Welcome back to Basic Exploit Development.
And in this module, we're going to show you how to offensively pass the reverse shell between a cloud
services listener to local Metasploit listeners.
So Shell passing can be a useful technique to relieve strain on underpowered virtual private servers
with low memory or ineffective CPU's like Mali, somebody using in this example is going to only have
one gigabyte of RAM.
It helps also in mitigating cost of getting a more expensive server.
It is an extremely lightweight method to allow your metasploit or net cat listeners run in the full
capacity on your local attacker machine by having the session travel through a TCP to reverse tunnel
that points right back to your payload listener on your home machine.
This technique is VPN compatible, so if the target was high tech kind of VPN, you will simply get
connect back through that vpn's IP address.
So how does this work?
The victim executes a payload that connects to our $5 a month vulture e-comm jump server listing on
port 443.
The jump server is constructed of four connections from port for three to log a host port for four,
four, four, which is the entry point of our reverse SD shuttle.
When the jumps are redirect four, four, three, traffic.
Two, four, four, four, it reaches our sponsor at home.
This is a significant cost by not having to run a particularly powerful server for like, oh, say $3
an hour or something.
Let's look at a diagram.
So our victim machine has this IP address and it executes a payload that connects back to our attacking
jump server.
6640 296, two, three, eight and 4443.
We then have a so-called reverse TCP tunnel.
Redirect that to localhost four, four, four, four, which then four performs that using this command
to back to our attacking listening port on a port four, four, four on our local laptop.
Let's try to put this in action.
So first of all, we need to build the reverse TCP tunnel used as a stage in app route at waterdrop
for server.
Although your IP address will be different than mine dashcam ra for for for local host four.
Four.
Four for.
Now we need to create our reverse TCP tunnel.
First, logon to the jump server.
Remember when I wrote, I assure you, vulture jump server.
That's just the IP address that's located my host file.
So we're going to use so cat dash V for verbose TCP for Dash L capital and so forth.
Three We use address fork TCP for loco host.
Four, four, four, four.
Oh, sorry.
I already use this in the previous sample.
All right.
Now let's go back and fray our Rochelle surge type payloads.
Bash.
Hello.
We're going to use this one.
Set a whole host to yourself, 000 to handler, and then we have to create our payload.
Remember to set our host to your attacking VP's IP address.
Set.
Four, four, four, three, generate talk afro.
All right.
And now when I put the file to root.
Tests show.
Now let's deliver this to our victim machine.
There are tests that show.
C.J. Lister at.
And now as the victim.
We're going to do a zero dash test to show.
Go back to our Metasploit listener.
And we open a command shell on our victim.
Now, here is where Shell passing is going to have a flaw because it's going to show you local host
to local host because of the TCP reverse message tunnel.
But you can validate that you actually hacked the host.
You named?
Who am I?
I'd.
So the only quirk that we have is that because of how Metasploit works, it always assumes that of getting
a connection from local host.
But as you can see, Perl can have IP token.
We successfully attacked the target through my second VPN, which is a bar guard.
So this shows you a lot about how to pass offensive shells and how to cut costs on your penetration
test by using a public IP address.
Forward the shell back to your home.
Metasploit Listener.
Remember these VP yesterday you ran for $5 a month.
They're probably only going to have one single core CPU and they're really, really slow and they don't
have much RAM to work with.
So you can't just run Metasploit reliably on those remote PCs.
You can just use this technique to pass it to a more capable machine, which is this kind of Linux VM
at home.
Thank you.