Reverse RDP Proxying with Metasploit
Having GUI access to a compromised machine
can greatly simplify our post-exploitation activities.
However, there are many protection mechanisms
that can complicate this approach.
In this section, we’ll use reverse proxying
to access machines that are protected by edge firewalls
and Network Address Translation configurations.
NAT is typically implemented at the company edge firewall
and segments internal and external IP addresses.
By design, this prevents us from gaining access to internal machines
from the Internet.
For example, if we have compromised an
internal workstation through a phishing attack,
we will not be able to obtain a Remote Desktop session on that system
even if we have the clear text credentials.
However, we could establish an egress network connection
from the compromised internal client to our attack machine
and leverage this connection as a tunnel
for other traffic, such as an RDP session.
This is certainly not a new technique,
but the concept and implementation can be somewhat complicated.
We’ll explore a few solutions.
First, we’ll use Meterpreter’s built-in reverse proxy feature
and then we’ll demonstrate a standalone solution.
To begin, we must have an established shell on the target system,
which in this case is the Windows 10 client.
To simulate a compromise, we will log in to the machine as the admin user,
and reuse our existing C# tradecraft
to launch a 64-bit staged Meterpreter agent
which will connect to our Kali attacking machine.
Once the Meterpreter session is active, we’ll send it to the background,
and run the autoroute module.
This will allow us to configure a reverse tunnel
through the Meterpreter session and use that with a SOCKS proxy.
The autoroute module creates a reverse tunnel
and allows us to direct network traffic into the appropriate subnet.
We can use a local proxy application like Proxychains,
to force TCP traffic through a TOR or SOCKS proxy.
We can configure it by adding the SOCKS4 proxy IP and port to the config file.
After configuring Proxychains,
we’ll start it along with rdesktop and supply the internal IP address.
After running the command,
the RDP connection is established through the SOCKS proxy
from the Meterpreter session,
allowing us to obtain a Remote Desktop session on the internal client.
The route created by Meterpreter also allows us to access any
other computer on that internal network.
In this section we used the proxy functionality of Metasploit
to set up a reverse tunnel.
Next we’ll use a stand-alone tool for this.