Payload not executing

Question

Payload not executing

Opened this issue 7 years ago · 11 comments

Hello here I am again..!

I am now getting the stager connection but when I choose the option 'Windows Meterpreter Reverse Shell' the execute command is sent but I'm not getting the meterpreter connection.

Regards, djitn.

Answer 1 · 2018-04-25T19:42:15.000Z

Hey,
Funny enough I've just noticed this today as well.

Looks to be an issue with pulling the invoke shellcode module. It's due to github now only supporting TLS 1.2.

I am looking to send the module over the initial stager connection to remove the need to download it on the target machine.

Will fix the bug tomorrow and hope to implement the offline sending soon.
Thanks

Answer 2 · 2018-04-25T19:45:15.000Z

The offline sending would be awesome! Thank you.

Answer 3 · 2018-04-26T09:37:43.000Z

Hi,

I have temporally fixed the bug in this location.
5fd1b77

I will implement the offline sending today.

Thanks
Charlie

Answer 4 · 2018-04-26T10:56:14.000Z

support has been added.
fbf876a

setup will need to be ran again

Answer 5 · 2018-04-26T17:25:19.000Z

Hello,

I've deleted everything, reinstalled it and ran the 'setup.sh'. I'm still not able to get the payload to connect back to my device.

Answer 6 · 2018-04-26T17:30:59.000Z

Hmm that's weird, I tested before pushing and can confirm its working for me.
Can you check the external modules directory and check there are PS1 files present.

Will look further into this tomorrow.
Thanks

Answer 7 · 2018-04-26T17:38:28.000Z

The external module directory has 5 .ps1 files in it. The stager connection is working as expected.

Answer 8 · 2018-04-27T09:51:17.000Z

Hi,

Could you try the following for me.

create stager
open new terminal and type netstat -pant
note down the open ports used by python
(windows) browse to ip address and port found in the previous step and look for p.ps1
download that file.
edit the file and go to line 94.
add a new line and add echo $data
save and exit
now execute the powershell file by browsing to the directory and typeing into cmd
powershell -exec bypass
then when in powershell type ./p.ps1
This should then make the connection back to winpayloads.
Try payload 2 and you should see the output in the powershell terminal.
Copy and paste the base64 output from the terminal into github so i can debug.

Sorry if this is confusing.
Charlie

Answer 9 · 2018-04-29T10:22:25.000Z

Did what you asked! (twice just to be sure)

Here is the content that was echoed by the powershell script:

Maybe completely reinstalling Kali is an idea?

EDIT:

After completely reinstalling kali the same thing occured. But after completely disabling windows defender (no other anti-virus programs are installed) it kind of works! I thought it was not necessary to disable windows defender.

Answer 10 · 2018-05-03T14:52:37.000Z

Hi,
Sorry for the delay - must have missed the notification from github.

So are you getting any messages from windows defender when its on and trying winpayloads?

Charlie

Answer 11 · 2018-05-03T16:41:56.000Z

Hello,
No problem. There are no messages from windows defender.

Djitn