-1

I am performing the exploit,unix/webapp/wp_admin_shell_upload on wordshell website.

Here is the screenshot of the exploit options.

enter image description here

I managed to run the exploit. However when I want to download passwd file from the remote machine using meterpreter.

The result return blank.

Download result

Even I tried to view the passwd file from my Kali Linux, the passwd file is not there.May I know what is the cause of the problem. Other commands works such as getuid.

It shows me the result.

GETUID

  • 1
    maybe the user u are logged in as doesn't have the privileges to see those files, try getsystem command for privilege escalation – Bokis Feb 10 at 13:17
  • The getsystem command shows result unknown command – Abdullah Naina Feb 10 at 13:19
  • 2
    try to load the priv extension. "use priv" is the command to load it.After that try the "getsystem" command again – Bokis Feb 10 at 13:21
  • 1
    instead of downloading, can you show the contents of the file? – schroeder Feb 10 at 13:40
  • Yes, try cat /etc/passwd instead. – multithr3at3d Feb 10 at 21:40
0

I suppose you don't have the privileges to view the file. Execute

cd /etc
ls

in meterpreter. It will show you a column with r, w, and x es. This is the privilege column. You need to see three r letters next to the passwd file, then the file is world readable - /etc/passwd usually is.

By the way, getsystem only works on windows. You can try local_exploit_suggester module on linux, but privilege escalation is generally more difficult on linux. There are also a lot of privesc python and perl scripts on the web, try them, for example pentestmonkey's linuxprivesc.py

You can also try meterpreter shell command, and check for sudo and su.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.