{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6786","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6786/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6786/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6786/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6786","id":149011675,"number":6786,"title":"post/windows/manage/autoroute Improvements","user":{"login":"jhale85446","id":12484685,"avatar_url":"https://avatars.githubusercontent.com/u/12484685?v=3","gravatar_id":"","url":"https://api.github.com/users/jhale85446","html_url":"https://github.com/jhale85446","followers_url":"https://api.github.com/users/jhale85446/followers","following_url":"https://api.github.com/users/jhale85446/following{/other_user}","gists_url":"https://api.github.com/users/jhale85446/gists{/gist_id}","starred_url":"https://api.github.com/users/jhale85446/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhale85446/subscriptions","organizations_url":"https://api.github.com/users/jhale85446/orgs","repos_url":"https://api.github.com/users/jhale85446/repos","events_url":"https://api.github.com/users/jhale85446/events{/privacy}","received_events_url":"https://api.github.com/users/jhale85446/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/docs","name":"docs","color":"fef2c0"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":8,"created_at":"2016-04-18T00:39:40Z","updated_at":"2016-04-25T16:55:02Z","closed_at":"2016-04-18T17:12:23Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6786","html_url":"https://github.com/rapid7/metasploit-framework/pull/6786","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6786.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6786.patch"},"body":"## Overview\r\nThis PR is in response to Issue #6781 where @wchen-r7 noticed that the autoadd CMD option was not adding all possible routes. As previously programmed, autoadd was only looking at the host's routing table to gather potential routes. In certain situations, this would miss other potential routes. The issue is observed in the case of a full traffic VPN that does not put a route to its subnet in the host's routing table since all traffic goes through the VPN's network adapter.\r\n\r\n## Fix\r\nThe issue was fixed by adding functionality for autoadd to search through the host's network interface list to find additional potential routes. If these routes are not already included in Metasploit's routing table, they are added.\r\n\r\nNote: Since I was unable to locate functions to convert an IPv4 address and netmask to a corresponding subnet \"network\" in the Framework, I wrote them for this module. If they do exist in the Framework, I will drop off the ones in this module. Or if they do not exist in the Framework, and it is desirable to move them to a Framework library for other modules to use, I am good with that. I would need to know which library is best for them.\r\n\r\n## Additional Improvements\r\nA new CMD option \"default\" was added to this module. This option will add a default route (0.0.0.0/0.0.0.0) to Metasploit's routing table for the associated Meterpreter session. This forces all TCP/IP traffic; not otherwise covered in the routing table, to be routed through that session. A default route useful in situations where a full traffic VPN is used and the VPN server does the routing to private networks. In this situation, it is likely that the compromised host's routing table and interface list would not include routes or references to these networks. The default route will push the routing off to the server allowing those networks to be accessed, pending you know where to look. The default route can also be used to browse the Internet as the compromised host using a Socks4a proxy and Proxychains.\r\n\r\nAlso, included in this PR is the addition of a documentation file for this module (autoroute.md). The file contains information on using this module and information on pivoting using a Socks4a server and Proxychains.\r\n\r\n## Verification of Fix for Issue\r\nA Meterpreter session was initiated on a machine running Windows 10. This host has NetMotion's Mobility VPN installed and set up for full traffic. (Also tested on Windows 7 using the same VPN.)\r\n\r\nBefore this update the results of this module using autoadd were as follows:\r\n\r\n```\r\n[*] \tRunning command run post/windows/manage/autoroute\r\n[*] Running module against SURFACE\r\n[*] Searching for subnets to autoroute.\r\n[+] Route added to subnet 192.168.1.0/255.255.255.0\r\n[+] Route added to subnet 192.168.86.0/255.255.255.0\r\n[+] Route added to subnet 192.168.184.0/255.255.255.0\r\n```\r\n\r\nThis is missing a route to the subnet associated with the VPN since it is not in the routing table as can be seen from the NetMotion interface.\r\n\r\n```\r\nInterface 18\r\n============\r\nName         : NetMotion Virtual Network Adapter (NMVNIC)\r\nHardware MAC : 4e:4d:a5:91:ea:8e\r\nMTU          : 1500\r\nIPv4 Address : 10.10.239.210\r\nIPv4 Netmask : 255.255.255.0\r\nIPv6 Address : fe80::3107:4f8f:74dd:5555\r\nIPv6 Netmask : ffff:ffff:ffff:ffff::\r\n```\r\n\r\nAfter this update the results of autoadd are as follows:\r\n\r\n```\r\n[*] \tRunning command run post/windows/manage/autoroute\r\n[*] Running module against SURFACE\r\n[*] Searching for subnets to autoroute.\r\n[+] Route added to subnet 192.168.1.0/255.255.255.0 from host's routing table.\r\n[+] Route added to subnet 192.168.86.0/255.255.255.0 from host's routing table.\r\n[+] Route added to subnet 192.168.184.0/255.255.255.0 from host's routing table.\r\n[+] Route added to subnet 10.10.239.0/255.255.255.0 from NetMotion Virtual Network Adapter (NMVNIC).\r\n```\r\n\r\nTesting on other VPN solutions is requested. Since this looks at all of the network interfaces, it should find the routes regardless of which VPN solution is used.\r\n\r\n## Verification of Default Route\r\nFor this, I started a Windows Meterpreter session on a host with a different public IP address from my Kali machine. The module was run on the session using the \"default\" CMD option. A default route was added. I used the Socks4a module with Proxychains and Firefox to visit www.ipchicken.com to verify that the reported external IP address belonged to the compromised host. A description of how to set this up is in the documentation file included in this PR."},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/214440196","html_url":"https://github.com/rapid7/metasploit-framework/pull/6786#issuecomment-214440196","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6786","id":214440196,"user":{"login":"tdoan-r7","id":1195616,"avatar_url":"https://avatars.githubusercontent.com/u/1195616?v=3","gravatar_id":"","url":"https://api.github.com/users/tdoan-r7","html_url":"https://github.com/tdoan-r7","followers_url":"https://api.github.com/users/tdoan-r7/followers","following_url":"https://api.github.com/users/tdoan-r7/following{/other_user}","gists_url":"https://api.github.com/users/tdoan-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/tdoan-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tdoan-r7/subscriptions","organizations_url":"https://api.github.com/users/tdoan-r7/orgs","repos_url":"https://api.github.com/users/tdoan-r7/repos","events_url":"https://api.github.com/users/tdoan-r7/events{/privacy}","received_events_url":"https://api.github.com/users/tdoan-r7/received_events","type":"User","site_admin":false},"created_at":"2016-04-25T16:55:02Z","updated_at":"2016-04-25T16:55:02Z","body":"Thanks for the module docs @jhale85446! Great work."}}