rapid7/metasploit-framework — pull request #2809 by scriptjunkie (2013-12-30 16:16:56+00:00)
Title: Add reverse_hop_http stager and handler

This pull adds the ability to use any basic PHP hosting as a hop point for meterpreter by adding a new reverse_hop_http payload. It does not require any modification of compiled meterpreter bins, just the slightly modified payload and a new handler that acts as a tunnel between the hop point and the meterpreter controller.

Being able to use any server you can put a PHP script on as a hop point for Meterpreter payloads makes it far easier to maintain reliable access to many systems through different hops without having full control of the various hops, without reconfiguring your own network settings, from behind TOR or NAT'd connections, etc. PHP hosting is free or cheap as well, which is an added benefit. Also, it would be simple to add hops written in ASP or other languages.

Demo https://www.youtube.com/watch?v=FktILE206z0