Hello everyone. In this video. We're going to be taking
a look at some of the essentials of meterpreter. Now
in this module, we're going to be focusing on post exploitation and
privilege escalation and one of the tools that is
extremely important to know when performing privilege escalation or
post exploitation and generally speaking maintaining access
on the target system is meterpreter. Now, the
great thing about the Metasploit console and meterpreter in particular, is
the fact that it is very well documented and
you have a very useful help menus. So
Example, if I just list out the help menu by
using the question mark symbol and I hit enter, you can see all
the useful commands are sorted out based on functionality
in their various and their various categories. And
again, in terms of the core commands. You
have them listed right over here. We'll be taking a look at some of
the essential commands that will really get you up to up to
speed with the meterpreter. And then, of course, you have your basic file
system commands, which allow you to navigate the system print
out information.
Fashion edit a file, print your working directory,
make a directory. So on and so
forth and then you have the ability to of course enumerate
system information and we'll talk about that shortly. So
without any further Ado, let's get started. Now, the
way I'm going to start is I'm going to set up a scenario where
we have just gained access to a system. And the
first stage is to enumerate information about the
system. So to find out more about the system we're
dealing with. And the First Command we want to run is this info,
right?
We type in six info, and this does exactly what it says.
It lists out information about the system, more importantly, it
lists out important information about the system. So
in this case, you can see tells us the computer name, it lists
out the operating system. So Windows 7, it lists out the build number
and the service pack which is extremely important. When trying
to find various vectors for privilege escalation,
whether they be kernel-based exploits or
service based exploits. It gives us the
architecture which in this case is 32 bit.
The system language the domain. It is part. It
is a part of the logged, on users on the
system, and the meterpreter architecture. Right
over here, the meterpreter architecture, and the type
that being said, that's how
to enumerate basic system information. Now, of course, we
can try and enumerate other people, it's of information. Like, first
of all, getting to know what user were currently logged
in as. So, if I say get user ID, when
we hit enter, you can see, we currently have administrative privileges and
that is
Noted by the anti-authority system option
here. So again, that means we have we pretty
much have administrative access. But again, this video is just explaining the
basics of and the essentials of meterpreter. So
we can also get into a
command prompt. We can get a shell on the system.
Now, we talked about the shell. This is not going to be the same as
a meterpreter session because I when we, when we're dealing with
the shell, where directly interacting with the system through
the command prompt, so that means we only
are going to be limited to windows-based command. So
if I hit shell, you can see gives me a command prompt
as you would expect, and I can now execute Windows commands,
which is excellent. So against a net users, and
that will list out all the users on the system. In this case.
You can see, we have administrator sshd for
the SSH server, sshd server guests, and
internet user. So again, we can then perform
commands like ipconfig. We can take a
look at the network or out information and we can
perform.
A plethora of other windows-based commands. Now when we're done working
within the command prompt and we want to return back
into the meterpreter session. All we need to do is type in exit
and that will take us back into the meterpreter session. All
right. So now that we have we've taken a look at
some of the basic in information and numeration commands.
Now, let's take a look at navigating the system and
trying to understand what's running on
the system. So let's start off with file system commands. So
file system commands are going to be pretty much the same.
I'm to Linux. And of course, it will have some
comments that have been appropriated from Windows. So
for example, if I want to change my directory, I can specify the
directory. I want to navigate to, in this case. We are running Windows so
I can navigate to the root directory of the C drive. And
if I display the files, I can use dir or
LS and I can hit enter and there. We are that lists out
all the files and directories within the DC drive.
And then of course I can change directory into any
of these. So I can say users and CD. We
can
Is the files in here we're going to CD. I want
to get into the IE user directory. So IE
user I can enlist the folds in the I
can then go over to the desktop and I can hit enter and
there we are. Now some important desktop
or file system commands are going
to be the ability to upload and download files to the Target to
and from the target. So if we find a valuable
file on the system, we might
want to save it onto our system. Or we might want
to download it.
Because we might want to use it later. Right? So to
do that. All we need to do is we
again, the first thing I'll do is I'll just create a file
here. We'll try and upload the file to the system. So I'll
just list out. We're currently in the Kali root directory. So I'll
just say touch or I can just Echo the data
directly. So I can say Echo. This is some
test data and
I can then output this into text
Dot txt.
Going to hit enter. So text Dot
txt and you can see that that file contains this
data. So let's try an upload this text Dot txt
onto the desktop and we can display
that by printing in the working directory. So
we're currently on the desktop of the IE user. So let's
try and upload the text Dot txt file here. So
to do this we all we need to do is type in upload and
we can then specify the directory to the file that we
want to upload. In this case. We are currently working in the home directory. So
I'll
They text Dot txt and hit enter. You
can see. It's going to tell me it's uploading it. It gives us the progress and
it tells us that it's uploaded. So, if
we list the directory now, on the desktop, you can see we have text
Dot txt. So if I open up My Windows desktop,
you can see the text Dot. Txt file has been added
in for open that up in a notepad. It tells me this is
some test data so that was successful. Now, let
us try and do something else. I'll create a new file
here and I'll say
Create a most sacred text
document will say it will just say
passwords. Right? Let's say someone has saved their
passwords. And what I'll do is I'll put this within
the documents directory that we are. And we'll just
enter in here and we'll say, AWS, passwords is
equal to pass
2020. Aw s,
just something basic to set up a basic scenario
here. So again, let's say we are
navigating through the system using meterpreter. So
again, we currently on the desktop. Let's go a step back here
and we want to go into the documents directory. So
documents documents
like so. And you can see
that we have a positive dot txt file, which is interesting. So
let's say we want to download that to the Calla system. All I
need to do is type in download passwords. .Txt. Passwords
dot txt hit enter and it's going
to download the
And if we take, if we take a look at the the
home directory for the Kali user, you can also
see, we have the passwords dot txt file in here so I
can hit enter and it gives us the data that we added right
over here. So I'll just delete that file now because
we do not need it. And also remove text Dot txt
from our home directory. And if I want to do the same
here I can say remove
Passwords Dot txt and that removes it. If
I go back and I say I want to go into my desktop now so CD
desktop and I say remove and of course I
say text txt, and that is gone. Right. So
those are the basic file system commands and of course we
can now move on to some of the more interesting commands which
are going to deal with processes. So processes are
an integral part of post exploitation and
privilege, escalation primarily because it gives you
a very clear picture of what's running on the system.
And it also gives you an idea of what processes you might want to migrate to.
And we've already taken a look at
migration in the previous video in the previous sections. So
again to list all the processes we simply type in
PS, right? And PS will list out all
the processes and it's sorted out into your process ID, the
name of the process, the architecture, which is very important when you're
migrating into a 64-bit. If
you're migrating into a 64-bit session or
process, that is currently
Using 64-bit. And then, of course, you have the session, the
user. So in this case, enter your Authority and
various other users like IE user
right W. So I can also migrate for
example into the explorer.exe process that
is currently using the IE win7
user or the IE user, which
is currently running. It is currently
a 32-bit session right away. So you
migrate into a session, the important
Mission that you need is going to be the process
ID. Right? So the process ID will is
what we will use. So in the case of Explorer, you
can see the process ID is 1496. Now,
if we are looking for a particular process on
the target, we can use a tool called P grip which is
process grip and against enter the name. So if I'm looking for
Powershell and I hit enter, it will give us the process
ID for partial dot exe and you can actually see,
we can confirm that that it is 34 96. So
let's say we're
I'm looking for p grip Explorer.
Sorry Explorer and that is 1496.
So I can then say migrate 1496,
right? 1/8. And
then that's going to migrate into that particular process
that we are migration completed successfully. So get
uid. We hit enter, you can now, see, we're not
logged in as the administrator and we're currently using
the IE user which does not have administrative privileges.
Alright, so now we are in a perfect place to start
talking about other commands.
Like get system and and
and the and hash dump, right? So the get
system command allows us to escalate our privileges. So
if I say get system and I hit enter, you can see
that is going to tell me the privilege escalation failed
and it this is using these various techniques
right over here. Now as we will move along to
the independent videos where I'll be covering Windows 7 privilege,
escalation will talk about how to get privileges or
to escalate or privileges using kernel exploits.
And various other useful tools with the Metasploit console. All
right. We also have the ability to dump hashes.
And that is done using dump, Ash dump. If I
hit enter, you can see will not be able to do
that because we do not have administrative privileges. So if
I list out the processes again, and
I currently can only see so
you because I do not have the various privileges,
the various administrative privileges.
You can see that I cannot
You important information like the user
information in regards to the entire Authority. So
again, what I would need to do is I can try
and migrate into any of these Services here. So I can say, let
me try and migrate into svchost.exe. So
in say migrate 3220 hit
enter and that does not work because we have insufficient privileges.
So again, we need to we
need to escalate our privileges manually. So we'll be taking a
look at that as we move.
Move Along into the next videos, but I just wanted to actually
demonstrate this to you right now. So what I'm
going to do now is I'm just going to terminate this
session now, phone to terminate a session, I can eat exit, right?
And again, it exit, and then since we're using Eternal blue,
I'll just hit run and that will give me another meterpreter session
with anti-authority
privileges. So get uid it
end, until there we are. Right. So
let's move along to some of the important.
Commands. The number one is the ability to background or
sessions. So, if we want to move this meterpreter session
into the background and maybe run some other Metasploit modules,
we can just type in background. And that will
send this into the background and we can view our sessions or
background sessions by typing in sessions. And
you can see it gives us our sessions right over here, the
IP address that we are connecting to and
the information regarding the system like the computer name
and the user, we are logged in as
And if we want to go back into that session, we need to type in sessions
and the session ID. So we could have up to 100
sessions or even more. So, the idea is very important. So
I ate two sessions three and we're back into the system with
the meterpreter session, right? So now
that we've taken a look at the background and sessions, let's take
a look at some more important ones that we can perform, which
are really, really fun to run. Of course. We
can take a look at hash dump old which will simply just dump the hashes
from the system. Now, this will not work on.
Versions of Windows because the Sam database is protected. But
again, we can then use these hashes for password cracking
which we'll talk about in its own module. So
let's take a look at some important commands that
we can run. Of course. We have the ability to we
have the ability to run commands or based
on the user interface. Now, of course, we
have you ICT L, which is very very important.
So we can use UI CTL to enable or disable the
keyboard or the mouse which again can be very
useful. Now, I'm running a virtual machine which
pretty much means that the way I interact with.
The user interface is through a different
layer as opposed to the USB or the universal service,
the universal service bus layer, so
it will really not work if I try and demonstrate it to you,
but in order to do that, all I need to type in is UI CTL against
a
I can see disable keyboard. So disabled keyboard
night in turn that's going to disable the
keyboard. Now again, it's very important that you know, that this is only going
to work on systems that are using USB when
I'm running it in a virtual machine. It really will not work because
again, I'm interacting with it very differently so
that I can then enable it again, and
again, I can do the same for
the mouse, right? So enable keyboard, and I
can do the same for the mouse so I can say disable Mouse.
Mouse. And again, disabled.
And I can then say enable mouse, right? So it's very
simple and very, very useful. So that
is a UI CTL. And of course, we cannot talk
about some of the other important commands which is
related to the to
the user interface. And that is the ability to.
I'll just open up the help menu because I want to actually show them to
you is the ability to, actually, what
we can do is we can use the inbuilt keylogger.
So we can actually get sorry. This is
the one, right? The key scan. We can start capturing key strokes and
this was again, will act like a keylogger. So any commands
that are being typed in, on the target will be captured. We
can also do the same for the mouse. We can also take a
screenshot of the desktop. So what we can do is let's
try and take a screenshot of the desktop first. So, screenshot hit
enter. It's going to save it in the home Kelly directory.
So if you open up a new dirt new terminal, or
we just open up the home directory.
Can see we've taken a screenshot right over
here. So what we can do now is
let us try and run the what
we can do is we can start, we can try and run the keese can
start and stop commands,
or we can dump the entire keystroke buffer, so we can
say, ski scan dump.
Toki's can dump and of course, that will
not work because we need to enable the key scan. So
we say keys can start and if that will start capturing
it, so keeps can start it.
Enters going to start the keystroke sniffer. So if we go into
the windows box here and we just type in, we
can say cmd.exe. Open that up, we
can then say, we're looking for net users and
we can see ipconfig the basic commands you would run and
we then close that out.
So we then say go back into our Kelly box
and we take e scan, stop hit
enter and we say keys can dump
hit enter and it's going to give us
a know. It's going to give us an error and that is again primarily because
of the fact that we're dealing with a virtual machine
and we do not have the ability to,
we are not interacting with a USB keyboards
and mouse and mice. So again,
We can use any of the user interface commands, right of you. But of
course, in this case, it really doesn't make a difference because or will
really, really, it will really not make any any
impact because again, we're running it in a VM. So
those are the important commands that you can run here. Now,
of course, I want to take you through some of the
important ones and one that you'll be forced to run quite a bit and
that is the ability to execute exe
s. So, for example, what I
can do is, let's see if I can find
The wind Rod or exe here. So we'll
look for WinRAR dot exe and that probably is
within the program files, but we
actually should see it right over here somewhere. So
this is under the directory Over Yonder. We
are under Windows system32, right? So if we go back and
we say, yeah, we have for example notepad.exe., If
you want to execute an exe file. All we
need to do is type in execute F and
we say, notepad.exe hit enter and that's going
to
Create notepad.exe. And again, what
we can do now is if we try and take
a screenshot of the desktop, we
hit enter. Let's see if we're able to actually see
whether notepad has been opened. I looks like it
executed but it did not display the but
you can see the process has been executed right over here,
and that's primarily because it's executing it
as n to your Authority.
As opposed to the IE user. So again, that
is a process that is created under NT Authority. And
of course, if we were running, or we were currently
using the IEEE user, then
the it'll actually be displayed on our desktop. So again,
that is a very simple way of
executing executables and any other executable file
on Windows, where they'd be a batch file, so on and so forth. And
then, of course, you have the ability to suspend or
kill processes. So again,
Kill the notepad.exe process.
So 29 that is 2920
hit enter. That's going to kill it. PS. And
you can see the notepad.exe is actually closed
now. So those are essentially all the
fundamental and essential meterpreter commands, that
you will need when when performing
exploitation, post exploitation and privilege escalation. Of
course, as we move along, I'll be taking you through some of
the other commands that you can run. But we're going to be focusing primarily.
Early on modules. And then only talk about manual, exploitation will
talk about file transfers and other techniques like
that. So that's going to be it for this video and I'll be seeing you in
the next video.