2

I have been following various tutorials in an attempt to get a meterpreter session on a lab VM, but I am having some problems triggering the payload.

I created the payload using veil (setup1.exe).

I have an administrator hash that I have been unable to crack, so I used the auxiliary/admin/smb/upload_file module in metasploit and used the hash. This copied the file to the C:\ on the target.

I then used auxiliary/admin/smb/check_dir_file to confirm that the upload was successful and the file (setup1.exe) was found on the target where expected. Finally I tried to use psexec_command with the command: C:\setup1.exe to trigger the payload.

I had already set up a handler in metasploit to listen for the connection. psexec_command gives me the following output when I run it:

[*] 192.168.XXX.XX:445    - Executing the command...

[+] 192.168.XXX.XX:445    - Service start timed out, OK if running a command or non-service executable...

[*] 192.168.XXX.XX:445    - checking if the file is unlocked

[*] 192.168.XXX.XX:445    - Unable to get handle: The server responded with error: STATUS_SHARING_VIOLATION (Command=45 WordCount=0)

[-] 192.168.XXX.XX:445    - Command seems to still be executing. Try increasing RETRY and DELAY

[*] 192.168.XXX.XX:445    - Getting the command output...

[*] 192.168.XXX.XX:445    - Command finished with no output

[*] 192.168.XXX.XX:445    - Executing cleanup...

[-] 192.168.XXX.XX:445    - Unable to cleanup \WINDOWS\Temp\pQmXEfWYhTIBaLOJ.txt. Error: The server responded with error: STATUS_SHARING_VIOLATION (Command=6 WordCount=0)

[-] 192.168.XXX.XX:445    - Unable to cleanup. Maybe you'll need to manually remove true, false from the target.

[*] 192.168.XXX.XX:445    - Scanned 1 of 1 hosts (100% complete)

[*] Auxiliary module execution completed

I am still a relative newbie and was hoping someone might be able to give me some pointers? I don't know if it is just that it is a lab vm, so may be purposefully more locked down than a real-world machine might be?

The payload created in veil (as I was following a tutorial) only used base64 encoding, and I wondered if it could be that the AV was still catching it? Maybe I need to use the obfuscated pyinstaller as well?

Also, does psexec need to be installed on the target for psexec_command to work? I also came across wmic and wondered if that was worth a shot instead?

I am happy to keep doing my research, but if anyone had any pointers it would be much appreciated :-)

2
  • Since it is your lab vm, try just double clicking the executable on the VM, see if it works. That would rule out it being a Metasploit issue, unless your handler isn't setup correctly
    – mubix
    May 12, 2016 at 13:41
  • Thanks for the suggestion. It is on a lab network environment at work, so I don't have access to the VM myself. I can try putting it on a VM of my own though and see if I am at least doing the process correct in general.
    – Chris
    May 12, 2016 at 14:04

1 Answer 1

2

I think the problem was that I was using bind_tcp instead of reverse_tcp.

I guess this might not always be the solution depending on other factors like firewall etc? But in this case it worked.

(Also, as a PS - viewing the running processes after exploiting the VM showed all of the other executables running, so I think the problem was the connection back.)

1
  • Yes, then the problem was indeed that firewalls in general like incoming (ingress) connections a whole lot less then outgoing (egress)
    – J.A.K.
    Mar 9, 2017 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .