Instructor: In today's lecture,
we're going to learn some basics
about how to interact with metaploits interpreter.
So I already have a session here,
and as as you can see it just meterpreter.
In Linux, in everything, in every command line,
the help command is always the best command you can run.
So the first thing we're going to do,
we're gonna do a help.
And as you can see we get a big list
of all the commands that you can run,
and a description of what each of these commands do.
So, I'm gonna show you some basics right now,
first thing that I want to show you
is the background command.
So background
will basically backgrounds the current session,
so in one terminator session,
it will just, it's very similar to minimizing a window.
So when I run background, I'll go back to metasploit
as you can see there,
and I can run other metasploit exploits
to further exploit the target machine,
or just to exploit other machines.
While maintaining my connection
to the computer that I just hacked.
So, to see a list of all the computers
or the sessions that we have,
we can just run sessions,
L, to list the current sessions,
and as you can see we have a session here,
meterpreter, so it's still there, we didn't lose it,
and it's between our device and the target device,
which is 206,
now in order if I want to get back into that session,
to interact with the meterpreter again,
all I need to do is run sessions again,
minus I for interact,
and then I'm gonna put number two,
which is the ID of the session.
And as you can see I'm back in the meterpreter session.
Another command that I wanna show you
is the sysinfo,
and you see me run this every time
I hack into a system, and the reason for this command,
it shows you information about the target computer,
so it shows us the computer name, right here,
we can see the operating system of the target computer,
and it's running windows 10,
we can see the architecture,
so it's a 64-bit computer,
so in the future if you wanted to run
some executables on that target,
we know it's a 64-bit and we create a 64-bit executables,
we can see that the language is English,
the work group that it's working on,
and the user ID that it's logged in,
and then we can see the version of meterpreter
that's running on the target machine,
and it's actually a 32-bit version
of meterpreter.
Another useful command for gathering information
is IP-config, now IP config is very similar
to the IP config that you get when
you run on the windows machine on the command prompt,
and it'll show you all the interfaces
that are connected to the target computer,
we can see for example,
here interface one,
we can see the MAC address,
we can see the IP address,
and for example here, this is the interface
that is connected to our network,
and the one that we got the connection from,
so if the device is connected to multiple networks,
you'll be able to see al the interfaces
and how to interact with them.
Another useful information gathering command
that you can run is PS,
now PS will list all the processes
that are running on the target computer.
So these might be background processes
or actual programs running in the foreground
as windows programs or GUIs.
You can see each process here,
the name of the process,
and then you can see the ID, or the PID,
in which it's running.
An interesting process is the explorer.exe,
and that's literally the graphical interface of windows,
and we can see that it's running on process ID 2116,
now a very good idea once you hack into a system,
is to migrate the process, the current process
that you're running on into a process that is safer
than your current process.
For example, the explorer is the graphical interface
of windows, so it's always running
as long as the person is using their device.
So, it's much safer than the process
that you gained your access to the computer through,
for example, if you gained your access
through an executable, or a program,
you will lose your process as soon as
the person closes that program,
so a better way to do is
to migrate to a process that is less likely to be closed,
or terminated, so what we're going to do,
we're going to use a command called migrate,
to move our current session into a different process,
and we're gonna use the explorer process
because it's very safe,
Put 2115,
and there's no such process obviously,
so it should be 2116,
and the migration's successful now,
so the meterpreter at the moment is running from
the explorer.exe, now if we go to the task manager
on the target computer,
and run my system monitor,
or resource monitor, sorry.
Now if we go on network,
and go into CP connections,
you'll see that the connection here on port 8080,
is coming from explorer.exe,
so it's not coming from a malicious file,
our payload or backdoor is actually running
through the explorer,
now if you see firefox or chrome,
you can migrate to that process,
and especially that you're connecting
through port 8080, or you can use 80,
then it's gonna look even less suspicious
because 80 and 8080 are the ports used by web servers,
so it's very natural or very normal
to have a connection on port 80 or 8080.