Jump to content

Setting up LHOST on Metasploit when using 3G network for remote exploits


updatesvc
 Share

Recommended Posts

I am a kind of a noob on this one.

I have this question.

I share internet through tethering using my phone which is connected through the internet through the 3G network.

I dont have any other way of accessing the internet, so no cable or wired connections.

In the options for setting up an exploit in metasploit the LHOST option will not work if I set my public ip.

This is because my ISP filters all incoming requests on all ports (The router is located at their site, no access).I would like to know if their is a way I could work around this, prefarably a free method.I already know I can use a VPS (Virtual Private Server) but thats expensive.

Possible noobie solutions:proxies,VPNs.If this is a solution I would like to know how to setup the LPORT and LHOST.

I am sorry if this has a simple answer.

Environment: Kali linux version on VMware workstation--->Hosted on a windows machine

Please help

Link to comment
Share on other sites

That didn't or won't work because the 192.168.x.x network is for the local network for me that is the network between my phone to my computer(Tether network).Thanks for trying. I am also looking for ways to unblock port which are blocked by default.

Link to comment
Share on other sites

The first thing you should know, is that 3G networks are usually natted. This does mean that running services from behind the nat is going to be difficult.

Can you determine your actual IP on the 3G network and your remote IP? Are they different?

You might be best off with a VPS or VPN to provide a static IP / Port that you run the listener on, or at least port forward (eg, via SSH).

Tim

Link to comment
Share on other sites

I am not quite sure what "actual IP" or "remote IP" means, but doing a google search for my Ip address I get this 154.122.xxx.xxx (I am guessing this is my remote ip) that same IP is what I get running an network analyzer tool on my android.When running trace route (on google.com) commands something different happens

1st hop ***10.36.xxx.xxx I guess this one is my isp router

2nd hop ***10.36.xxx.xxx I guess this one is another my isp router

3rd hop ***212.49.xxx.xxx this one shows my isp domain name

4th hop ***10.xxx.xxx.xxx

-----some other more gateways

BTW I tried accessing the router pages no luck.

phpsystems:do you have any references or walkthrough guides for VPNs or SSH tunnelling to listen to a port.

Link to comment
Share on other sites

By Actual Address, I meant the IP that your 3G provider assigned to you. By remote IP, I meant the address you see when you go to something like whatismyip.com. Nat is the translation from one to the other.

Port forwarding via ssh is straight forward, You just need the -R option eg, if you vpn is on 2.2.2.2 and you want the listener on port 2345, you could it up via:

ssh -R 127.1.1.1:2345:2.2.2.2:2345 user@2.2.2.2

Then metasploit would be listening on 127.1.1.1 (LHOST) port 2345 (LPORT), and the payload would be talking to 2.2.2.2 port 2345

This might help:

https://www.youtube.com/watch?v=PQY8eTzMiHM

Link to comment
Share on other sites

:grin: Thanks phpsytems, for sharing

I will try that : watching the video now

Here is a small snip from ipconfig /all command when using a 3g USB dongle

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : HUAWEI Mobile Connect - Network Adapter #2
Physical Address. . . . . . . . . : 58-2C-80-13-92-XX
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::8c28:ca02:bfe3:648c%5(Preferred)
IPv4 Address. . . . . . . . . . . : 154.122.xxx.71(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.240
Lease Obtained. . . . . . . . . . : Saturday, January 30, 2016 11:19:06 AM
Lease Expires . . . . . . . . . . : Friday, February 5, 2016 11:19:07 AM
Default Gateway . . . . . . . . . : 212.49.xxx.22
154.122.xxx.65
DHCP Server . . . . . . . . . . . : 154.122.xxx.65
DHCPv6 IAID . . . . . . . . . . . : 794307712
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-3D-7B-3D-58-2C-80-11-91-08
DNS Servers . . . . . . . . . . . : 212.49.xxx.22
196.202.xxx.45

At the time my IP whatismyip.com was 154.122.xxx.65 the same as my (DHCP server and Gateway) but different from my IPv4 address

I will check back , and inform you if the ssh solution worked.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...