Now, you may have heard about S.
S H port forwarding, if you have, you will be somewhat familiar with this section.
However, the port forwarding technique used an interpreter is likely S.H. port forwarding so.
This functionality will give you access to the ports on the target that you can't otherwise reach.
So to understand how this works, I'll just indulge me a moment, will you?
I'll tell you a little story.
Think of a penetration test that you successfully compromise and gain access to a target.
You with me so far, but you are not allowed to access Port three three, eight, nine and for four
or five, which can only be locally accessed for security reasons.
So at this point, you need to forward these ports on the target to yourself.
So by using these port forwarding techniques and interpreter, you can reach a port on a target that
you can't reach by any other way necessary.
It just so happens the interpreter put forward command does all of this magic for us.
And it's going to relay TCP connections to and from the connected machines.
So I'm going to assume you already have an interpreter shell, like I do here.
I also have a system level session on metastable three using when R.M. as they exploit that you've discovered
before.
So, all right, same page, same page.
So let me first check if I can reach port for four or five after enabling Windows firewall on my disposable
three.
So I'll open up a new tab.
And map he for four or five reason tend 10 that to that 10.
And the port is filtered.
So this will mean that the port is behind the firewall and it won't give us a response.
So we'll go back to the interpreter session.
Type in shell as my command to get into the window shell.
I want to check if Port 445 is really closed or whatever it's doing.
So I'll type net, stat A. pipe, find a star for four or five.
Now, as you see here, bought for four or five is listening on the local.
OK, so exit the show.
And now you discover that bought for four or five is open on the target, but you can't access it to
make a Pesek or execute something else on that board.
And that's why, thankfully, interpretor put forward command will give us a hand.
Port forward.
H.
Help menu is awfully clear, so you can create port forwards and manage them.
And I'm going to list if I have any.
Put forward list.
No, I don't have any.
So it only takes a few seconds to add some.
To add a put forward rule type port forward.
Then L for the local board on your system and then.
P for the port on the target.
And finally, Ed, are to specify the target I.P. address.
And then you can add a rule.
So now let's list it again.
All righty, then, you have a poured forward rule.
So, you know, this forward rule is even valid outside Métis Point.
So let's go to another tab.
And now I will make an end map scan.
But this time I'm going to use my localhost i.p.
As well as the port that I binde remote port for four or five due to 40.
So now the query will be and map P four for four or five reason.
One two seven zero zero one.
And I can see now, what, four, four, four, five is open on my localhost.
Now, it doesn't really make sense, you know.
So add as V to this query to identify the service information.
And because of the fording is a little slow.
OK, well, not that much.
So have a look at that and map the Texas areas on my local port for four or five is a Microsoft service,
which means the assembly service is running on that port.
So I can go back to Métis Point.
Background session.
Now, the last step is making a PSA back to target over 40.
So first, let me choose this exact.
Use, exploit.
Windows.
SMB, yes, exactly.
Show me the options.
Said our host.
To one two seven zero zero one.
And it's the same logic for what we use for Inmet.
So because I need to exploit the service running on board for four or five on my localhost, which forwards
everything to work for four or five on my disposable three, so.
Set our report to four for four or five.
Set SMB user to vagrant.
And SMB pass to Vagrant as well.
Set payload.
To Windows interpreter.
Reverse TCP.
Said, I'll host to the IP address of your colleague.
Said support to something that you want, let's choose 555.
And I think I set up everything, but double checking is always better, so show the options again.
And nothing extra to configure so that I can exploit.
And I think that boy is doing quite well.
So this point, sometimes sessions don't open or sometimes two sessions open.
So you can try it again, don't worry.
And the session opened by using the gorgeous duo.
Get UID.
Info.
And you successfully make yes, exactly, and have a session on Métis voidable three.