Hello everybody and welcome back.
And now let's check the part two of the commands
that we can run with the meterpreter shell.
So let me just start up my exploit once again. So my listener -j -z, and then I execute the program,
and we get the meterpreter session opened.
So sessions, this is all standard.
We already covered how to enter the session.
So, here we are in the meterpreter session.
Now there are a few commands that we can use in order to interact with the system itself.
So, for example, this command is very useful if you're, for example, attacking a lower or an older Windows
system.
What this does is, as it says right here, attempts to elevate your privileges to that of a local
system.
Now system privileges on Windows are the same as the root privileges on Linux.
What that means, basically, is that once you actually get the system privileges you can say that
you fully exploited the machine. As a user your commands, and your basically usage of all the other programs,
is limited.
So in order to do that you just type here getsystem.
But this is a Windows 10 machine, the privilege escalation won't really work here.
Now there is another way to do the privilege escalation which I will show you just in a second,
after we cover these other commands.
So there are some commands such as play audio file on target system, not
written on this, which is not really that important to us at the moment.
What is important for us is, for example, the keylogger. If you just type here the command keyscan_start
keyscan_start
So let's just do that,
keyscan_start.
It will say right here, starting the keystroke sniffer. And it will record all of the keystrokes that
the target enters in it's machine, or in it's keyboard.
So, for example, let me just open notepad right here.
And if I just start typing anything in the notepad, for example, hello world, and something like that,
it will get written to our keylogger.
So in order for us to print out what the target has typed in its keyboard, we can just type
keyscan_dump. And it as you can see right here,
this is the notepad which I typed in the search bar.
So it captured that and it also captured the hello world, as we can see right here.
This shift is referring to the capital letter.
That's why it starts right here.
So this is useful, for example, if you wanted to capture the password once the user logs in to any
website. Unlike the man in the middle attack where you can only target HTTP websites
and some HTTPS websites,
this will work on any website. Or, basically, anything that the target types, since this is a keylogger
installed on their local machine.
This will capture even if they type it on Facebook or even if they type messages in messengers. So you
can just capture anything basically with this. In order for you to stop
the keylogger, once you actually want to end it, you can just type here
keyscan_stop. And this will stop the keystroke sniffer.
So, once you type the keyscan dump it will no longer print the output of the target's keyboard usage.
So, basically, what I usually do is I always at the start time turn on the keyscan so
I can capture everything that the target types. And then at the end, when I want to exit the session, I
just basically just dump the keystrokes and close the keylogger.
So that is a really useful thing to have.
It is installed in meterpreter so
you can just type it with one simple command, and the keylogger will start. Now
I would show you these commands as well such as webcam chat, webcam snap, but my Windows machine doesn't
really have a webcam so I won't be able to do that.
What I can show you is, for example, this screenshot right here.
This will grab a screenshot of the interactive desktop, which can also be useful.
So let me just lower this so you can see. If I just type here in the terminal, or in the meterpreter
terminal, screenshot, you will see that it will say screenshots saved to root, and then some random name
.jpeg.
Now the screenshot will basically be this screen that you are watching right now. So let us check it
out.
If we go right here and we lower the screen. Now we know that it is saved in root
so we go to places and then computer.
OK.
So, we go down, scroll to the root, and right here and we can see the screenshot really did save right
here.
So this is also a useful thing to have.
Now since we don't need it
I will delete it now. Let me open in terminal. So open in terminal, and remove this.
OK,
good.
Now, let's see if there is anything potentially interesting to us as well.
So, for example...
yeah, some of these commands you actually need administrative privileges to run. For example, the clearev,
clear event log. You would need to actually have the system privileges in order to perform
that.
So, let's actually see how we can get the system privileges on the Windows 10 machine.
Now, first of all, in the Windows XP, for example, and maybe Windows 7. I'm not really sure about that.
I'm not really sure about Windows 7.
The getsystem command will work on Windows XP for sure.
So just type in this command and you will be able to get the system privileges.
But as we can see, that doesn't really work for us.
So what we want to do is background this session right here.
And the next thing you want to do is basically just search for the bypass module. So the bypass module,
you just type here search bypassuac, and uac is basically User Account Control. And you will
see there is a few different modules that are used in order to bypass the User Account Control, which
will give us, hopefully, the system privileges on the target machine.
Now if you use the simple one which is the first one, so you use this one.
Let us use it.
So use exploit/windows/local/bypassuac and we show our options on it.
You will see that it doesn't really work on Windows 10. If I set here, or let me show targets
first so we can see the available targets.
It says right here that it both works on Windows 32 bit and both on Windows 64 bit, but it really doesn't.
So let's see if we specify right here the session, which is the only thing that it actually asks from us.
So we check the session ID with the sessions command.
We can see that our session ID is 2, and we set session to
2. And if show options once again, we can see that everything is correct. And if I just type here
exploit, this won't really work since our target or Windows 10 isn't really vulnerable to this attack.
As we can see, exploit aborted due to failure.
Not vulnerable.
Windows 10 is not vulnerable.
So, what else can we do?
If we search bypass once again.
So let me just find the command.
So here it is. This one will work.
I've checked all of these and the one that works the most,
basically, this one also works sometimes. But, sometimes it just decides not to work.
This one works in most of the cases. So, exploit/windows/local/bypassuac_fodhelper
Windows UAC protection bypass.
So it
came out in 2017 and it is ranked as excellent. So, if you just copy this, and use, paste it here,
and we can see that,
basically, I believe it is the same options as in the previous one. So the only thing we need to set is the
session.
So we set the session to 2 since that is the session that we are running on our target.
Windows 10 machine. And after that you just click here exploit.
Now the only thing that will happen with this is I believe a power shell window will pop up for a brief
second, and then it should close. Once it closes it will open a system meterpreter shell. As we can see,
sometimes, yeah,
sometimes this happens as well. So it basically just says exploit was completed but no session was created.
So what you want to do when it actually completes the exploit but the session isn't really created, and
you didn't get the meterpreter shell,
you want to run this command until you actually get it.
So from a few times you will be able to get the meterpreter shell.
So we ran this a second time and, as we can see, we were able to receive the meterpreter shell.
There are some of the things that it did.
So as we can see, started reverse TCP handler, UAC is enabled, checking level, part of administration group,
continuing, and it basically gives us a meterpreter shell.
So, if we background is right now, and I clear our screen a little bit, and show my available sessions,
you will see that right now we have two sessions available.
The 2 is the one that we run with our shell.exe file right here.
Let me just close this hello world since we need it.
This is the 2 session under ID 2, and the session number ID 3 is the one that we got with the
bypass FOD helper, which we used in order to elevate our privileges. But if you notice right here, we
are still not the administrator, or the system privilege account, on the target PC. We are still this
account right here.
So, what you want to do is enter the third session, which is the one that we got with the bypass.
And right now if you just type here getsystem, the command will simply work,
since we were able to bypass the user account control or the UAC. As we can see right here, if I just
type here getuid, which will print out who I am,
it will say I am authority or system, which is the highest level of privileges you can have on a Windows
PC.
And by this it means that we fully and successfully exploited the Windows 10 machine.
Right now you can do anything you want to it. You can change even important files, you can crash Windows,
you can download/upload, you can basically do anything as well as in the root privileges in Linux.
So if I background, and now type your sessions once again, you will see that one of them is simple user
account and the other one is system authority.
So, in the next video I will show you how
you can actually...if you're running a Windows 10 machine, for example if that's your main host, how you
can prevent yourself from this attack.
You can prevent anyone from actually bypassing this with FOD helper, and actually gaining the system
privileges to your PC.
So that would be about it for this tutorial of privilege escalation and some of the basic commands in
my interpreter, and I hope I see you in the next one and take care.
Bye!