OK, so let's see some of the basic interpreter commands with a Windows victim.
Here I have a system running Windows XP service pack one, and it's IP address is two zero seven.
This system has zero 08 zero 067 vulnerability.
So now let's try to exploit the vulnerability and have him interpretor session on the Windows system.
We were in the midst voidable maturity session, so send them a procession background to access MSF
console shell.
Now, let's find the exploit module written for the Miss 08 067 vulnerability.
And we have one exploit with a great rank.
That's good for us, so type use and the full module name to use it.
So now let's look at the payloads we can use with this exploit.
Wow, there are a lot of payloads and let's choose this one.
Windows interpreter slash reverse TCP.
And so the options now, we have already seen these steps before, so I'll keep a quick said the remote
host, the IP address of the Windows machine.
Listen, host as our colleague.
Remote port is correct.
Listen, Port, that's OK for me.
Ready to run the exploit?
And yes, we have an interpreter session on the Windows system.
And what's the first command, this info is always my first command and look at that, we are confirmed
we are on Windows XP service pack one help command is the second one, of course, shows the command
available.
OK, so now there were a few commands which I said that I will show you with an interpreter session
on a Windows system.
The hash dump command was not available when we were on voidable.
Now, an interpreter has this command.
Of course, we can also use the hash dump post module as well.
The hash dome command is more important for Windows systems, and I'll tell you why in a Linux system,
looking at the shadow file is usually enough to see the password hashes.
However, gathering hashes is a bit complicated for Windows systems.
Password hashes are located in the same database and you need to have the key of the same database,
which is in the system file.
Thankfully, we have met her, we can dump password hashes of a Windows system with a single command.
No.
You can use either if config or it config commands to learn the IP address of the victim machine, same
as an interpreter on Linux.
Now you can use the WD command to see your current location on the victim's system, there's no such
command in MSDOS systems, but hey, this is not the command shuttle.
This is my interpreter.
And again, you can use the code command to change the location.
Now, the search function has the same functionality, so you can use it to find any file in the victim
machine.
You can use the command to see the contents of a file, and as you know, Cat is a standard Linux command,
but this cat is not that cat, if you know what I mean.
So now I want to show you an interpreter command, which is window specific.
Clear, Evy.
This command is used to clear the application system and security logs on a Windows system, there are
no options or arguments needed.
Your activities on the system after the exploitation will leave some footprints.
So you just better clean them up.
Let's go to the Windows system and look at the event viewer.
Well, I don't know its location, so I'll use the search option.
And here it is.
Here are the log files.
And now let's run the clear of command and it wiped the log files, so turn back to the Windows system,
refresh the event viewer and see no logs remain.
Well, I don't know if you see what I'm seeing, but there is a new record in the security log.
You see it.
But I don't know what it is, but it doesn't look like a warning.
Well, at least it doesn't contain any clue about who we are.
Now, the Shell command presents you with a standard shell on the target system, this time we have
a command prompt as well.
Now we can use the standard MSDOS commands.
Desire to list the files and folders, if config to see the internal IP, et cetera, et cetera.
Use exit to exit the shell.
Now, we couldn't run idle time commands on meds, voidable limbic system, but now we can.
And as I said before, it displays the number of seconds that the user at the remote machine has been
idle.
Very useful info.