HackHub Ultimate Hacker Simulator HackHub Port Forwarding & NAT Guide

Reverse TCP payloads and external callbacks fail in HackHub Ultimate Hacker Simulator when your in-game router blocks inbound traffic. Port forwarding maps a WAN port on the victim’s or your edge router to an internal host and service port Metasploit expects. Randomized IPs and router models change every save, but the verification loop is always the same: configure Fern, save, rescan with nmap -sV, then exploit only after the port reads open.

When you need forwarding

Common triggers:

• Journalist chapters targeting Carl’s office PC or home lab with macro documents.
• Metasploit modules listing LHOST / LPORT requiring external reachability.
• Mail explicitly mentioning the Fern router admin app.
• Scans showing filtered until a NAT rule exists.

If exploit succeeds locally but no session opens, assume NAT misconfiguration before swapping modules.

Identify router credentials and model

Story loot and mail provide router brand or default password hints. Open Fern from the desktop and select the model matching your topology card. Login passwords may come from earlier hydra hits or plaintext files on compromised shares — check Downloads after every shell.

Never assume default admin passwords from web guides; use credentials discovered in your save.

Create forwarding rules in Fern

Although UI labels vary by model, every rule needs:

Field	Meaning
External port	WAN-side port Metasploit listens on or payload advertises
Internal IP	Private host from diagram (Carl-PC, not your player machine unless stated)
Internal port	Service port on that host (match nmap service)
Protocol	TCP for most Metasploit callbacks

Example intent (values are placeholders):

• Forward WAN 4444 → 192.168.x.x port 4444 TCP

Replace octets with addresses your map displays. Saving without enabling the rule is a frequent mistake — toggle enable if Fern exposes it.

Set Metasploit listener side

On your attack box:

msfconsole
use <payload-module-from-story>
set LHOST <your-ip-on-relevant-subnet>
set LPORT <external-port-you-forwarded>
show options
exploit -j

LHOST must be reachable from the victim network path — often your LAN IP toward the router, not 127.0.0.1. Documentary chapters split attacker and victim routers; read mail for which device needs the rule.

Verification with nmap

Before delivering a malicious document or running client-side exploits, scan the public endpoint associated with the forwarded host:

nmap <public-ip-from-diagram> -sV

Compare to a scan taken before forwarding. You want the forwarded service port to transition closed/filtered → open with a recognizable banner. No change means:

• Rule points at wrong private IP (player PC vs Carl).
• Internal port mismatch (forward 8080 while service listens 80).
• Fern config not saved or firewall sub-panel blocks WAN input.
• You scanned the wrong public IP on multi-WAN maps.

This before/after check is the single most reliable debug step in Journalist’s Sister.

Deliver payload after verification

Generate office macros or client binaries only once forwarding proof exists. Send via story mail, shared drive, or USB fiction as directed. Wait for session callback — Metasploit should show session opened.

If session opens then dies, check idle timeouts and restart exploit -j before regenerating files.

Double-router scenarios

Late maps chain hotel edge + home routers. You may need:

1. Forward on hotel gateway to Carl’s WAN.
2. Forward on Carl’s home router to his PC.

Work outward-in; verify each hop with targeted nmap against the hop’s public face.

hydra and admin panels

Some players crack Fern login via hydra on the router management port discovered separately. Template:

hydra -l admin -P <wordlist> <router-ip> http-post-form

Adjust module path per service from nmap -sV. Wordlists fund via How to Play contracts.

Interaction with Wi-Fi

You must sometimes join neighbor Wi-Fi (Wi-Fi and Hashcat) before Fern UI is reachable on the correct subnet. Layer attacks: association first, router admin second, Metasploit third.

Multiplayer note

Port forwarding puzzles are primarily solo story content. PvP maps may simplify NAT — see Multiplayer for mode rules.

Command reference

Forwarding itself is GUI-driven; surrounding recon uses CLI tools documented in Tools Commands. Keep Tools bookmarked for nmap port flags and Metasploit set syntax.

Automation caution

Workshop Scripts that pre-fill Fern fields must still read live IPs from your notes. Hard-coded forwards break next chapter.

Related guides

New players should understand baseline scans in Getting Started and keyboard flow in Controls before tackling dual-router chapters.