Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This question is a doozey, but is something I am trying to figure out for a simulation penetration test. Maybe I'm going the wrong way about it, and maybe I should post this in another forum, but given what I'm actually asking it felt appropriate here.

I am able to remotely connect to another computer, and access a windows command prompt. The other computer is behind a VPN. Using only the tools I have at my disposal (that is, a reverse connected meterpreter) how can I find out the TRUE external IP address of the remote machine?

I am thinking I will need to hit an external site (like ipchicken.com) or even just pull down an external webpage (since I have the server logs to that server) via the command line, while forcing it to NOT go through the VPN.

Any help would be appreciated!

share|improve this question

3 Answers 3

up vote 1 down vote accepted

First, check the local IP address! Make sure a public address is not assigned to the device.

If there is indeed a NAT, you would need to look at your routing table first.

$ netstat -rn
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
192.168.0.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
0.0.0.0         192.168.0.1     0.0.0.0         UG        0 0          0 eth0

Using that you should see what routes exist on that computer. Most likely there will be a route going over a VPN (yours) and then other routes. What you are looking for is the default route, make sure it exists and then send traffic over it; if the default route is your VPN then try to find a more specific route that leads you out of the network.

If you have a default route that is not your VPN go to any server in which you can track IP address that connected to it. This can be your server in which you try to ping, or try and access a webpage on your server.

Edit:

Adding a route in Windows:

route ADD *prefix* MASK *subnet* *gateway* METRIC *metric* IF *interface number*
route ADD 157.0.0.0 MASK 255.0.0.0  157.55.80.1 METRIC 30

Although you can change the route using meterpreter:

route add *prefix* *subnet* *gateway*
route add 157.0.0.0 255.0.0.0 157.55.80.1

Source:

http://www.offensive-security.com/metasploit-unleashed/Msfconsole_Commands#route

route /?

share|improve this answer
    
what is the command to use a different route on windows? –  Tedd Johnson Sep 24 '13 at 23:39
    
@TeddJohnson, updated. Also, I would look at: offensive-security.com/metasploit-unleashed/… for uploading a file. –  prateek61 Sep 24 '13 at 23:46

I generally use checkip.dyndns.org (216.146.39.70) to identify my external ip, via the command

curl -s checkip.dyndns.org

In your case all you have to do is add to the routing table a specific rule bypassing the VPN. So, suppose your local gateway is 10.1.1.254, all you have to say is

sudo route add -host 216.146.39.70 gw 10.1.1.254

Now, when your request "curl -s chekip.dyndns.org" leaves your pc, it will be routed thru the local gateway, not the VPN, and the reply will disclose your true external IP.

share|improve this answer
    
yes, that would work on linux, is there a windows command to do something similar? –  Tedd Johnson Sep 24 '13 at 22:08
    
This one is great! Although, I would add that you should probably use the IP address in the curl as to limit network traffic. @TeddJohnson if you have a meterpreter session why wouldn't you just upload curl to the computer and then modify the routing table? –  prateek61 Sep 24 '13 at 23:33
    
I will give it a shot in meterpreter, this would be a fantastic solution as long as it works! –  Tedd Johnson Sep 24 '13 at 23:40
    
@TeddJohson In windows the same command would be route add 216.146.39.70 mask 255.255.255.255 10.1.1.254 –  MariusMatutiae Sep 25 '13 at 4:19
    
@prateek good point about using the IP number rather than the full URL. The DNS request would go thru the VPN. I am not used to working in hostile environments. –  MariusMatutiae Sep 25 '13 at 6:35

I tried to use quite a few options but none works as expected, so I wrote a simple command line program for this purpose.

It is free, you can download it here.

The program is written in .Net and can be also used as a library or even compiled for OS X and Linux using Mono. Although this is a simple program it includes all options for reliably acquiring an external IP address, because it does not depend on a single public site but many.

Use the -? parameter for details.

share|improve this answer
    
Would it be possible for you to include the source code as well? We're always a little cautious with linking to .exe files on the Internet. –  slhck Jan 6 at 17:51
    
Yes, but you can use reflection and this will show you everything also, it is .net application... anyway you can contact me using comments and i'll provide source also. –  user286725 Jan 19 at 20:44
    
Homepage for application is here –  user286725 Jan 19 at 20:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.