Time to finally figure out our possibilities with the interpreter shell in the last section, we focused
so much on how to gain access in many different ways and we popped amateur potential so many times.
But we never got to see its true power and all of its comments.
We only rent a few of them just to make sure the connection was successful.
Now we are going to go real quick through the basic commands that we can do with the interpreter Shell,
and then after it we will see some of the post exploitation modules and how we can run them.
So for this, I already got the shell opened.
As we can see right here, Metropia recession one opened.
I ran my file, which is, you see, and by now, all of us should know how to do this.
Just send the payload to the target, execute it, and you should have an interpreter session on their
machine.
From here, we can run the comment to see all of the available commands with the interpreter SHELP.
If I scroll all the way up and we are going to start from the beginning.
The first section of the comments that we get are called core comments, and these comments we are going
to brush through real quick, which is going to mention a few of them that we already know, such as,
for example, this background or B.G. If you type a background in your interpreter Shelke, this will
background your session and you will be able to use your plate framework module.
When is this command useful?
Well, if I type the command sessions that we already know, we got one session currently, but you
might have a session with multiple targets.
And in order to navigate between each and every session, you can use the background command to put
this method better session in the background and for example, enter a different session with a different
machine.
So that command is useful in that sense.
Of course, you don't need to type the background command.
You can simply just type instead Biji and it will do the same thing.
So if you go back to my session.
And go back to my health comment, we can scroll back to the comments and read some of them.
And what do they do?
So just go to this menu and most of them we're going to cover later on for now.
And we are not going to touch them because most of these are not needed for us at the moment.
For example, you know that you can exit the mortar shell with this exit comment background, the background
comment here.
We can see how we can switch between different sessions and you can get the user I.D. I believe get
command is right here.
Here it is.
Get your I.D., get the session, your I.D..
So if I type that right here, it will tell me the session you had.
We also know the command get user ID and this will tell us which user are we on the target machine.
OK, so these are just some of the comments and of course, you can experiment with others, but some
of them we're going to cover later on for now.
And you can just read through this menu and go to the filesystem comments and these filesystem comments.
You can just picture them as commands that we use inside of a terminal so we can change the rectories.
We can print current working directory, at least all of the files on the target system.
And let's see how that would work.
So if I go down here and to see in which directory and I can type the command, print, working directory,
it will tell me that I'm currently in this desktop directory on the target machine.
Now, why am I here?
Well, because this shell dot the inside of that directory and once the target executed it over Metropia,
the recession will automatically be inside of the directory for the payload is OK.
If I wanted to list all of the files inside of here, I can type the command and I can also type the
command.
So it supports both Linux Command and Windows Command.
There is used to list files inside the Windows system.
So we can see what files we have right here and maybe we could find something interesting right here.
For example, we get these passwords, dot the file, and of course, I created this on purpose just
for this tutorial.
But this is something that occurs quite often.
Matter of fact, years ago, even I had this file where I've written down all of the passwords that
I couldn't remember for different websites and to read the content of this password stop the next fall.
We can use a familiar comment for us, which is the cat comment for type cat passwords, dot the press,
enter this will print out all of the content inside of this file.
We can see the router, username and password, the Facebook username and password and the PayPal email
and password.
So this is something that you could possibly frown on and you want to see the contents.
Just abdicate command.
Of course, we don't need to be inside this directory if we don't want to, we can use our regular CD
comment to go one directory back.
And if we type, we are no longer in this.
That's the directory here.
We can type there once again to list out all of the files inside of this directory.
If we wanted to choose one of these directories, we can go back to them.
But for now, let's just go back to the desktop directory.
Great, if I type there, here, our desktop files and if we wanted to, we could also download the
file from the target machine.
So how can we do that?
Well, it is as simple as just typing download and then the file name.
In this case, let us say we want to download, for example, passwords that the.
I press enter and here it is, it will download it for us.
Now, I'm not sure where by default the interpreter saves these files, but it could be right here on
the desktop and here it is, here is the password that you see.
And you can also upload files if you want to.
For example, let's say we want to upload this red Back-Door that you acce from one of the previous
videos to the target machine.
We can see right now we don't have it on the desktop, on the target machine.
But if I type upload and then read back to the exit press, enter, go back to the desktop just to check
out.
And here is our file.
We successfully uploaded another executable to the target system.
Then we could use something like a shell to execute that file.
OK, but we are not going to do that right now, let us exit out of the shell and run the command once
again just to see what else we can do.
Inside of the filesystem comments, we also get the comments and how we can create and remove files
so we can use our media to remove a folder, we can use our M to delete the specified files.
So, for example, we want to delete the file on their desktop.
We can do that using the regular our end comment.
We can also create a directory and create files if we want to.
So let's see, for example, if we manage to delete the red Back-Door that we just uploaded, we don't
want it there.
So let's just delete it real quick.
The R.M. comment, and it is no longer here.
And let's say we want to create the best directory.
And we want to copy passwords that stick in the test directory, hmm?
Access is the night letters.
Just check out right here.
We got the test directory, but for some reason, we can't seem to copy this file.
And this could be due to many different reasons.
But the main reason will probably be because we are not an administrator on the target machine.
And we're going to check out in some future video how we can become an administrator and system level
account just by getting the at the shell as a regular user.
Remember, if I ran to get your ID, we're just a regular user.
We are not this system level account, but more about that later on.
For now, let us run the health comment once again.
And you can play with this file system comments that we have right here, but they are just regular
comments that we can run inside of a Linux terminal.
Just this time, you're running it on the target machine inside of the network commands.
We only have a few of them.
So let's just test two or three of them.
For example, this ARP command will display the host our cache.
So with this, we should be able to see the IP addresses and their corresponded Mac addresses.
These are all of the IP addresses that are inside our tables on the Windows machine.
So we have our clinic's IP address because we are currently communicating with our target machine from
our IP address.
Therefore, it must have our Linux IP address in the ARP tables.
We also get the vaulters IP address, the broadcast IP address and all of these down here are not that
important.
If I run the comment, of course, I will be able to see all the networking interfaces on the target
system as well as the IP address that the target currently has.
If I ran the comment, for example, nets that this will print out all of the connections that our target
machine currently has, so we can see right here the connections, the IP addresses, which protocol
are the using in case these are using TCP?
And down here we have EUTERPE Protocol.
If I go up here, we should be able to find ourselves at the ACCE that established the connection with
the IP address.
So we know that 190 to the 168 that fund that four is the IP address of my Windows Ten Target machine.
And here if I go and find the IP address of Linux machine and here it is, we can see it is running
on Port five five five five.
The connection is established and the process that is causing this connection is shall dot or our payload.
Great, now, if you want to, you can go up here and experiment with the other comments as well, but
these are not that interesting or important for us at the moment.
What is important and what we will cover in the next video are these system commands and user interface
commands.
We want to see some of the cool stuff, such as capturing keystrokes or running a key logger, running
a screenshot on the target desktop, maybe, for example, recording microphone, recording webcam,
all of that.
We want to check out and see how we can run them, and we will do that in the next video.
So experiment with the comments that we covered a little bit.
Feel free to run the others as well if you want to check out what do they do?
And I will see you in the next lecture.