2

After spawning a meterpreter session from the target Windows 7 system I wanted to search for all the files with sub-string "clue" in in their name. As search -f "*clue*" took a long time to complete, I found it a waste of time. I want to know if it's possible to make it a background task somehow and get the meterpreter prompt back?

I tried my luck with Google but it only shows results for Meterpreter's background command which sends the entire session to background and gives us the msf prompt.

2

Here are three ideas to consider:

  • Use bgrun with search_dwld.rb
  • Use file_collector.rb
  • Create your own script

bgrun

The best solution I can find for this is to use the command bgrun. As the Metasploit script states,

"bgrun" => "Executes a meterpreter script as a background thread"

Bgrun executes a script in a background thread, however the search command can't be used with bgrun. The closest script I can find to the search command is search_dwld. Search_dwld works in a similar way to search and also downloads the files that have been found.

The usage for search_dwld is as follows:

search_dwld -- recursively search for and download files matching a given pattern

USAGE: run search_dwld [base directory] [filter] [pattern]

filter can be a defined pattern or 'free', in which case pattern must be given

Defined patterns:

$filters.keys.sort.collect{|k|"\t#{k}"}.join("\n")

Examples: run search_dwld

=> recursively look for (MS|Open)Office in C:\

run search_dwld %USERPROFILE% win9x

=> recursively look for *.PWL files in the user home directory

run search_dwld E:\\ free '.(jpg|png|gif)$'

=> recursively look for pictures in the E: drive

You can use search_dwld with bgrun like this:

bgrun search_dwld

File Collector

Another option is the file_collector script. As the link above states,

Meterpreter Script for searching and downloading files that match a specific pattern. First save files to a file, edit and use that same file to download the choosen files.

file_collector is a three part process. First we create the file list, then we remove any files we don't want from the list, then we execute the download process. Here is a guide on how to use file_collector.

You can also use file_collector with bgrun as stated earlier with search_dwld:

bgrun file_collector

Create script

Another alternative is to make your own script in Ruby which searches for files.

bgrun searchScript.rb

This could actually be a good solution as you can make the script fit your exact needs.

  • will this work with a post module? for instance run post/windows/gather/some-script if not how can I background a post module – AK_ Mar 7 '18 at 18:36
  • As far as I am aware of, no. bgrun only works on Ruby scripts and can't execute post modules. I suppose you could run the post module, background the session and open a new session? – Joe Mar 7 '18 at 18:45
  • how would you do that? bcz run kinda blocks everything, unless there is a key combination like bash's ctrl+z – AK_ Mar 8 '18 at 10:07
  • Yes, ctrl+z is the same as background command – Joe Mar 8 '18 at 11:23
  • that backgrounded the whole metasploit framework, not what I inteded to do. I meant I wanted to background only that script – AK_ Mar 8 '18 at 11:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.