I have been following various tutorials in an attempt to get a meterpreter session on a lab VM, but I am having some problems triggering the payload.
I created the payload using veil (
I have an administrator hash that I have been unable to crack, so I used the
auxiliary/admin/smb/upload_file module in metasploit and used the hash. This copied the file to the C:\ on the target.
I then used
auxiliary/admin/smb/check_dir_file to confirm that the upload was successful and the file (setup1.exe) was found on the target where expected.
Finally I tried to use psexec_command with the command:
C:\setup1.exe to trigger the payload.
I had already set up a handler in metasploit to listen for the connection.
psexec_command gives me the following output when I run it:
[*] 192.168.XXX.XX:445 - Executing the command... [+] 192.168.XXX.XX:445 - Service start timed out, OK if running a command or non-service executable... [*] 192.168.XXX.XX:445 - checking if the file is unlocked [*] 192.168.XXX.XX:445 - Unable to get handle: The server responded with error: STATUS_SHARING_VIOLATION (Command=45 WordCount=0) [-] 192.168.XXX.XX:445 - Command seems to still be executing. Try increasing RETRY and DELAY [*] 192.168.XXX.XX:445 - Getting the command output... [*] 192.168.XXX.XX:445 - Command finished with no output [*] 192.168.XXX.XX:445 - Executing cleanup... [-] 192.168.XXX.XX:445 - Unable to cleanup \WINDOWS\Temp\pQmXEfWYhTIBaLOJ.txt. Error: The server responded with error: STATUS_SHARING_VIOLATION (Command=6 WordCount=0) [-] 192.168.XXX.XX:445 - Unable to cleanup. Maybe you'll need to manually remove true, false from the target. [*] 192.168.XXX.XX:445 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed
I am still a relative newbie and was hoping someone might be able to give me some pointers? I don't know if it is just that it is a lab vm, so may be purposefully more locked down than a real-world machine might be?
The payload created in veil (as I was following a tutorial) only used base64 encoding, and I wondered if it could be that the AV was still catching it? Maybe I need to use the obfuscated pyinstaller as well?
Also, does psexec need to be installed on the target for
psexec_command to work? I also came across wmic and wondered if that was worth a shot instead?
I am happy to keep doing my research, but if anyone had any pointers it would be much appreciated :-)