0

Curious if any of you have an answer to this Metasploit question. It's an issue of a Metasploit session within another Metasploit session.

In this lab I'm doing, I need to compromise a machine (10.10.50.8) and then use it to pivot to another machine (10.10.51.21). I spark up Metasploit (instance #1) and get a Meterpreter session going on 10.10.50.8. I use plink to setup a reverse ssh connection on port 21 to a ssh server on my Kali box. That gives me a new bash shell where I can now do things like nmap 127.0.0.1 from my Kali VM to probe 10.10.51.21's FTP port. All good so far.

Now that I have the reverse ssh connection, I can access 10.10.51.21 via localhost. I spark up a new instance of Metasploit (instance #2) and attack 10.10.51.21 using exploit/freebsd/ftp/proftp_telnet_iac. I launch the attack and get a message about a port conflict followed by an exploit failed message. So I had to background Metasploit session #2 so I could determine the port conflict. I go back to Metasploit session #1 and sure enough port 4444 was being used when I compromised 10.10.50.8. With that I went back into my Meterpreter session to get back to Metasploit session #2 (to compromise the 10.10.51.21) and couldn't figure out how to get back to it. Running sessions -l only shows the Meterpreter session used to compromise 10.10.50.8.

Anyone know how?

And yeah this is a little bit of Inception going on here. :)

  • 1
    Why not use sshuttle for pivoting? This makes it more transparent (TCP only though). If 10.10.50.8 is compromised, you can use these SSH credentials in order to use sshuttle. The machine 10.10.51.21 should be available to metasploit directly over TCP only. – Jeroen Mar 1 at 21:10
  • Thanks @Jeroen-ITNerdbox. This was more of an experiment in trying to get a reverse ssh connection established. In terms of sshuttle, interestingly enough I was having a chat w/ the creator over Twitter and he confirmed that I would need to have a ssh server (or some TCP server) to connect to in order to use sshuttle. I was hoping to use it via a Meterpreter session but couldn't figure out how to do it. The box 10.10.50.8 didn't have an ssh server running which is why I dropped plink.exe on it and connected back to my Kali VM's ssh server. – Rey Bango Mar 1 at 23:12
  • 1
    But if you compromised the host, you could (technically) install an SSH server. Just trying to think along. – Jeroen Mar 1 at 23:20
  • Yeah I know. I was hoping to be able to use sshuttle through a Meterpreter shell w/out having to install an ssh server on the compromised box. No biggee :) – Rey Bango Mar 3 at 1:30
  • You can also use the following command to run Meterpreter commands on background sessions: sessions -C – heybmcgill yesterday
1

Regarding the original question, I found the answer to how to restore the backgrounded session. I have to use "channel -i " to get back to the specific backgrounded session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.