Hello everybody and welcome back. And right now let us see some of the post
exploitation modules that you can run after you fully exploit the target. So in
the previous videos we saw how we can gain and access the system privileges on a
Windows 10 machine, and we also saw how we can actually prevent anyone from
doing that on our own machine. But right now let us see some of the post
exploitation modules that we can use. So, right here if we type sessions, I
have two sessions. One of them is the 4 and one of them is the 5. One has the
system privileges. Well, not yet but the getsystem command will work on the 5,
since I used the fodhelper exploit. And the 4 one we can close since that is the
first session that we have open, so sessions -i 4, and we can exit that.
Now we clear and we enter the sessions -i 5, get system. I already covered all of
this. And right now if I type here getuid, we are the system privilege account.
So, first of all, there is a module that is called sniffer which allows us to
basically sniff packets from our target machine. The meterpreter has the
capability of packet sniffing the remote host without, basically, touching the
hard disk. And it is useful when we want to monitor what type of information is
being sent. And even better, this is probably the start of multiple auxilary
modules that will ultimately look for sensitive data within the capture files.
Now the sniffer module can store up to 200,000 packets in our ring buffer and
supports them in a standard pcap file format so you can process them using
wireshark later on, for example. So once we exploit the target, basically, what you
want to just type here is use sniffer, and it will say loading
extension sniffer...Success. So the thing we want to do right now is to
check our available options with the help command. And right here at the
bottom we will see that it added the sniffer commands, which is sniffer_dump,
sniffer_interfaces, sniffer_release, start stats and stop. Now before we begin the
sniffing we actually want to see the available
network interfaces on the target. So, if we just type here sniffer_interfaces...
sniffer_interfaces. Let me just see why this is the incorrect
function. Copy, sniffer_interfaces: Operation failed: Incorrect function. Let
me just type here sniffer_dump...sniffer and then maybe this? So it doesn't want
to work, not really sure why. Thought it would work. Let me just type help once
again and type sniffer_interfaces. Okay, so this one doesn't work for some
reason, but luckily we have an alternative for this. So the alternative
is the packet recorder. So we will just type here run packetrecorder, and it
will run a module packet recorder for us. As we can see it basically even gives us
our available options at the start of it. So, meterpreter scripts are deprecated.
Tried post/windows...okay. So these are just some
of the options that we can do. Now below we have the commands list. So, what we
want to do is check the running interfaces, something that we tried with
the sniffer command but it simply didn't work. So, let us try with this one. Maybe
this one will work. So packetrecorder, I believe we should specify -li. Specify
the alternative folder to save PCAP files and interface ID number where all packet
captures will be done. So it will show us, I believe, our available interfaces right
now. Meterpreter scripts starting on interface 1. Error starting
packet capture: Operation failed: Incorrect function.
Not really sure what it gives us these options...
maybe I'm specifying something incorrectly? The -Li...oh, so it's the
capital L. I remembered it to be the -Li. So the capital L is actually
the listing of interfaces that can be used for capture. But it still says
incorrect function. Wwe can see right here it actually uses the sniffer
interfaces function, that's why it doesn't work.
That's why this one doesn't work as well. Now you can try on your own PC, maybe
this will work for you. Basically, what you want to do is basically select first
the interface, and then start sniffing in the .cap file. Then you can see all of
the packets that the target processed, in the current time, in the PCAP file,
where you saved it, via Wireshark. But right now we won't really bother with this
anymore. What we want to do is basically use our
module that, for example, works, such as let's say we want to run an OP scanner
on the target. So run, the module is called post/windows/gather/
arp_scanner. And then we want to select the RHOSTS which we want to
scan. And let's say we want to scan 192.168.1.1/24, which will
basically I believe will scan all of the hosts and their MAC addresses. It will
print us everything that is currently on our local network. As we can see,
ARP scanning is running and it found out these five devices. Now I believe there
won't be really any more devices, these are all that are currently on my network.
As we can see, the Huawei router right here, my laptop which is at 1.15, Windows
10 machine, this is the Kali Linux machine and this right here I have no idea what it
is. Yeah, this is the another interface for our Windows 10 machine. So
this is the wireless interface for Windows 10 machine. Good! So this is
another useful thing if you want to see the devices on the
target's network. If you are not on the local network you won't be able to see other
devices, in case you're doing this attack over over the internet. So this is just a
local attack for now, and I will show you later on how you can port forward and
actually run this attack all over the world if you want to. In another continent,
for example. Now let me just see if this is finished. We will close it since it
doesn't seem to finish. Maybe it just takes a lot of time to scan all of the
255 hosts. But the next module I want to show you...let me just background this and
clear this a little bit so you can see it a little bit better. So the next module
I want to show you is an important one. It is used many times by hackers in malware
where they want to check if the current malware, or current virus, is running in the
virtual machine. Now why does this function exist? Well basically the
hackers want to run a function that will check if the virus has been opened in
a virtual machines. That will probably mean that someone is trying to
reverse engineer that virus, and uses a virtual machine to do that. So then the
virus, for example, once it sees that it is actually running in a virtual machine,
it just decides not to run anymore. And then the user that actually
tries to reverse engineer the malware can't really see what the malware is doing,
since it refuses to run, since it saw that it is in a virtual machine. Now in order
to check if your target is running on a virtual machine you can just run
post/windows/gather/checkvm, which checks virtual machine. And this
will check if our Windows 10 is a virtual machine, which it isn't, as it
says right here. Desktop appears to be a physical machine. So this means that our
target is not running Windows 10 on a virtual machine. Which is correct since we
are not. The next one which could also be useful is the credential collector. It
will basically give you the hashes of the accounts on the
Windows machine. So the module is called run, so just type here run. Basically, the
run command just runs the module that you specify after that. And then
post/windows since we're on the Windows machine. Gather since we're gathering
some credentials, so we specified credentials.
And then credential_collector. And hopefully this
will print out all the hashes for our accounts. So, running module...error accessing
hashes. Did you migrate to a process that matched the target's architecture? What
do you mean by that?
Did you migrate the process...but we can try another one which is basically
giving us the hashed password of the administrator, I believe. So it is called,
let me just check, I believe it is called something like this. So, post/windows/
gather, now most of these post exploitation tools will start
with post/windows/gather. And then what we want to do is hashdump. Let's see if
this one will work. Obtaining the boot key...calculating the hboot key, obtaining
the user list and keys. Okay, and this one did work. We were able to get the hashed
passwords. Now for example, you can then copy some of these. You can, for
example, copy the administrator, so just copy this one right here. And you would
be able to use another module in Kali Linux called PSexecute, which
is also in the Metasploit module, in order to set the SMBpass to be this
hashed value right here. And you would be able to exploit over port 443 with the
SMBpass. So you just set this hashed value as the SMBpass in that module,
and you will be able to get another meterpreter shell with
that. So that is also a useful thing to do. The next thing that you want to do is
basically another module that we can run, which is basically
the dumplinks module. Which it basically parses the .ink files
in recent documents, which could be useful for
further information gathering, for example. So in order to do that you can
just type here run post/windows, and then you can just type gather/dumplinks.
I believe it is like this. So you just run this and it will give you all of the...
the specified script could not be found: post/windows/gather/dumplinks. Okay, so it
doesn't matter, it is not that important of a module anyway. We will not be
bothering ourselves to find it right now. What we can do is we can see all of the
applications that are installed on a compromised host. So, you do that with
this module, run post...yeah, and this is probably the reason why it didn't work. I
specified the slash in the front which I shouldn't have, but it doesn't really
matter at the moment. We'll just go to the next one. So post/windows/gather and
then ennum_applications, and this will print out all of the applications installed
on the host that you have hacked. Which could be useful for you in order to see
what the host has up and running, and what the host has installed. So we can
see there are a bunch of these since this is a real machine that I used before. We can
see WinPcap, WinRAR, a bunch of the visual studios, and so on and so on. Now I'm not
really sure what these numbers right here are. Oh, this is the version. So it
even gives you the version of the programs running. So we can see a bunch of
Python versions, OpenOffice, Razor Cortex, and a bunch of these
different applications. Another post exploitation module that you can use is
the enum_logged_on_users, which returns the listing of current and recently
logged on users along with their SIDS, which would be useful for you. So you
just type here run post/windows/gather/enum_ logged_on_users
post/windows/gather/enum_ logged_on_users, and this should print out all the users that have
recently logged in. So running against session 3 we can see
right here that the one of them is a system, and the one of them is the user
account. So, it even saves this into a file at this location right here. So root,
and then the Metasploit 4, and then here. So you can delete it if you want to. It
even saves the file right here at this location and this path. You can check it
out in there if you want to, or you can delete it. So that would be about it
for this module for now. Now in the next video I will show you how you can
actually run the same attack that we did right now over the Internet. So this is
only a local area attack. What you want to do is do a port forwarding on your
router and actually perform the same attack. So I will show you how to do that
the in the next video and I hope I see you there.