Netcat and Armitage issue

[kcart]

Dear Backtrack users,

I have a little issue and I hope to find a solution with your help. So please find below from where the problem is coming:
1. I have a windows xp box behind a router;
2. A netcat application connects from the windows box to a Backtrack5 box(having an external IP) via Internet;
3. I receive that connection using Armitage(Listeners --> Reverse(wait for) --> shell) and I get a shell.
Everything is ok so far but now I would like to obtain a meterpreter connection and I don't know how to do this(I mention that if using Armitage(Listeners --> Reverse(wait for) --> meterpreter) that's not working, I mean that nothing happen after I start netcat connection on windows box.
This is my problem and I want to let you know that I remain grateful for any replay.

Kind regards,

G

[raffi]

You have the right idea using Listeners --> Reverse (wait for) --> shell to receive a netcat callback. However, when you use this same mechanism to create a Meterpreter listener, Metasploit is now expecting Meterpreter to call back--not a plain netcat shell.

All is not lost though, give yourself a callback with netcat (like you did),and right-click the host that shows up in Armitage and navigate to Shell N -> Upgrade to Meterpreter. Metasploit will then try to upload and execute meterpreter through your existing netcat shell. This doesn't always work though. In my experience it failed about 50% of the time. I'm not sure why. It's worth a try though.

[kcart]

Hello raffi,
Thank you for the time spent to reply to my message.
Unfortunately, the problem is not as simple as it seems to be... I want to say that I don't know where that "Shell N" is(pls see the picture below).
BT.JPG
I wonder if there is a problem with my Armitage or I just missed something(this thought drives me crazy).
Brgds,

G.

[raffi]

That's an interesting "screenshot". The menu is Shell N where N is a number. Armitage takes each session from Metasploit and creates a menu attached to the appropriate host with the name [session type] [N]. Now that you can find Shell N (it's at the top of your menu), you'll notice that the Meterpreter upgrade menu is not there. Armitage only shows this against what it knows are Windows hosts. So right-click the compromised host, go to Operating System, and set it to Windows (it doesn't matter which flavor). Then you can go to the Shell N menu and select the Meterpreter menu option. I don't remember what Armitage calls it though. And like I said earlier, this option is flakey, so it may work or it may bomb. If this doesn't work, then you'll have to generate a meterpreter executable, get it on the box somehow, and then execute it through your netcat shell.

If you're able to execute something other than a netcat callback on the host, just use Armitage to generate a reverse TCP meterpreter executable, create a listener (you know how to do this), and run that.

I recommend reading the Armitage documentation too. This will help you understand the tool better: http://www.fastandeasyhacking.com/manual

[kcart]

Hello raffi,

You're right, if I don't declare the OS of the box, the meterpreter won't never show up in the "Shell N"(I finally found out what "Shell N" is) list.
Thank you for your patience.

Rgds,

G.