search

CounterHack / HolidayHack2017

SANS Holiday Hack Challenge 2017
1 stars 0 forks source link

Meterpreter session only worked once #22

Open januszjasinski opened 6 years ago

januszjasinski commented 6 years ago

Might have got lucky but got a meterpreter session yesterday to complete the phishing attack. Whilst I realise I can complete the task in other ways, I'd like to get meterpreter working again for my writeup.

Is this method now blocked as I can't get it back despite using same payload/exploit.

Thank you!

januszjasinski commented 6 years ago

Also with netcat. Seen some other issues stating it's been flaky but was hoping to use it, as mentioned, in my writeup. I've copied/pasted my output from the console to make sure it was exactly as I did it when it worked.

Copying the file to the webroot doesn't seem to be playing ball either since yesterday...

tkh16 commented 6 years ago

To the best of my knowledge, a Meterpreter should work, but we did make a lot of changes over the last 48 hours while trying to improve stability, so it's certainly possible that something changed (for example, anti-virus software could be blocking it that was previously disabled, or vice versa). I'll check with the rest of the team, but in the meantime, check again now that we've stabilized things and see if it's behaving more like you'd expect.

chrisjd20 commented 6 years ago

There was a time we turned of defender for testing purposes. It is now back on as intended.

Copying to web root worked just fine for me.

Netcat is a known issue. We didn’t find it until multiple concurrent sessions. So it’s limited when lots of people attempt to use it.

Command execution works all day long.

With that said, we did change a bit of code up so what one payload used to work may no longer though I don’t see that being very likely.

chrisjd20 commented 6 years ago

I just re validated 2 separate payloads that got me what the challenge calls for and both worked.