Re: Meterpreter shell error 7022

[Jay <lists.infosec () gmail com>]

Thanks, have not heard of that before, I will take a look.

Funny thing is I just got into another server, same OS, impersonated the
same user, and shell worked just fine. Guess its not a domain thing, must
be server specific.

On Wed, Nov 16, 2011 at 9:46 AM, c0lists <lists () carnal0wnage com> wrote:

> Windows Credentials Editor (WCE)
>
>
> http://hexale.blogspot.com/2011/08/post-exploitation-with-wce-presentation.html
> http://www.ampliasecurity.com/research.html
>
> On Wed, Nov 16, 2011 at 10:37 AM, Jay <lists.infosec () gmail com> wrote:
> > I wonder if this is a bug/limitation, the environment is mostly server
> 2003
> > but I think the DC is 2008.  Nope, no process running.
> >
> > WCE?
> >
> > Thanks
> >
> > On Wed, Nov 16, 2011 at 9:28 AM, c0lists <lists () carnal0wnage com> wrote:
> > >
> http://msdn.microsoft.com/en-us/library/windows/desktop/ms681389%28v=vs.85%29.aspx
> > > ERROR_CTX_WINSTATION_NOT_FOUND
> > > 7022 (0x1B6E)
> > >
> > > The specified session cannot be found.
> > >
> > > sounds like there were some issues using the token.  is there a
> > > process running as the user you want to be on the box that you can
> > > migrate into instead?
> > >
> > > how bout WCE to dump the hashes of the user's token?
> > >
> > >
> > >
> > > On Wed, Nov 16, 2011 at 10:21 AM, Jay <lists.infosec () gmail com> wrote:
> > > > Hello all, I am using incognito to impersonate a domain/enterprise
> admin
> > > > and
> > > > according to getuid it works fine. However when I try to get a shell
> by
> > > > using the shell command or execute I get the following error.
> > > > stdapi_sys_process_execute: Operation failed: 7022
> > > >
> > > > Any ideas? I ran across a post in February of last year with a guy
> > > > having
> > > > the same problem, but there wasn't a resolution. Link below.
> > > >
> > > > http://seclists.org/metasploit/2010/q1/139
> > > >
> > > > Thanks
> > > >    Jay
> > > >
> > > > _______________________________________________
> > > > https://mail.metasploit.com/mailman/listinfo/framework
> > > _______________________________________________
> > > https://mail.metasploit.com/mailman/listinfo/framework
> >
> >
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework