4

Curious if any of you have an answer to this Metasploit question. It's an issue of a Metasploit session within another Metasploit session.

In this lab I'm doing, I need to compromise a machine (10.10.50.8) and then use it to pivot to another machine (10.10.51.21). I spark up Metasploit (instance #1) and get a Meterpreter session going on 10.10.50.8. I use plink to setup a reverse ssh connection on port 21 to a ssh server on my Kali box. That gives me a new bash shell where I can now do things like nmap 127.0.0.1 from my Kali VM to probe 10.10.51.21's FTP port. All good so far.

Now that I have the reverse ssh connection, I can access 10.10.51.21 via localhost. I spark up a new instance of Metasploit (instance #2) and attack 10.10.51.21 using exploit/freebsd/ftp/proftp_telnet_iac. I launch the attack and get a message about a port conflict followed by an exploit failed message. So I had to background Metasploit session #2 so I could determine the port conflict. I go back to Metasploit session #1 and sure enough port 4444 was being used when I compromised 10.10.50.8. With that I went back into my Meterpreter session to get back to Metasploit session #2 (to compromise the 10.10.51.21) and couldn't figure out how to get back to it. Running sessions -l only shows the Meterpreter session used to compromise 10.10.50.8.

Anyone know how?

And yeah this is a little bit of Inception going on here. :)

Improve this question
5
  • 1
    Why not use sshuttle for pivoting? This makes it more transparent (TCP only though). If 10.10.50.8 is compromised, you can use these SSH credentials in order to use sshuttle. The machine 10.10.51.21 should be available to metasploit directly over TCP only.
    – Jeroen
    Commented Mar 1, 2019 at 21:10
  • Thanks @Jeroen-ITNerdbox. This was more of an experiment in trying to get a reverse ssh connection established. In terms of sshuttle, interestingly enough I was having a chat w/ the creator over Twitter and he confirmed that I would need to have a ssh server (or some TCP server) to connect to in order to use sshuttle. I was hoping to use it via a Meterpreter session but couldn't figure out how to do it. The box 10.10.50.8 didn't have an ssh server running which is why I dropped plink.exe on it and connected back to my Kali VM's ssh server.
    – Rey Bango
    Commented Mar 1, 2019 at 23:12
  • 1
    But if you compromised the host, you could (technically) install an SSH server. Just trying to think along.
    – Jeroen
    Commented Mar 1, 2019 at 23:20
  • Yeah I know. I was hoping to be able to use sshuttle through a Meterpreter shell w/out having to install an ssh server on the compromised box. No biggee :)
    – Rey Bango
    Commented Mar 3, 2019 at 1:30
  • You can also use the following command to run Meterpreter commands on background sessions: sessions -C
    – heybmcgill
    Commented Oct 16, 2019 at 0:09

2 Answers 2

Reset to default
6

Commands are updated now and channel -i doesn't work anymore.

Use the following commands to get session back: sessions -i* to view the available sessions id's.
Let's say meterpreter session id is 1, then the following command: sessions -i 1 will get you your session back.

Improve this answer
2

Regarding the original question, I found the answer to how to restore the backgrounded session. I have to use channel -i <channel id> to get back to the specific backgrounded session.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .