Métis Boyte and my interpreter are both coated with and they stand over Ruby, so even Métis Point lets
you run directly any ruby code on the target without any insulation.
However, the community widens this feature further.
So python and power shell extensions are a good example of how the community contributes to Métis Boy.
The Python extension gives you the ability to run Python code natively on a target machine without having
the interpreter installed.
Also, it lets you load your own Python scripts.
And while Railgun gives us the ability to execute Win32 API calls.
A completely in-memory python interpreter is not a bad idea for Python lovers, it doesn't support all
python modules, but it is going to help you work with easier automation of Win32 related functions
with libraries such as C types.
And besides, no one can underestimate the power of power sharing.
Now, it also comes as an extension to interpreter and can greatly expand interpreters capability on
a compromised Windows target.
So in this coming section, we're going to touch on the features of these extensions and I will show
you how they can be used to your advantage.
So with an active maturity shell running on the target machine.
Let's type in lowed, python, and that's going to load the extension, giving us access to these new
command.
And to get the new commands just type in help Python.
All right, so three new commands are added to the session.
By executed execute python command, string's directly python import.
Helps you to import your python files directly into memory, Python reset restarts the Python interpreter
that loads into the memory.
So why don't we start with the first one first?
Typing Python execute H.
Brings up the help menu.
All right, so there's only one extra parameter.
So let's take Python execute.
And then type your python code between double quotes.
All right, so I'm going to get the path variables value and assign it to the X variable.
Then with our.
The value of this variable.
And yes, you just executed the first Python code on the target.
So you ready for another example type python execute?
Now, this time, let's get the path of the Tomcat users file.
And are to print the value of the variable.
You can also import a file, so type Python, import H.
To display the help menu and here are a few more parameters.
Python import.
F and the path to your final.
Desktop Tomcat users.
Is my Python file.
And this will look at all the patterns on the target and print the Tomcat users file path.
Now, here's a place that you can really show your python ability.
So why don't we just jump into another extension power shell?
So type load power shell to load onto the session.
Help PowerShares interview Fresh Command.
The first two commands work like Python commands that I already showed you.
But the third one is different, so let's have a look.
It's going to provide a powerful show over the session.
So that's really perfect to run the power shall command.
Power shall execute.
So just one extra parameter, but you don't need.
Now, this also depends on your power show ability.
So let's write some basic commands.
The view, the power show inversion table type power shall execute P.S. version table.
Power shall execute.
Get service to Lyssa Services.
And there are all the services listed below.
So if you want to run a few commands with parameters, you have to use them between double quotes.
So I'm only going to get there running services on the target with this one.
And here it is.
All running services.
Ready for another example.
So this time I will bring the 100 newest application logs.
With this line.
Stop it here and let you go.
And the second command power import.
Type power shall import.
And then the path to the file that you want to import.
So I'm going to import host Rickon File.
And you can download it from these addresses.
So after you import the file, then you need to run this file.
To do so, just type power shall execute invoke host Rickon.
Now, it has a very long output and it takes a few more seconds.
It enumerates the target system very well.
IP information, user information, active connections, services and processes, shares and so much
more.
OK, so now I will import and other power shall file.
Host, enum.
And you can download this file from that address.
And type power, shell, shell.
So now you were in power, Shell, Shell.
And to run the script, you imported type invoke host Inam Local.
And compared to host Rickon, this one brings much more information about the target.
And that's with all these extensions.