Metasploit and NAT

[whatthe?]

I have a test Windows 2000 server on my local LAN that I can easily get a command shell using Metasploit Framework 3. If I take my attacking laptop off the LAN and come in remotely on the same port (port 80) through my firewall, the exploit always fails saying "exploit completed, but no session was created".

I have created a port forward on my remote firewall to forward the designated LPORT to the internal private IP of my attacking PC. And my firewall on the test LAN has port 80 open and accessible to the test victim.

Any ideas what I am doing wrong?

Thanks for any help

[MaXe Legend]

I've experienced somehow.. The same on LAN's too :S On "world wide web" connections
it worked fine, but somehow on lan's i did have some similar problems, but my problem
was that the file was sent, but eh.. It looked like it wasn't anyway :S And if it was, then
it didn't execute probably maybe :S As the pentesting machine weren't giving a shell

I don't have a fix for it tho, sorry ;(

[imported_wyze]

I have a test Windows 2000 server on my local LAN that I can easily get a command shell using Metasploit Framework 3. If I take my attacking laptop off the LAN and come in remotely on the same port (port 80) through my firewall, the exploit always fails saying "exploit completed, but no session was created".

I have created a port forward on my remote firewall to forward the designated LPORT to the internal private IP of my attacking PC. And my firewall on the test LAN has port 80 open and accessible to the test victim.

Any ideas what I am doing wrong?

Thanks for any help

Maybe use Wireshark to make sure the traffic is actually being routed correctly to the port? The router / firewall may be dropping the packets.

[whatthe?]

Thanks SWC666

I have already sniffed traffic on the victim machine and can see that my remote attacking machine is indeed making a connection to it through the firewall on port 80.

I have also verified that I can connect through my remote firewall (on the attacking side via port 4444 (set as LPORT in the exploit). I ran a netcat listener on 4444 on my attacking pc and could connect to it on this port from my victim machine.

Is there something about NAT or port forwarding that that does not work with Metsploit?

[streaker69]

Chances are, whatever 'sploit you're using doesn't understand dynamic port allocation.

[thorin]

If I take my attacking laptop off the LAN and come in remotely on the same port (port 80) through my firewall, the exploit always fails saying "exploit completed, but no session was created".

I have created a port forward on my remote firewall to forward the designated LPORT to the internal private IP of my attacking PC.

How can both of the unerlined statements be true at the same time?

[streaker69]

How can both of the unerlined statements be true at the same time?

/Central Computer from Judge Dredd.

They cannot be, Judge McGruder

[whatthe?]

The problem occurs when the victim and attacking pc are on seperate lan's with seperate private ip schemes. When I put them on the same lan (i.e. no nat, firewall, internet between them) the sploit works like a charm.

[purehate]

Sounds like a tcp/ip protocol book is in your future.

[imported_harry]

I take it that when you are running it over the www you are putting your external IP for the LHOST and not your internal IP?

I usually use the DMZ feature that most routers have now-a-days and place my local machine in that for the duration of the exploit.

Or better still use a different 'PAYLOAD' - instead of a reverse shell use a bind shell - this way nothing has to come back to you, you just need to connect to the target on the port you specify - of course you need to use a port that the targets firewall is letting through, but a quick port scan should soon show you which port you can use ( don't forget about UDP)