Hi, and welcome back to Section 12 Tunneling Tru ANet.
In this video,
you'll learn how to bypass network-based firewalls using Meta Deploy.
I hope you're excited. So let's to get started with this exercise,
please ensure that you have booted your Windows 10 Enterprise virtual machine.
The Windows 10 Enterprise virtual machine will be our Victor
machine, and we'll also be using Carly Lenox as our taco machine.
Because we don't have a network-based firewall,
we can simply leverage a host based firewall on the Windows 10 system to
function as a network-based firewall between our Windows 10 virtual machine
and a Carly Switch machine. Firstly,
let us configure the firewall to block a certain range of port numbers
on the Windows Stand virtual machine.
Simply open the Windows Stand virtual machine like so let's click on
the start menu. Let's click on settings.
Let's click on update and security like so.
And before we proceed,
let us click on Windows Security.
We'll click on fires on track protection. And here,
let us ensure that our real-time protection is disabled.
This is to ensure that our pude will execute later on.
Simply click on managed settings and ensure that realtime
protection is actually disabled, like Sue.
When you're ready, click on firewall and network protection.
Ensure that all these firewalls are tuned on to monitor the domain network,
private network,
and even the public network to configure our whole Swiss firewall to
restrict traffic. Let us click on advanced settings like Soup,
and this will open up the Windows offender firewall.
With advanced settings option,
we can simply click on outbound rules and let's create a new outbound rule.
This rule will simply be used to block specific outbound ports.
Let's click on nuru like so.
And now let's select port and click on Next with this
rule, let us block a range of port numbers.
Let's block ports starting at
44, 4, 4, 4, 2, 5, 5, 5, 5.
When you're ready, simply click on next.
Our preferred action in this scenario is to block the connections to those
sports.
Let's click on next notice asking where should we apply
this rule? Let's apply to all our zones,
the do domain, the private network, and even public networks.
Let's click on next and let's set a name to help us
identify the purpose of this rule.
Let's say blocking ports
for security testing. Great.
Let's click on finish and now the rule is configured.
As you can see, it is listed right here. If you double click on this rule,
we can see it is enable, we can see exactly what the scope are,
if there's any advanced settings, what ports are being blocked and so forth.
Great. Let's click on console. So now that our environment is set up,
let's head out to Carly Lenox to create our pude.
So now that we are on our Carly Larox virtual machine,
let's use MSF Venom once more to create AP load.
Currently we will set the Windows interpreter,
reverse TCP all ports.
We'll specify the Lho as a IP address of our Carli Locks virtual machine.
The airport will be 44 44,
so when this P load is executed on a Windows 10 virtual machine,
it'll call back to our Carly Larox virtual machine.
Ensure that you set your Carly Larox IP address in this area.
We'll use F to specify the type of format for this
file, which is a Windows executable,
and we will call this file reverse underscore.
Shell simply it enter for the P to be generated.
Great, so the P is greeted. Let's verify. Let's do
LS dash l i.
We'll do grab and let's just search for reverse.
And here we can see that our payload is created within our current directory.
Excellent.
I'm simply gonna copy the IP address of my Carly machine once more.
And now let us start a Metasploit
multi handler. To accept any sort of inbound connections,
I'll type metas like Sue actually
MSF console and it enter to start Metasploit.
Great. To start the multi handler,
let's use exploit multi handler
like Sue and hit enter.
Now we need to specify the same payload,
so type set payload like so
those specify windows slash interpreter
slash reverse underscore tcp underscore
all ports. Simply enter.
Next we'll set our L host,
which is a IP address of our Carly Lennox wheelchair machine at the moment.
Next we'll set ports, which is 44 44.
An enter. Simply run to start a listener.
So now we need to transfer the payload from our Carly Lux virtual machine
to our victim machine to execute it. I'm going to open it in YouTube like so,
and I'm going to run the Python three
HT D P server on port 80. 80. Great.
I'm going to head over back to my Windows 10 virtual machine.
To download a payload,
I'm gonna simply open edge and then connect to
my Carly Lang virtual machine.
I'll do H G D P call slash slash specify the IP address
of the Carly Lang machine like so.
And here you can see the entire directory list.
I will simply look for the reverse onco file,
and here it is, reverse onco shall 30 xc.
I will right click and I'm going to do save linkers.
This should allow me to download a file. I'm gonna click save.
Great.
I'm going to add a word to my downloads directory like so.
And here we can see the file is downloaded. Excellent.
I'm going to meet this window a little smaller so we can observe to see what is
happening on the multi handler side and the virtual
machine.
However, before I do that,
I'm going to configure an IP table to redirect any sort of in
common traffic from this Victor machine to ports
44 44 on meta exploitable.
To do this, I'm going to use the second terminal like soup.
I'm going to stop my H T D P server and let's use this command
to redirect all in common traffic between ports 44 40
and 5 56 to be redirected to port 4, 4 44.
Therefore, when we execute a pude,
the P will attempt to connect to various TCB ports and
all the traffic will be redirected specifically to or
multi handler. Let's press enter.
Let's enter or password for Carly Lenox and it enter Andre.
Once this executes perfectly, you will get a new prompt. Great.
Going to minimize this and I'm going to open my Windows virtual machine
on the side.
I'm simply going to double click to execute this and we are going to run it.
Let's take a look at what is happening here. And if you notice,
we actually have a interpreter shell.
We can type cifo and we can see we now have a reverse connection
that was simply able to bypass a firewall and still we are able
to retrieve traffic or retrieve a connection from the victim machine.
During the course of this video,
you have learned how to bypass network-based firewalls using Meta Exploit.
In the next video, we will take a look at each G D P tunneling.
I hope this video has been informative for you,
and I'll see you in the next one.