I'm trying to upload nc.exe on a Windows 7 system, after having exploited it by using: exploit/windows/fileformat/ms15_100_mcl_exe.

After obtaining the session:

sessions –l
sessions –i 1

I issued the following command to upload the nc.exe:

upload /usr/share/windows-binaries/nc.exe C:\\windows\\system32

but it didn't work, and I got the following error message:

[*] uploading  : /usr/share/windows-binaries/nc.exe -> C:\windows\system32
[-] core_channel_open: Operation failed: Access is denied.

I've also tried other meterpreter commands, and I can say that some commands work, while others don't. For instance:

  • getuid works
  • getsystem doesn't work
  • shell works

Note: I've previously disabled the Windows 7 firewall.

  • 1
    That probably happens because simply you don't have the right permissions to upload your .exe to this particular directory - that's why you get "Access is denied". – game0ver Nov 3 '18 at 19:40

You’ll need to elevate your privileges on the target through another exploit. You won’t simply get NT AUTHORITY/SYSTEM just because you’ve got a meterpreter session. Try using your shell to send a MSFVenom .exe that will give you UAC Bypass and another Meterpreter. Use that new Meterpreter exploiting the UAC Bypass to getsystemand you’ll get the NT AUTHORITY every time.

You’ll also want to take advantage of Mimikatz while you have a session open. Make sure you grab any hashes you can to crack offline to further future persistence.

  • You’re welcome! There’s a few guides out there that tend to make this challenge a little easier than it is. To truly understand how Windows Internals work from a remote exploitable standpoint. It’s best to start with a basic shell elevate yourself by chaining exploits to get to NT AUTHORITY. You’ll have a much better understanding of exploitation, and pivoting undetected when you start using your sessions to lateral pivot to more machines across a network. – user847763 Nov 5 '18 at 1:56

That's as simple as you don't have permissions to write on that folder. Probably, your meterpreter is got under a low priv account. Try to upload to a directory where the user is able to write (maybe it's home dir).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.