BNAT Router - Metasploit


This page contains detailed information about how to use the auxiliary/bnat/bnat_router metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Table Of Contents
hide

Module Overview

Name: BNAT Router
Module: auxiliary/bnat/bnat_router
Source code: modules/auxiliary/bnat/bnat_router.rb
Disclosure date: -
Last modification time: 2017-07-24 06:26:21 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): -
List of CVEs: -

This module will properly route BNAT traffic and allow for connections to be established to machines on ports which might not otherwise be accessible.

Module Ranking and Traits

Module Ranking:

  • normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

msf > use auxiliary/bnat/bnat_router
msf auxiliary(bnat_router) > show targets
    ... a list of targets ...
msf auxiliary(bnat_router) > set TARGET target-id
msf auxiliary(bnat_router) > show options
    ... show and set options ...
msf auxiliary(bnat_router) > exploit

Go back to menu.

Msfconsole Usage

Here is how the bnat/bnat_router auxiliary module looks in the msfconsole:

msf6 > use auxiliary/bnat/bnat_router

msf6 auxiliary(bnat/bnat_router) > show info

       Name: BNAT Router
     Module: auxiliary/bnat/bnat_router
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  bannedit <[email protected]>
  Jonathan Claudius

Check supported:
  No

Basic options:
  Name      Current Setting  Required  Description
  ----      ---------------  --------  -----------
  BNATIP    1.1.2.2          yes       The ip of the bnat response you are getting
  CLIENTIP  192.168.3.2      yes       The ip of the client behing the BNAT router
  ININF     eth2             yes       The internal interface connected to the network
  OUTINF    eth1             yes       The external interface connected to the internet
  SERVERIP  1.1.2.1          yes       The ip of the server you are targeting

Description:
  This module will properly route BNAT traffic and allow for 
  connections to be established to machines on ports which might not 
  otherwise be accessible.

References:
  https://github.com/claudijd/bnat
  http://www.slideshare.net/claudijd/dc-skytalk-bnat-hijacking-repairing-broken-communication-channels

Module Options

This is a complete list of options available in the bnat/bnat_router auxiliary module:

msf6 auxiliary(bnat/bnat_router) > show options

Module options (auxiliary/bnat/bnat_router):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   BNATIP    1.1.2.2          yes       The ip of the bnat response you are getting
   CLIENTIP  192.168.3.2      yes       The ip of the client behing the BNAT router
   ININF     eth2             yes       The internal interface connected to the network
   OUTINF    eth1             yes       The external interface connected to the internet
   SERVERIP  1.1.2.1          yes       The ip of the server you are targeting

Advanced Options

Here is a complete list of advanced options supported by the bnat/bnat_router auxiliary module:

msf6 auxiliary(bnat/bnat_router) > show advanced

Module advanced options (auxiliary/bnat/bnat_router):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   VERBOSE    false            no        Enable detailed status messages
   WORKSPACE                   no        Specify the workspace for this module

Auxiliary Actions

This is a list of all auxiliary actions that the bnat/bnat_router module can do:

msf6 auxiliary(bnat/bnat_router) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

Here is the full list of possible evasion options supported by the bnat/bnat_router auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(bnat/bnat_router) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

References

See Also

Check also the following modules related to this module:

Authors

  • bannedit
  • Jonathan Claudius

Version

This page has been produced using Metasploit Framework version 6.1.27-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.