0

Can someone explain a technique when I know that I can expoit RCE on a server that is located in an internal network but I don't understand how to get a reply back from the payload once it gets inside the server?

  • Is the vulnerable server able to contact anything else than the internal network? – mhr Jul 29 at 11:53
  • are you in the local network or outside the public network? – schroeder Jul 29 at 12:55
  • Pease explain the question further do you have RCE already or you know that the internal application has RCE but haven't actually exploited it cause you cant reach it – Vipul Nair Jul 29 at 14:12
  • @Vipul Nair - actually it is theoretical question. I've done it already in a lab but the server was facing the internet. Now i'm wondering how we can go futher if the server is begind a firewall in a VLAN which is not connected to the Internet by any mean – heismadatmelol Jul 30 at 8:24
  • @heismadatmelol you cant.simple – Vipul Nair Jul 30 at 8:43
1

It could be that some of the outgoing traffic from the server is blocked. Upon gaining a RCE there are various techniques to check if you can get a connection back:

In summary:

  1. Check what you can reach
  2. Use that to create a shell
  3. Do whatever you came to do

*This is not intended as a deep dive explanation, but just as an example of some of the techniques you can use

0

Provided you are already executing code on the target, you could simply start a netcat listener on your attacking machine to receive a shell that you execute on the target from the RCE.

See below where l tells the program to listen, v is for verbose and p specifies the port that your reverse shell has been configured to call back on.

nc -lvp 1337

If you are not sure if you are executing code or not, try pinging yourself from the target box and listen locally with Wireshark or tcpdump.

NOTE: This assumes direct access being available from the target machine to the attacking.

  • @schroeder i think he is dead wrong.Isnt the question just asking how to get a rce from an application that only works on the internal network? – Vipul Nair Jul 29 at 13:00
  • @VipulNair I'm actually not sure what the question is – schroeder Jul 29 at 13:03
0

I think in such a scenario the general idea would be to find a public-facing application that can interact with the internal application in question or the internal application is somehow interacting with something external facing. Conditions of both would be implementation-specific.

In a black-box scenario, this should be pretty tough. But if you can, you would find a vulnerability in a public-facing application this could be an RCE (ideal situation) or it could server-side request forgery or some other vulnerability. That way you can smuggle commands and see the output. I mean this is more of a pure networking question.

Can you interact with an application in the internal network? If and only if there is public-facing application which you can leverage

Edit:-Okay i read some answers and I might be wrong here.Please explain the question further do you have RCE already or you know that the internal application has RCE but haven't actually exploited it cause you cant reach it.Cause if you have RCE then you could use out of bounds methods to further the attack i wrote the answer on the notion that you don't have RCE yet and were asking if its possible to RCE an application on the internal network.

  • The server might not be accessible for new incoming connections from outside, but it is not out of the range of possibility for it to be able to call out, which makes a reverse shell possible, no? – schroeder Jul 29 at 13:11
  • @schroeder But if it has no incoming connection is there a way to interact with it?How would you put the first command in to respond back to you? – Vipul Nair Jul 29 at 13:18
  • If the server is passed the payload from the public layer. – schroeder Jul 29 at 16:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.