Getting Shells 101
Last updated
Was this helpful?
Last updated
Was this helpful?
We all love shells and that's why nxc makes it as easy as possible to get them! There really is something magical about shelling a /24
We can use the empire_exec module to execute an Empire Agent's initial stager. In the background, the module connects to Empire's RESTful API, generates a launcher for the specified listener and executes it.
First setup the rest API:
Second setup a listener:
The username and password that nxc uses to authenticate to Empire's RESTful API are stored in the nxc.conf file located at ~/.nxc/nxc.conf:
Then just run the empire_exec module and specify the listener name:
On your Metasploit instance, run the following commands
The SRVHOST and SRVPORT variables are used for running the webserver to host the script
The target variable determines what type of script we're using. 2 is for PowerShell
Pick your payload. In this case, we'll use a reverse https meterpreter payload
Run the exploit
Once run, the web_delivery module will spin up the webserver to host the script and reverse listener for our meterpreter session.
Then just run the met_inject module and specify the LHOST and LPORT values:
We can use the metinject module launch a meterpreter using Invoke-MetasploitPayload.ps1 script.