In addition to post modules and local exploits for post exploitation activities,
the Metasploit framework includes Meterpreter.
We introduced Meterpreter earlier in the course.
Now let's look at it in more depth.
There's a lot of capability with Meterpreter, and we will
unfortunately not be able to cover all of it here.
Meterpreter is a primary tool for post exploitation operations,
given its feature set. Here are just a few ways in which it
can be used in post exploitation operations.
There are commands that allow us to explore the compromised system,
including its files and configuration.
We can monitor the users of the system, capture keystrokes,
screen shots, and audio.
It includes tools to establish persistence,
and it can utilize local exploits and post modules.
Meterpreter can also be used to pivot to other
systems in the target environment.
Meterpreter functionality can be enhanced through the use of extensions.
They provide additional capabilities for managing
post exploitation on target systems.
The extapi, or extended API, provides extended Windows
functionality for managing services, the user's clipboard,
Active Directory services interfaces, and Windows
management instrumentation queries.
The sniffer extension provides packet capture capabilities; espia provides
access to the webcam and microphone on the target; kiwi will grab
credentials from Windows memory, lanattacks allows you to start rogue DHCP
and TFTP servers for attacking other systems on the target systems network.
Incognito can dump password hashes and conduct token impersonation attacks.
Networkpug can craft network packets to send on the target network using the
target system.
It can also receive packets.
The Privilege Escalation Library, or priv,
is used to acquire higher privileges or to use those higher privileges.
The timestomp command is used to modify the creation,
modification, and access times for files on the system.
The hashdump command will dump the contents of the
password database on a system.
The hashes can be used for pass‑the‑hash attacks or password cracking.
The getsystem command attempts several methods for elevating your
current process to system‑level privileges.
Meterpreter can also target the user of the system.
This functionality may be needed if the user is an
administrator or someone with access to sensitive data.
Meterpreter includes ways to gather data about and from the user.
We may need to do some work without alerting the user.
You can check the user idle time with the idletime command.
You can migrate the Meterpreter session to a user process and monitor their
keystrokes to capture passwords and other valuable information.
First,
you have to find the appropriate process ID, migrate Meterpreter to
it, and then enable keyscan and dump the keystrokes.
We can even capture audio from the system's microphone.
Now let's get this Meterpreter demonstration underway.
As always,
we need to know how to find help within Meterpreter
using the built‑in documentation.
We will use the standard API to explore the file system,
use the priv Library for privilege escalation, the
incognito extension for persistent user access,
execute a post module, and focus on the system user
with user interface commands.
That's a lot, and again,
we will only scratch the surface of Meterpreter capabilities here.
The standard API commands are our first look at the capabilities of Meterpreter.
Now let's look at a list of those commands with the help command. Notice,
there are a lot of commands in just the standard API.
Let's start by checking our privilege level with getuid. Notice we have
the privileges of an administrator of the system.
Let's acquire some information about our target system with the sysinfo command.
Let's take a look at the file system with the cd, pwd, and ls commands.
Remember, these are most like Unix shell commands.
We can search the local file system using the search command.
Here's a simple way to find rtf documents on the local system.
The ps command lists running processes.
Let's look at the priv library for privilege escalation commands.
Here are the available commands for priv.
Notice the three commands, timestomp, hashdump, and getsystem.
Let's use timestomp to set the times of a specific file on the system.
Let's change the win.ini file to an unlikely value. With
this timestomp command, we are setting the modification time
to an interesting time in 1970.
Here's the effect on the file.
The hashdump command lists all of the password hashes on the
system. On this system, hashdump fails.
We may have to try a local exploit to get those password hashes.
The getsystem command will attempt acquire system
privileges using several techniques.
If those fail,
you might also need to try a local exploit. The getuid command
will show you the current privilege level.
We are currently at the highest level for the Windows system.
Now let's look at persistence.
These will be commands to create an account and examine the
environment and the user for data that could be used to maintain
a foothold on the system for later use.
First,
we'll start with loading the incognito extension. Incognito
has a command to create a user account.
It also has a lot of other capabilities for managing tokens as well.
That's a bit beyond our introductory level here, but be
aware that this extension provides it.
You can also create a user account with a post module.
One way to use that user account might be through an rdp session.
We can enable rdp if it's not enabled using this post module Just use
the run command with a path to the post module.
Notice how this script handles everything to enable rdp,
including opening a port in the firewall.
This might be noticed by the user or admin,
but then again,
maybe not. Now let's look at some of the user interface
oriented commands in Meterpreter.
We may be exploring a target while user is using the system as well.
We might draw some suspicion from the user if our
exploration caused some performance issues. We may need to
find a time when the user is not present,
or at least not using the computer.
The idletime command will show you information about how
long the user has not been active.
Meterpreter can also capture the key strokes of the user.
This can be useful for capturing passwords and other sensitive
information that could be used in further exploratory work.
To make the keyscan commands work,
we need to migrate Meterpreter to the process from which
we want to capture those keystrokes.
First,
let's identify a process. For our demo, let's look at the notepad.exe
process running under the user. In the real world,
you'd probably pick a shell or an ssh process or even a web browser.
Next, we use the migrate command and the process ID.
Once migrated,
we can start capturing the keystrokes with the keyscan_start
command. After a while, we can dump the keystrokes we found.
Meterpreter can capture a screenshot of the desktop.
This can be useful for seeing sensitive information on the
screen or just as proof that the system was compromised
during the penetration test.
Meterpreter can also capture audio from the computer
microphone and even change the user interface,
for example, disabling the mouse and keyboard.
We aren't doing that now,
but you can see the documentation for each of those commands here.
Well,
that completes our demonstration of just a few of
the capabilities of Meterpreter.