-: Welcome back.
And in this video I want to talk about a few more
useful commands and post exploitation modules.
So, what I got right here.
I established my Meterpreter session,
with my Windows 10 main machine.
And now let's see, what else could we find useful,
after exploiting the target.
Well, if we take the help command, somewhere around here,
I believe there should be an option called search.
And what search allows us to do is to, for example
search for a specific file types, on the target system.
So if we type search, dash h, this will give me
an options that I can use with this command.
For example, if I wanted to find all the JPEG pictures
on the target system.
What I could do is echo type search dash F,
and then star sign dot JPEG, press enter.
And what this is going to do is it'll manage to
extract all the JPEG, images that are located
on the target system.
Now. you can also do for any other file type that you want,
and you can also mix it,
with one of these options right here.
And here are the results.
We can see there are a lot of them.
All of these are JPEG files, as we can see right here.
Now if I scroll all the way up,
we can see that the list goes on and on.
So maybe we would want to narrow it
down, if we were searching for something specific.
But right now, we got all of the JPEG files,
on the target system.
Okay, another thing that I want to show you, is the usage
of post expectation modules.
How can we do that?
Well, if we go and put my session in the background,
clear the screen, and since we are on a
windows machine, what we can do to search
for the post exploitation modules, is we can type search
and then post slash Windows, press enter.
And this will list out all 191 post exploitation modules.
And you can scroll through them,
and see which ones you would find useful.
For example, if your target has Ava cart, and it connects
to the virus access point, you can use this module type use
and then the module name show options.
And usually this modules will only want this session ID
so they're very easy to run.
You can simply just set the session ID to
first of all, let's check out what session ID we have.
And it is one, so said session ID to one.
Then run the program, and this will list out
all of the virus interfaces, and possibly the
passwords of the connected wireless access points.
Now since my machine doesn't have a wireless interface,
it simply just prints out no wireless interfaces.
So these post expectation modules, depend on
what you're looking for.
So let's scroll a little bit up,
and see which type of modules we have.
So we got bunch of enumeration modules.
You can enumerate Chrome, to extract all the
chrome data you can find inside of that browser,
in case the target is using Chrome.
Check for VM.
So you can use this module, for example
to check out whether the target, that you manage to
hack uses a virtual machine or if it's a virtual machine.
So let's see how that would work.
We know that my Windows 10 main machine,
is not a virtual machine,
so it should give out false, as a result.
So set session one. Run this,
checking if my target machine is a virtual one.
And it says it appears to be a physical machine.
Which is correct.
You can also be more specific, when searching
for the post exploitation module.
Such as for example, type search and then passwords.
And we can see right here, we get some post exploitation
modules for gathering passwords, credentials
total commanders, save password extraction.
Let's go a little bit up, see what else we have.
Not really too interesting.
However, one module that we can use to extract the hashed
versions, of passwords on a Windows machine is we
can type search and then hash dump.
Then we can scroll a little bit up and we got somewhere
around here, a module.
Here it is called post Windows gather and then hash dump.
So let's copy it, type use, and then paste the module name.
If I type show options, set the session to be one.
As you can see, they're very easy to run.
Only one option is required, and I type run.
It will tell me, access is the night.
So this simply means time not, a system level account.
We know how we can fix that.
So I'm just going to do that real quick, just to
show you what this has done, post exploitation model,
outputs once it works.
So I'm going to real quick, elevate privileges.
And here it is the privilege escalation worked,
from the second try.
And I'm going to type get system background, this session
and now use post windows gather.
And then hash dump, set session to be session two
because the session two, in this case
is the session with the system level account.
And if I type run, this should give me the hashes,
of all the users on that Windows machine.
And here they are.
We got the administrator hash, we got the user hash,
and we got some other hashes as well.
And we could use them to crack,
them with some other program.
But more about password cracking later on in the course.
For now on, we just managed to extract the hashes.
Another useful option, that we have that requires
system privileges inside within the Meterpreter shell.
If I go inside of my system level account shell,
and I type the help menu.
Scroll a little bit up.
I should see this option called clear EV.
And this stands for Clear The Event Log.
What does this mean?
Well, this command for Clear Application System,
and Security Logs on a window system.
So it is something similar to covering up our tracks.
How can we run them?
Well, it takes no other parameters.
So all we need is a system privileged account,
and we can type clear event.
And we can see right here it is wiping,
out records from Application, System and Security.
And another thing that I want to show you,
before I close off this video, is that
you can run post exploitation modules even
from the meterpreter shell.
So you don't need to always put it inside of the background,
in order to run a post exploitation module.
You can simply just type run,
and then the module name, for example, I will use this one.
So post windows gather,
and then enum underscore applications.
And if I press enter.
What this post module will do, is it'll print
out all the installed applications,
on my Windows 10 machine.
And we can see them right here.
So many different modules exist.
We saw there are hundreds, of post exploitation modules.
You run all of them the same way.
So you can simply just go and search,
through them and find which one is useful for you.
Then you can test them out and see how they work.
Great! Now that we covered all of this,
you have a pretty good understanding
of what post exploitation is.
So let's just remind ourselves
of the most important things that we do.
After exploiting the target,
we try to elevate our privileges, recreate persistence.
In order to be able to enter that machine whenever we want.
And we search for useful information,
on that target machine, such as password hashes,
such as different files, that we might find useful.
And those are the main parts of post expectation module.
Of course, you can then use the commands,
like clear event, and other commands that are used to cover
up your tracks, and delete the lock files,
which could be useful to cyber forensics.
In case they want to track back,
the person that was on that machine.
So, thank you for watching this video,
and I will see you in the next lecture.