2

I have been following various tutorials in an attempt to get a meterpreter session on a lab VM, but I am having some problems triggering the payload.

I created the payload using veil (setup1.exe).

I have an administrator hash that I have been unable to crack, so I used the auxiliary/admin/smb/upload_file module in metasploit and used the hash. This copied the file to the C:\ on the target.

I then used auxiliary/admin/smb/check_dir_file to confirm that the upload was successful and the file (setup1.exe) was found on the target where expected. Finally I tried to use psexec_command with the command: C:\setup1.exe to trigger the payload.

I had already set up a handler in metasploit to listen for the connection. psexec_command gives me the following output when I run it:

[*] 192.168.XXX.XX:445    - Executing the command...

[+] 192.168.XXX.XX:445    - Service start timed out, OK if running a command or non-service executable...

[*] 192.168.XXX.XX:445    - checking if the file is unlocked

[*] 192.168.XXX.XX:445    - Unable to get handle: The server responded with error: STATUS_SHARING_VIOLATION (Command=45 WordCount=0)

[-] 192.168.XXX.XX:445    - Command seems to still be executing. Try increasing RETRY and DELAY

[*] 192.168.XXX.XX:445    - Getting the command output...

[*] 192.168.XXX.XX:445    - Command finished with no output

[*] 192.168.XXX.XX:445    - Executing cleanup...

[-] 192.168.XXX.XX:445    - Unable to cleanup \WINDOWS\Temp\pQmXEfWYhTIBaLOJ.txt. Error: The server responded with error: STATUS_SHARING_VIOLATION (Command=6 WordCount=0)

[-] 192.168.XXX.XX:445    - Unable to cleanup. Maybe you'll need to manually remove true, false from the target.

[*] 192.168.XXX.XX:445    - Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

I am still a relative newbie and was hoping someone might be able to give me some pointers? I don't know if it is just that it is a lab vm, so may be purposefully more locked down than a real-world machine might be?

The payload created in veil (as I was following a tutorial) only used base64 encoding, and I wondered if it could be that the AV was still catching it? Maybe I need to use the obfuscated pyinstaller as well?

Also, does psexec need to be installed on the target for psexec_command to work? I also came across wmic and wondered if that was worth a shot instead?

I am happy to keep doing my research, but if anyone had any pointers it would be much appreciated :-)

  • Since it is your lab vm, try just double clicking the executable on the VM, see if it works. That would rule out it being a Metasploit issue, unless your handler isn't setup correctly – mubix May 12 '16 at 13:41
  • Thanks for the suggestion. It is on a lab network environment at work, so I don't have access to the VM myself. I can try putting it on a VM of my own though and see if I am at least doing the process correct in general. – Chris May 12 '16 at 14:04
2

I think the problem was that I was using bind_tcp instead of reverse_tcp.

I guess this might not always be the solution depending on other factors like firewall etc? But in this case it worked.

(Also, as a PS - viewing the running processes after exploiting the VM showed all of the other executables running, so I think the problem was the connection back.)

  • Yes, then the problem was indeed that firewalls in general like incoming (ingress) connections a whole lot less then outgoing (egress) – J.A.K. Mar 9 '17 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.