AWS Amazon, though Amazon will likely ban me if they see I'm installing metaploit on their instances.
  2. Rely on bind-tcp or cmd payload... but cmd payload doesn't seem to work well when it comes to Eternalblue (which is what I need mainly).

What else can I try to mitigate the port blocking from the ISP?

closed as off-topic by Xiong Chiamiov, Rory Alsop Mar 8 '18 at 21:59

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Why can't you run both of them locally? Hitting a web-server from the internet versus locally is A) a trivial difference B) more of a basic network administration problem, rather than a security problem. – Adonalsium Mar 6 '18 at 19:44
  • Are you sure it's your ISP? Why? It could also be your router. What you can do is connect to an owned server via SSH, and use it to pivot and get your reverse shell. Failing that, you can also choose a bind shell, provided the port is exposed through the NAT. You don't need metasploit installed; you can pivot your metasploit through the SSH tunnel on AWS. – Mark Buffalo Mar 6 '18 at 19:45
  • I can run them both locally but I am trying to 'imitate' attacker environmen as clolesly as possible. That is...instead of thinking I am protected I want to see things the way network outsiders see them... – johny Mar 6 '18 at 19:46
  • @Mark Buffalo, yes I was thinking about RDP or even better: SSH as you mentioned to automatically forward everything. I guess it could be the router, so far I only tried to connect...'ping' without port forwarding on the router. – johny Mar 6 '18 at 19:48
  • 1
    AWS does not ban people for installing Metasploit - you can even get Kali AWS VMs – schroeder Mar 6 '18 at 21:42
0

You need a VPN SERVER because ISP does not open port 80 by default so you cannot listen on that port to complete http listen attacks. I recommend you to first try free VPN server and then you can check whether port 80 is open or not by going to Here.

If you are using router you need PORT FORWARD to redirect request to your machine. Here is the tutorial you can try.

  • You should have read the comments, OP found out it's not the ISP but the router. – korrigan Mar 7 '18 at 5:54
-1

I think a good summary of all the answers here is:

  1. AWS doesn't ban you when you install metasploit -- it shouldn't even know, and it has Kali AMIs. https://aws.amazon.com/marketplace/pp/B01M26MMTT

  2. Are you absolutely sure your ISP is blocking. Try setting up the AWS instance and see if it works -- if it doesn't chances are something else is messing up the exploit.

  3. Check if your have Port-Forwarding correctly setup on your router (which I suspect might be the issue). And test it!

  4. Finally try spicing up the exploit, by changing the destination port (try using something other than defaulting to 4444).

As others mention, a bind shell is the perfect way to bypass this issue, but if you're saying it's not working, then try the steps above.

As always, try harder.

  • A bind shell will not work against a target if it's behind a NAT. You would need to be on the same network as the attacker in order to access it. – Mark Buffalo Mar 7 '18 at 5:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.