How'd you do it?
This section should also tell us any relevant information about the
environment; for example, if an exploit that used to work is failing,
tell us the victim operating system and service versions.
I had modified the base payload to be encrypted in my own code and encrypted again into base64. The payload should have decrypted both layers and run the main python code.
What should happen?
I should have a full interactive meterpreter session and be able to use post-modules.
What happens instead?
Armitage says that a new meterpreter session is open and has sended the stage. It also shows that the host was red and had lighting bolts so it should have been working. I tried to run a basic cmd shell and a window popped up saying "loading stdapi. Try again." After that, I could not interact with the session at all. getsystem failed and everything else as well.
You might also want to check the last ~1k lines of
/opt/metasploit/apps/pro/engine/config/logs/framework.log or
~/.msf4/logs/framework.log for relevant stack traces
Metasploit Version: 14.17.17-dev
Get this with the version command in msfconsole (or git log -1 --pretty=oneline for a source install).
What OS are you running Metasploit on?
Kali Linux 2 2018.4 x64
42
We're going to need a lot more information, particularly: "I had modified the base exploit to be encrypted in my own code and encrypted again into base64"?
So I read an article on null byte about creating an undetectable payload. The trick worked and I had a meterpreter session, but it had the same result as my own payload. I have a special Caesar cipher to encode the BASE64 base python code. I will try to use just the original payload generated by msfvenom and see if I can get a working meterpreter. I'll see if I can get some screenshots
Most helpful comment
42