2

I am trying to run this exploit through metasploit, all done on the same Kali Linux VM. I am trying to attack from my VM to the same VM.

https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/unix/webapp/wp_admin_shell_upload.md

kali linux system(latest) apache: Server version: Apache/2.4.46 (Debian), Server built: 2021-01-11T10:58:23 mariadb: mariadb Ver 15.1 Distrib 10.5.8-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper PHP: PHP 7.4.11 (cli) (built: Oct 6 2020 10:34:39) ( NTS )

Wordpress: version 5.0.11, No plugins

Metasploit: metasploit v6.0.16-dev

exploit: unix/webapp/wp_admin_shell_upload

PASSWORD: REDACTED1

RHOSTS: 192.168.116.128 (ip a: lo: ... eth0: inet 192.168.116.128/24

TARGETURI /wordpress/ (Wordpress directory: /var/www/html/wordpress)

USERNAME: REDACTED4

LHOST: 192.168.116.128

It's the same, because I am trying to do the exploit from my local metasploit to the same Virtual Machine, all at once.

show targets:
0  Wordpress

set target 0
sh: 0: getcwd() failed: No such file or directory
target => 0

msf6 exploit(unix/webapp/wp_admin_shell_upload) > run
sh: 0: getcwd() failed: No such file or directory

[*] Started reverse TCP handler on 192.168.116.128:4444 
[*] Authenticating with WordPress using admin:password1234...
[+] Authenticated with WordPress
[*] Preparing payload...
[*] Uploading payload...
[-] Exploit aborted due to failure: unexpected-reply: Failed to upload the payload
[*] Exploit completed, but no session was created.

So, obviously I am doing something wrong. Can somebody help me out?

Improve this question
10
  • This isn't a security question but a networking question. And to get around this problem, instead of installing target services on your attacking VM, you should spin up a new VM to install all your target services on. Then you will have a much more straightforward approach to learning all this stuff without needing to constantly devise workarounds.
    – schroeder ♦
    Feb 28, 2021 at 9:07
  • @schroeder Thanks for the answer. Did that and the problem persists. Any ideas as to why might be the problem?
    – oolnux
    Feb 28, 2021 at 11:31
  • Not without more info. The target may not be vulnerable. There may still be networking issues. You need to start a troubleshooting process to confirm what is working properly and what is not. Get logs from the target (which is now easier since it is a separate VM)
    – schroeder ♦
    Feb 28, 2021 at 11:33
  • What are the most common problems that indicate that the target is not vulnerable? Also, what kind of platform should the target be? Ubuntu, kali? How can I make it totally vulnerable? Just remember that "because this is authenticated code execution by design, it should work on all versions of WordPress"
    – oolnux
    Feb 28, 2021 at 11:55
  • frewalls, networking blocks, etc.
    – schroeder ♦
    Feb 28, 2021 at 12:03

0

Reset to default

Browse other questions tagged .