Getting db_autopwn to work in a NAT'ed environment

[theysaid () hush com]

Hi folks.
How is it so possible to achieve WAN-wide mass scans in an 
environment in which (1) the user is behind a NAT router, and (2) 
the user wants to utilize a reverse tcp payload.

First comes a typical network setup:
Internet <=> Router (WAN IP) <=> BT4 (192.168.2.10)
Incoming TCP/443 packets destined to WAN IP is forwarded to BT4 
machine..

When we create our own payload with msfpayload, we can specify our 
WAN IP and WAN PORT(443,in this case) and then within msfconsole, 
we configure the handler to bind to our internal ip which is, in 
this case, 192.168.2.10. When the payload is executed from anywhere 
else, we are able to obtain a meterpreter session.

Here comes the problem:
But this will NOT work when using exploits or launching db_autopwn 
with the reverse_tcp payload because we are obliged to set LHOST to 
our internal ip for handler to bind to this ip and unfortunately, 
msf will "again" use this LHOST value in exploit's payload and when 
we launch an exploit then the RHOST will try to connect to the 
internal ip that we've set..

I am looking forward to your opinions and workarounds on this.
Thanks. 

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework