We have launched our exploits, and our payloads have been successful.
We have a session established with our target.
Now what?
Well, let's talk about modules that we can use for post‑exploitation activities.
Post‑exploitation activities encompass everything we might do once
we established that session with our target.
Our first task is to explore the system. In the penetration
testing execution standard, this is defined as the infrastructure
analysis phase where we look at the network configuration and
network services on the system.
Next,
we may exfiltrate data. Here we need to be careful and
comply with our rules of engagement.
We may not be able to make copies of the data,
but we should note the pertinent data we found for the report.
Persistence means that we established alternate means to
re‑enter the system at a later date.
If, for example, the vulnerability we initially used is patched later,
we would still have another way in.
Pivoting is moving from the current compromised system to
other systems in the target environment.
The data we collected when exploiting the system
will come in handy for this step.
Post modules are Metasploit framework modules for post exploitation.
They can assist you in simplifying and automating some of the
work in gathering information about the system,
managing the configuration of the system for
persistence, and escalating privileges.
Much like post modules, local exploit modules use a
session with a target system to operate.
This is because a local exploit module uses the connected session
to run the exploit as a local user to that system. The exploit
uses the system internal services, libraries, and commands.
It may upload exploit code to the system to execute as well.
A local exploit can take advantage of vulnerabilities as a
legitimate and unprivileged user on that system.
For most local exploits, you will use it to escalate privileges.
In some instances,
the local exploit will open a new session in Metasploit with
those higher privileges. There are also local exploits that can
establish persistence on the target.
Now let's spend some time exploring post modules and local exploits.
First, we will look at how to find these types of modules,
select a few for use, configure them for sessions we want to target,
then execute them, run in the case of post modules or exploit for local exploits.
Let's get started. For this demonstration,
I have sessions established to two targets that we will exploit.
Session 1 is for a Windows Server. Session 2 is a Linux Server.
Let's start with the search.
You can see that there is a search parameter for post modules.
Let's find post modules to gather information from our target system.
Here we can see that there are a few options for gathering all
manner of information from target systems.
The ones that are prefixed with enum will enumerate or or
create a list of specific configuration details.
Let's pick one module that will enumerate the services running.
Here are the details for this one.
Now we need to configure it for the session on which we want it to run.
Then we run it with the run command.
Let's look at the network connections that this system has with
tcpnetsat. Here you can see the network connections listed include
our own Metasploit session connection.
Next, let's look at local exploit options.
Try this search to find local exploits.
Let's look at Linux‑specific ones.
A lot of these are very specific,
affecting either a specific kernel version, distribution, or
a specific version of a software package.
Once we find and compromise a target,
we may need more time for exploration of that system.
Let's establish some persistence on this system so
that we can have the time needed.
Let's utilize that session to the Linux target.
(Working) As you can see from the messages,
we have a new session established.
It's running as root on the target.
We have also set up the target system to re‑establish this session continuously.
It will even survive reboots.
We also have a Metasploit‑persistent handler to
establish a connection on our side.