1

I'm trying to get access into a Windows 2000 server through the vulnerability MS03_026. An exploit is provided by Metasploit but I don't know why it isn't working. After filling the options (basically the RHOST) and running it, it just says "Sending exploit" and return the prompt. Port 135 is wide open.

Playing with payloads, only once it worked using a meterpreter/bind_tcp, but once connected, meterpreted didn't recognize any command (well, it did recognize help but didn't show anything).

meterpreter > cd C:
[-] Unknown command: cd.
meterpreter > help
meterpreter > pwd
[-] Unknown command: pwd.

Anyway, it's not working anymore, again with the "Sending exploit" and return to the prompt.

This vulnerability is widely known, and all the resources I see shown it properly working, so I don't know what the hell may be happening here.

Improve this question
1
  • this might be better placed in a metasploit forum
    – schroeder ♦
    Jun 5, 2014 at 17:12

1 Answer 1

Reset to default
1

Run the command

meterpreter > load stdapi

and then run the commands you are trying. If the stdapi extension itself fail to load, it means the payload didn't run successfully. The reason might be AV or another host protection or the SMB service itself might be too unstable. Restart the machine if you have attempted the exploit multiple times and then try it. Also, set the correct target using the set target option in the msfconsole.

Improve this answer
3
  • the problem is that after "Sending exploit" it returns to the prompt msf exploit(ms03_026_dcom) >. Only once it continued to the meterpreter.
    – user15194
    Jun 5, 2014 at 20:17
  • 1
    Are there any host based protections installed? AV? HIDS? Also, have you determined that the machine is vulnerable against the exploit? If you are not getting any response after "Sending exploit", it means the vulnerability was not triggered or the first stage got blocked.
    – void_in
    Jun 6, 2014 at 4:39
  • @yzT Assuming that you've got access to the machine at an OS level, if you haven't already, I'd try rebooting it before retrying the exploit. In some cases I've seen exploits that will only work once as they leave the vulnerable service in a hung/crashed state.
    – Rory McCune
    Jul 6, 2014 at 14:51

You must log in to answer this question.