The Ethical Hacker Network

timmedin

Sr. Member

Offline

Posts: 469

Re: metasploit

« Reply #15 on: May 29, 2009, 11:57:28 PM »

Ahh, good call. VNC is much quieter and you can jump into another session without the user knowing. The problem is, all your actions can be observed by someone sitting near the box. It is handy for seeing what the user is doing and monitoring what sites they may be accessing (admin page for firewall, phone system, etc). I still recommend the command line for the vast majority of tasks since it is much quieter and very powerful, especially when you script some of your tasks. Take a look at the meterpreter WinEnum script by DarkOperator:
http://darkoperator.blogspot.com/2008/11/re-wrote-winenum-and-added-new-features.html

I just came across Dark Operator's blog post on getting terminal from a shell. Much more in depth and elegant than what I posted above.
http://darkoperator.blogspot.com/2009/02/how-to-get-terminal-from-shell-in.html


	Logged

twitter.com/timmedin | http://blog.securitywhole.com

viruz

Jr. Member

Offline

Posts: 50

Re: metasploit

« Reply #16 on: May 30, 2009, 12:11:38 AM »

thanks for ur prompt reply bro, quite interesting, i already took a loot at the Darkoperator blogspot about getting terminal from shell, but when i run the command, netsh firewall set opmode mode=DISABLE it says invalid, unknown command firewall set opmode and like that...i think your earlier post is quite easier though and combining both will be great.

Yea vnc is good to see what the user is running and doing at the moment, what do you think uploading a RAT


	Logged

timmedin

Sr. Member

Offline

Posts: 469

Re: metasploit

« Reply #17 on: May 30, 2009, 12:21:24 AM »

When doing a pen test using the built in features helps you fly under the radar. While a RAT would be good for keeping access, it may flag on AV or HIPS and your pen test could be interrupted.

Also, when you are typing those commands, make sure you have a shell. It won't work from the meterpreter prompt.


	Logged

twitter.com/timmedin | http://blog.securitywhole.com

viruz

Jr. Member

Offline

Posts: 50

Re: metasploit

« Reply #18 on: May 30, 2009, 12:32:04 AM »

thanks for your great support,
i did run the command on the shell not meterpreter,

C:\WINDOWS\system32>netsh firewall set opmode=DISABLE
netsh firewall set opmode=DISABLE
The following command was not found: firewall set opmode=DISABLE.

C:\WINDOWS\system32>

that is what i get

C:\WINDOWS\system32>netsh firewall set portopening TCP 3389 RDP Enable
netsh firewall set portopening TCP 3389 RDP Enable
The following command was not found: firewall set portopening TCP 3389 RDP Enable.

C:\WINDOWS\system32>

what do u think might be wrong, or its the target pc missing somethings? its just a win xp with nothing on it, i got it for practical purpose maybe its the one with the fault or......?

i am looking at the blogspots u gave now

I went through the sites and the http://darkoperator.blogspot.com/2008/11/re-wrote-winenum-and-added-new-features.html was good, but i took a look at the meterpreter scripts on there and almost all were said to be on metasploit project now, if so wy do i keep getting invalid syntax then.

I GOT TO SEE NOW THAT THE SCRIPTS ARE IN THE FRAMEWORK3 BUT I AM USING FRAMEWORK2 WHICH I DO NOT SEE SCRIPTS IN THE DIRECTORY...MAYBE THE CAUSE.

THANKS FOR ALL YOUR ADVICE.


« Last Edit: May 30, 2009, 01:30:01 AM by viruz »	Logged

timmedin

Sr. Member

Offline

Posts: 469

Re: metasploit

« Reply #19 on: May 30, 2009, 09:06:36 AM »

From what I googled it looks like the firewall isn't installed, but I thought it was installed in XP, just not automatically enabled until SP2. Either that or you don't have privileges to modify it. I dunno.

Also, you may want to get MetaSploit 3. There are quite a few differences between them, and I believe that scripting works differently in each version.


	Logged

twitter.com/timmedin | http://blog.securitywhole.com

viruz

Jr. Member

Offline

Posts: 50

Re: metasploit

« Reply #20 on: May 30, 2009, 10:07:01 AM »

yea..thanks for ur great comment, it actually said it all..i mean all. i cannot penetrate using the metasploit 3 that was while i use the metasploit 2 instead and i got it, i actually DIS - ACTIVATED the windows firewall myself, maybe that is just the cause as you have said..... which i believe it is.

thanks brother i appreciate alot.
God bless


	Logged

Ketchup

Hero Member

Offline

Posts: 1021

Re: metasploit

« Reply #21 on: June 01, 2009, 10:50:06 PM »

viruz, I am little late with this. It's been crazy at work.

Sorry, try this syntax for the commands. netsh is very sensitive about spacing and case.

netsh firewall set opmode ENABLE

netsh firewall set portopening TCP 3389 RDP ENABLE

Notice that the ENABLE commands are in all caps. When in doubt, just drop into netsh without any options. That opens an interactive prompt. You can then just type help for the command listing.


	Logged

~~~~~~~~~~~~~~
Ketchup

timmedin

Sr. Member

Offline

Posts: 469

Re: metasploit

« Reply #22 on: June 02, 2009, 09:39:48 AM »

Only string parameters are case sensitive, the rest is not. So if you add the rule:
netsh firewall set port opening tcp 3389 RDP enable
and then want to modify the new RDP rule you have to use the same case so Rdp or rdp will not work.


	Logged

twitter.com/timmedin | http://blog.securitywhole.com

viruz

Jr. Member

Offline

Posts: 50

Re: metasploit

« Reply #23 on: June 02, 2009, 09:02:12 PM »

Ketchup and timmedin,

i am really really appreciative of your guidance, i am grateful bro...i got it all working now,. i enabled the RDP protocol now and to disable the protocol in other not to leave the system more vulnerable will be netsh firewall set portopening TCP 3389 RDP disable.
really grateful, still are there some particular backdoor that cannot be uploaded using meterpreter? or tftp? i was able to download and upload from the shell or through meterpreter but if i try to upload a kind of RAT to the victim, it aborts and tells me file not found, i created the server in the root directory and copied it to /tmp directory, if i try to upload the file i get file not found as answer even if AV is disabled. does it means that the shell via tftp and meterpreter do not upload all files?

the RAT i used was sub seven. thanks for your response


	Logged

former33t

Full Member

Offline

Posts: 226

Re: metasploit

« Reply #24 on: June 02, 2009, 09:15:47 PM »

Sounds to me like your target is running AV of some sort. SubSeven is probably being immediately detected and removed by any security product on the machine. I'm betting that even with the AV "disabled" you are still running into problems with security software of some sort. Windows defender, anti-spyware, something?

Take a look at your running services. If you own the machine and can get to the console, try adding an exception for the directory you are uploading the RAT to. Copy the file locally to the folder and verify that the file isn't quarantined, etc.

I thought I had AVG "disabled" for some time, but it kept eating Poison Ivy and sending it to quarantine...


	Logged

Certifications: CREA, MCSE: Security, CCNA, Security+, other junk

Ketchup

Hero Member

Offline

Posts: 1021

Re: metasploit

« Reply #25 on: June 02, 2009, 09:44:14 PM »

I agree with former33t. Disabling AV itself often does not disable it's script execution blocking routines, etc. Norton and McAfee especially fall into this category. They are a bit like malware themselves.


	Logged

~~~~~~~~~~~~~~
Ketchup

viruz

Jr. Member

Offline

Posts: 50

Re: metasploit

« Reply #26 on: June 02, 2009, 11:09:15 PM »

i understand it now, yea i have access to the target machine, i will do as you have said and see what happens
thanks


	Logged

rebrov

Full Member

Offline

Posts: 130

Re: metasploit

« Reply #27 on: July 20, 2009, 11:59:39 AM »

Quote from: viruz on May 28, 2009, 03:04:38 PM

i am having a little trouble with metasploit, i tried to penetrate my windows xp box with the RPC exploit code and after a successful connection using meterpreter, all it could do was say connection reset by peer, like below, what could be the cause of this problem, anyone with ideas please?

*] Sending stage (2650 bytes)

Sleeping before handling stage...
Uploading DLL (75787 bytes)...
Upload completed.
Meterpreter session 1 opened (192.168.*.*:52376 -> 192.168.*.*:27991)

excuse me dude can i ask question i tried to penetrate via this port be4 135 RPC but it couldn't done why can u tell me which exploit and payload u use for windows xp ??

cuz maybe mine is old exploit


	Logged

lincoln

Newbie

Offline

Posts: 13

Re: metasploit

« Reply #28 on: July 20, 2009, 04:21:18 PM »

Quote from: rebrov on July 20, 2009, 11:59:39 AM

Quote from: viruz on May 28, 2009, 03:04:38 PM

Sleeping before handling stage...
Uploading DLL (75787 bytes)...
Upload completed.
Meterpreter session 1 opened (192.168.*.*:52376 -> 192.168.*.*:27991)

Which exploit are you trying?
Firewall turned off?
Which SP? Has the box been patched recently?


	Logged

rebrov

Full Member

Offline

Posts: 130

Re: metasploit

« Reply #29 on: July 20, 2009, 06:31:03 PM »

Quote from: lincoln on July 20, 2009, 04:21:18 PM

Quote from: rebrov on July 20, 2009, 11:59:39 AM

Quote from: viruz on May 28, 2009, 03:04:38 PM

Sleeping before handling stage...
Uploading DLL (75787 bytes)...
Upload completed.
Meterpreter session 1 opened (192.168.*.*:52376 -> 192.168.*.*:27991)

Which exploit are you trying?
Firewall turned off?
Which SP? Has the box been patched recently?

this exploits : windows/dcerpc/ms03_026_dcom

and this payload : windows/meterpreter/reverse_tcp

and thats wat i got :

msf exploit(ms03_026_dcom) > exploit

Started reverse handler
Trying target Windows NT SP3-6a/2000/XP/2003 Universal...
Binding to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:10.0.0.100[135] ...
Bound to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:10.0.0.100[135] ...
Sending exploit ...

Exploit completed, but no session was created.

and wat firewall u mean ..? mine or the RHOST ?

Which SP? Has the box been patched recently

if that wat u meant

i tried it on xp sp2 and sp3 same resultes

i dont know wat u mean by already patched


	Logged

Pages: 1 [2] 3 Go Up

« previous next »