Meterpreter Port forwarding

Metasploitable 3: Meterpreter Port forwarding

In this Metasploitable 3 Meterpreter Port sending hacking instructional exercise we will figure out how to forward nearby ports that can't be gotten to remotely. It is extremely normal and great practice to run particular administrations on a nearby machine and make them accessible to that neighborhood machine just rather than the full system. On a neighborhood organize these administrations are normally organization boards used to design equipment or programming on a solitary machine which doesn't have to open these administrations to the full system, much the same as you would not have any desire to uncover a nearby FTP or SMB server to the web. A decent case of an administration that doesn't permit outside access of course is MySQL server. MySQL server incapacitates remote access as a matter of course upon establishment for security reasons and requires the framework overseer to unequivocally empower remote access so as to permit remote associations. In this instructional exercise we will utilize Meterpreter port forward to burrow associations with administrations that can't be gotten to remotely.

Port forwarding: Accessing local ports remotely

The beginning stage of this instructional exercise is the place the last instructional exercise has finished: a Meterpreter shell that was increased through misusing HTTP PUT that enabled us to transfers malignant documents to the web root registry.

The starting point of this tutorial is a Meterpreter shell.

When we run ipconfig on the Metasploitable 3 machine we can see there's a moment NIC give IP 10.0.2.15 as should be obvious on the accompanying screenshot.

Multiple NICs on Metasploitable 3

The main issue is that this system is right now not routable from our Kali Linux assault machine. To get to this system we would need to setup a socks4 intermediary with proxychains to forward all associations with this subnet. A similar strategy would likewise enable us to examine the objective system from the point of view of the Metasploitable 3 machine. This would uncover open ports and administrations that can be gotten to locally yet not remotely. One case of such administration is the MySQL benefit that is running on port 3306. The underlying Nmap examines didn't uncover this port as it is firewalled on the grounds that it's not intended to be gotten to remotely. When we run netstat on the Metasploitable 3 machine we can confirm that port 3306 is utilized on the machine and has the administration with PID 2224 appended:

Netstat output on Metasploitable 3

By running tasklist we can confirm that MySQL.exe is running on PID 2224:

PID for MySQL.

Since we know MySQL is running on port 3306 and can't be gotten to remotely, we have to setup the Meterpreter shell in a way that we can burrow associations over the shell. Since the Meterpreter shell runs locally and can get to port 3306, we have to forward a neighborhood port to the Metasploitable 3 machine over the Meterpreter shell. The most straightforward approach to do this is to utilize the Meterpreter portfwd module. Before we forward the nearby port to Metasploitable 3, we should observe the port sending usefulness when all is said in done first to show signs of improvement comprehension of what it precisely does

Meterpreter Port Forwading

The portforward fucntionality in Meterpreter can be utilized as a turning strategy to get to systems and machines through the traded off machines that are generally distant. The portfwd charge will transfer TCP associations with and from the associated machines. In the accompanying advances we'll be making the mySQL server port 3306 accessible on the nearby assault machine and forward the movement on this port to Metasploitable 3. At the point when all is setup we will associate with the localhost on port 3306 with the mysql order line customer. The association with these ports will be sent to Metasploitable 3.

We can make the passages utilizing the accompanying summons:

We can make the passages utilizing the accompanying summons:

We should clarify the parameters we've utilized as a part of the summon:

- l [port]is the nearby port that will tune in and sent to our objective. This can be any port on your machine, as long as it's not as of now being utilized by another administration.

- p [port]is the goal port on our focusing on have.

- r [target host]is the our focused on framework's IP or hostname.

When we've effectively ran the charges on the Meterpreter sessions the yield saying the two ports have been sent should look as following:

Forwarding local port 3306 to port 3306 on 172.28.128.3

We can confirm that neighborhood port 3306 is open on our nearby machine by running netstat as following:

Port 3306 available on the local attack box.

Next we can get to the MySQL benefit on Metasploitable 3 by having the MySQL customer associate with the localhost as following:

Successful connection to the MySQL server.

Associating with the MySQL server additionally uncovered a usually observed security issue; we didn't supply a secret key in the association order and we were not incited to enter one either. As should be obvious in the screenshot we can list all databases introduce on the MySQL server, including the WordPress database. Because an administration can be gotten to locally just, it doesn't imply that a secret key assurance layer ends up plainly out of date. As should be obvious associations and ports can without much of a stretch be sent when an aggressor has shell access to the machine. 

Since we've access to the WordPress database, we should extricate the client secret key hashes utilizing the accompanying SQL inquiry:

WordPress password hashes

Running a lexicon assault on the administrator hash with john uncovers the watchword for the WordPress administrator client:

The password for the admin account is sploit.

In this instructional exercise we've found out about port sending with Meterpreter. We've sent associations from a neighborhood port on our assault box, over Meterpreter to a nearby port on the Metasploitable 2 machine. This enabled us to get to port 3306 on Metasploitable 3 from a remote machine. In the following and last Metasploitable 3 hacking instructional exercise we will assault the WordPress establishment utilizing a couple of various assault vectors.