Re: Meterpreter shell error 7022

[c0lists <lists () carnal0wnage com>]

Windows Credentials Editor (WCE)

http://hexale.blogspot.com/2011/08/post-exploitation-with-wce-presentation.html
http://www.ampliasecurity.com/research.html

On Wed, Nov 16, 2011 at 10:37 AM, Jay <lists.infosec () gmail com> wrote:
> I wonder if this is a bug/limitation, the environment is mostly server 2003
> but I think the DC is 2008.  Nope, no process running.
>
> WCE?
>
> Thanks
>
> On Wed, Nov 16, 2011 at 9:28 AM, c0lists <lists () carnal0wnage com> wrote:
> > http://msdn.microsoft.com/en-us/library/windows/desktop/ms681389%28v=vs.85%29.aspx
> >
> > ERROR_CTX_WINSTATION_NOT_FOUND
> > 7022 (0x1B6E)
> >
> > The specified session cannot be found.
> >
> > sounds like there were some issues using the token.  is there a
> > process running as the user you want to be on the box that you can
> > migrate into instead?
> >
> > how bout WCE to dump the hashes of the user's token?
> >
> >
> >
> > On Wed, Nov 16, 2011 at 10:21 AM, Jay <lists.infosec () gmail com> wrote:
> > > Hello all, I am using incognito to impersonate a domain/enterprise admin
> > > and
> > > according to getuid it works fine. However when I try to get a shell by
> > > using the shell command or execute I get the following error.
> > > stdapi_sys_process_execute: Operation failed: 7022
> > >
> > > Any ideas? I ran across a post in February of last year with a guy
> > > having
> > > the same problem, but there wasn't a resolution. Link below.
> > >
> > > http://seclists.org/metasploit/2010/q1/139
> > >
> > > Thanks
> > >    Jay
> > >
> > > _______________________________________________
> > > https://mail.metasploit.com/mailman/listinfo/framework
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
>
>
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework