Jump to content

WindowsMeterpreterStaged not working :(


RooTShell
 Share

Recommended Posts

Hi, guys.

Just got my Bash Bunny in the mail today.

1) I updated it to the 1.3 firmware.

2) Installed all tools according to this post 

3) Downloaded all payloads from the GitHub projects into my payloads/library folder.

---------------------------------------------------------------------------------------------------

I want to use the WindowsMeterpreterStaged payload so I copied it to the switch1 folder.

I also created a meterpreter exe and updated it to my server. I edited the sc.txt file and changed http://127.0.0.1/update.exe to the correct url that points to my server and also uploaded it to my server. I also edited windows-staged-meterpreter.txt and changed http://127.0.0.1/sc.txt with the correct url to the sc.txt file I just uploaded to my server.

After all this I disconnected my Bash Bunny, activated switch1 and inserted it again in my computer. After a few seconds I get a red led. Looking at the readme file for this payload it says 

Red

 = Failed to load dependencies

I logged into my serial console and /root/debuglog.txt reads: Unable to load dwindows-staged-meterpreter.txt

Looking at the payload.txt of WindowsMeterpreterStaged we have the following lines of code:

source bunny_helpers.sh

if [ -f "/root/udisk/payloads/${SWITCH_POSITION}/ducky.txt" ]; then

QUACK ${SWITCH_POSITION}/windows-staged-meterpreter.txt

LED G

else

LED R

echo "Unable to load dwindows-staged-meterpreter.txt" >> /root/debuglog.txt

exit 1

fi

This makes me believe that /root/udisk/payloads/${SWITCH_POSITION}/ducky.txt is not found. The WindowsMeterpreterStaged payload doesn't come with a ducky.txt file as you can see in the github page https://github.com/hak5/bashbunny-payloads/tree/master/payloads/library/remote_access/WindowsMeterpreterStaged

Also the payload refers to file bunny_helpers.sh Where's this file located? I can't find it in the Bash Bunny's GitHub page either :/

What am I doing wrong? Can anyone help me with this?

Thanks in advance!

Link to comment
Share on other sites

It's actually not a duplicate of the post you referred. They refer to different payloads.

Also, as I stated above, the ducky.txt does not exist, not even in the github page of the WindowsMeterpreterStaged payload...

Thanks for your reply though.

Link to comment
Share on other sites

28 minutes ago, RooTShell said:

It's actually not a duplicate of the post you referred. They refer to different payloads.

Also, as I stated above, the ducky.txt does not exist, not even in the github page of the WindowsMeterpreterStaged payload...

Thanks for your reply though.

Actually, if you read the content, it is EXACTLY the same. Read the code he posted. Don't be so quick to rub it off.

Link to comment
Share on other sites

Just tried your suggestion of removing the brackets around $SWITCH_POSITION and changing the path to the ducky.txt to its full path... It didn't work... It still outputs "Unable to load dwindows-staged-meterpreter.txt" in /root/debuglog.txt 

As mentioned before the ducky.txt is not in my Bash Bunny payload folder neither in the payload github page.

Link to comment
Share on other sites

Are you reading what it the if statement is doing? It is saying:

If Ducky.txt exists

Start windows-staged-meterpreter.txt

It's not even running the file it checked.

Which of those files can you see next to the payload.txt?

Edited by Dave-ee Jones
Link to comment
Share on other sites

Of course I read what the if statement is doing. I'm a programmer for 30+ years. And this is why I stated in the first post that I found the if statement odd because ducky.txt doesn't exist in the payload folder, only windows-staged-meterpreter.txt. And this is why I stated that this is not a dupe of the post you mentioned because in this case ducky.txt simply doesn't exist...

Last night I rewrote the entire WindowsMeterpreterStaged payload from scratch and finally got it to work. The github version is completely broken...

 

Link to comment
Share on other sites

I looked through that payload.  Yeah.  It assumes there is a ducky.txt when there isn't and it doesn't even use it.  It is also doing manual UAC bypass versus running the downloader in an already elevated command prompt.

For a meterpreter shell I find it easier just to use the web delivery method of metasploit and use Powershell for stager's language.  Possible for it to be just a 2 quacker.  One to bypassUAC the regular keyboard way and then second in the cmd shell to run the Powershell command to launch meterpreter stager.

Link to comment
Share on other sites

  • 1 year later...
On 5/20/2017 at 6:44 PM, RooTShell said:

Of course I read what the if statement is doing. I'm a programmer for 30+ years. And this is why I stated in the first post that I found the if statement odd because ducky.txt doesn't exist in the payload folder, only windows-staged-meterpreter.txt. And this is why I stated that this is not a dupe of the post you mentioned because in this case ducky.txt simply doesn't exist...

Last night I rewrote the entire WindowsMeterpreterStaged payload from scratch and finally got it to work. The github version is completely broken...

 

I also currently need to be working on this payload. Been trying so many times and still failing. Can you share with me the correct version of yours? 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...