Forum Replies Created
- AuthorPosts
- June 12, 2020 at 5:06 am in reply to: Gaining Shell Access From LFI Vulnerabilities – Method 2 #39738Diego PérezModerator
Hi Riccardo!
Cool you got it!I’ll suggest to keep a copy of the downloaded file, I have break metasploitable many times and keeping a copy is time saving 🙂
Greetings!
DiegoDiego PérezModeratorHi Stanley!
Please try as suggested by Sithum. It works pretty well in custom kali.Let me know how it goes!
DiegoDiego PérezModeratorHi Simo!
Can you share a screenshot of the error so I can see the full traceback?Let me know.
DiegoDiego PérezModeratorHi!
Yeah, that’s normal (lossing internet) cause all the packets are being sent to queue 0 and if there’s no script using it they won’t be redirected properly, just flush iptables when you’re done.Can you share your corrected code again? Also share a screenshot of the error? I want to see where is it exactly ocurring based on the prints you have in your code.
Let me know.
DiegoDiego PérezModeratorHi!
This problem is happening cause Nexpose is starting with the system boot, this is breaking it for some reason, so the solution is to prevent it from starting at system startup, to do that do the following:
1. Boot up Kali, login and give it sometime for the nexpose service to start.
2. Stop the service that started with startup
service nexposeconsole stop
3. Remove nexpose from startup applications.
systemctl disable nexposeconsole.service
4. Restart, login again, now nexpose should NOT start automatically.
5. Start nexpose manually
service nexposeconsole start
6. Go to http://localhost:3780, and wait for it to show you the login screen, it might get stuck at 32% for a while but give it sometime and it should work.Also please make sure you give Kali at least 6Gb ram (memory) if you want to use Nexpose, if you can’t then its fine, we only use nexpose in 2 lectures in the course because its designed to scan a large number if IPs, so if you needed to use it in real life then you’d probably be working for a big company that can get you a powerful computer to run nexpose.
Hope it helps!
DiegoDiego PérezModeratorHi Domzi!
Cool you got it!
DiegoJune 11, 2020 at 5:35 am in reply to: Gaining Shell Access From LFI Vulnerabilities – Method 2 #39649Diego PérezModeratorHi Riccardo!
You can try to import a new metasploitable, did you download it from official Rapid7 site?
Let me know.
DiegoDiego PérezModeratorHi Akabueze!
This module is currently disabled in SET, so we’ll need to wait for an update and hope they include this module again.Greetings!
DiegoDiego PérezModeratorHi!
Are you running your code in kali’s terminal?Run the these commands in kali’s terminal:
pip unistall scapy
pip install scapy==2.4.2Let me know how it goes!
DiegoDiego PérezModeratorHi Domz!
A new custom kali has been uploaded it’s v1.2, please download it and install Veil as in the lecture.
It also displays colors in terminal.Let me know how it goes!
DiegoJune 10, 2020 at 4:55 am in reply to: Gaining Shell Access From LFI Vulnerabilities – Method 2 #39585Diego PérezModeratorHi Riccardo!
Can you try to add a couple more ../../ to your injection?Let me know how it goes!
DiegoDiego PérezModeratorHi Sithum!
Cool you got it!
DiegoDiego PérezModeratorHi Sithum!
Cool you got it!
DiegoDiego PérezModeratorHi Baba!
The communication has to be done here.
Can you share a screenshot with the result of running the installation script for ZLogger? Also the result of command “file <your keylogger name>”?Let me know.
DiegoDiego PérezModeratorHi Dennis!
When you selected the name for yhe output file you have to append the extension as well, I mean rev_tcp_8080.exeTry it out and let me know how it goes!
Diego - AuthorPosts