Hi. I have gotten a meterpreter session on my W8.1 x64 machine. I cant use getsystem and some other good stuff and i figured it was because of the meterpreter being x86. So I wanted to use payload inject to get a x64 meterpreter instead, which failed because it could not get a proper PID. When i use ps in meterpreter it shows very little processes. Where am I going wrong?
Forum Thread: payload_inject and Processes Shown in Meterpreter
- Hot
- Active
-
Forum Thread: When My Kali Linux Finishes Installing (It Is Ready to Boot), and When I Try to Boot It All I Get Is a Black Screen. 8 Replies
6 days ago -
Forum Thread: HACK ANDROID with KALI USING PORT FORWARDING(portmap.io) 12 Replies
2 wks ago -
Forum Thread: Hydra Syntax Issue Stops After 16 Attempts 2 Replies
1 mo ago -
Forum Thread: Hack Instagram Account Using BruteForce 208 Replies
1 mo ago -
Forum Thread: Metasploit reverse_tcp Handler Problem 47 Replies
2 mo ago -
Forum Thread: How to Train to Be an IT Security Professional (Ethical Hacker) 22 Replies
3 mo ago -
Metasploit Error: Handler Failed to Bind 41 Replies
3 mo ago -
Forum Thread: How to Hack Android Phone Using Same Wifi 21 Replies
3 mo ago -
How to: HACK Android Device with TermuX on Android | Part #1 - Over the Internet [Ultimate Guide] 177 Replies
3 mo ago -
How to: Crack Instagram Passwords Using Instainsane 36 Replies
3 mo ago -
Forum Thread: How to Hack an Android Device Remotely, to Gain Acces to Gmail, Facebook, Twitter and More 5 Replies
3 mo ago -
Forum Thread: How Many Hackers Have Played Watch_Dogs Game Before? 13 Replies
4 mo ago -
Forum Thread: How to Hack an Android Device with Only a Ip Adress 55 Replies
4 mo ago -
How to: Sign the APK File with Embedded Payload (The Ultimate Guide) 10 Replies
5 mo ago -
Forum Thread: How to Run and Install Kali Linux on a Chromebook 18 Replies
5 mo ago -
Forum Thread: How to Find Admin Panel Page of a Website? 13 Replies
6 mo ago -
Forum Thread: can i run kali lenux in windows 10 without reboting my computer 4 Replies
6 mo ago -
Forum Thread: How to Hack School Website 11 Replies
6 mo ago -
Forum Thread: Make a Phishing Page for Harvesting Credentials Yourself 8 Replies
6 mo ago -
Forum Thread: Creating an Completely Undetectable Executable in Under 15 Minutes! 38 Replies
8 mo ago
-
How To: Find Identifying Information from a Phone Number Using OSINT Tools
-
How To: Dox Anyone
-
How To: Write an XSS Cookie Stealer in JavaScript to Steal Passwords
-
How To: Use Burp & FoxyProxy to Easily Switch Between Proxy Settings
-
How To: Check if Your Wireless Network Adapter Supports Monitor Mode & Packet Injection
-
How To: Use Kismet to Watch Wi-Fi User Activity Through Walls
-
How To: Make Your Own Bad USB
-
How To: Brute-Force Nearly Any Website Login with Hatch
-
How To: Perform Advanced Man-in-the-Middle Attacks with Xerosploit
-
How To: Exploit EternalBlue on Windows Server with Metasploit
-
How To: Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel Spreadsheets
-
How To: Enumerate SMB with Enum4linux & Smbclient
-
Hacking Gear: 10 Essential Gadgets Every Hacker Should Try
-
The Hacks of Mr. Robot: How Elliot & Fsociety Destroyed Evil Corp's Data
-
Hack Like a Pro: How to Create a Nearly Undetectable Covert Channel with Tunnelshell
-
How To: Install ParrotSec Sealth and Anonsurf Modules on Kali 2.0
-
How To: Hack a Site Knowing a Bit of HTML (hackthissite.org) Part 1
-
How To: Crack SSH Private Key Passwords with John the Ripper
-
How To: Crack Shadow Hashes After Getting Root on a Linux System
-
How To: Find Vulnerable Webcams Across the Globe Using Shodan
11 Responses
How did you infect the target ? Because I only see webbrowser or Notepad.
I guess you used a web exploit.
When I tested such infection with Hacking team Flash Exploit, the remote session only has access to firefox associated processes and not to the users one.
Try to upload an executable on the hard drive and launch it via cmd from your meterpreter.
Or upload an trojanized exe , and launch it manually in your target.
See the differences :)
Typically you could migrate to the explorer.exe which is x64 and having fun :)
Thanks for your reply.
I used browserautopwn. Im pretty sure that when I used that same exploit on XP and 7 x86 it gained access to all processes but I might be misremembering. Can't test it because I deleted those VMs. I thought about uploading an executable payload but I was afraid AV would pick up on that, and I was not sure if I could disable AV services without a system account. But since that is also done from cmd (i forgot about that part) i guess it will work :)
I haven't tryed this on Windows 8.1, but you could try to use:
msf> use exploit/windows/local/bypassuac
This is like a post exploit, you need to have an active session, then background it and launch the exploit.
The setting are quite easy, first set SESSION (your active session ID), then create another payload and set your LHOST and an alternative LPORT, for example I change it to 5555, you can't run two payloads on the same port at the same time.
Also make sure to set the target, you have two options, x64 or x86.
Then just exploit and see if successful. If everything is fine you should manage to use the 'getsystem' command and get full control on the target.
Let us know if it worked.
Good luck!!!
Thanks for your reply. I actually think I tried that, can't remember for sure, so I will definitely try that again :). If I did, I probably did not change the target. Did not know i had to use another port. I will get back with the results.
Unfortunately it returned: Exploit aborted due to failure: no-access: Cannot BypassUAC from Low Integrity Level.
Typically you re into the browser session , which is different from the user session.
Browser processes are in your case Low integrity , very low power of action.
User processes are in medium integrity , and if the User is local admin , you can use bypassuac function which uses Dll Hijacking to spawn a High Level Processes.
High Level Processes are processes from NT Authority/System , if you can migrate into one , you are the king on the infected system.
Av are easy to bypass :) : Keywords Veil-Project / Shellter.
Have Fun :)
Oh i see. Thank you very much for the explanation. I was convinced that meterpreter just "took over" the system whichever way it entered :). I will look into that. Thanks :)
Clearly no :) , having a remote control is far away from pwning the system.
You can have fun with a simple meterpreter , but with admin privs aka High Process integrity meterpreter you control the entire machine , persists into it and do full of bad (cool) stuff ! :)
Be Fun , Be Ethic
I just complicated things for myself when there was a simple explanation :).
Indeed. Had full control over my XP VM and that was way more satisfying. I guess I used a specific exploit on that. I suppose social engineering is the way to go for real world application, atleast for full control. Autopwn was a nice fantasy :).
Yep , if you're interested in browser attack, i can lead you to study the Beef framework , or some drive-by attacks such as Trojan firefox plug-in :).
Have fun :)
Thanks again. You have been most helpful! :)
Share Your Thoughts