Hey there.
Welcome to the course, Post Exploitation with Meterpreter.
I'm Ricardo.
I'm a cybersecurity specialist with years of experience in the field.
And in here,
I'll show you how to use the Meterpreter tool to perform a lot of the
post‑exploitation activities in a penetration testing.
This course is all about leveraging Meterpreter for
post‑exploitation activities such as privilege escalation,
persistence, and exfiltration.
If you work in the pen test field for a while,
you know that those activities can take a lot of time
if you try to do them manually.
That's why we have Meterpreter.
With this tool we can automate a lot of they heavy lifting,
making post‑exploitation really simple.
For example, in just one command,
we can extract the password hashes for all the users in the target machine.
Or with just one command,
we can run several post‑exploitation attacks to try to get admin access.
Pretty cool, right?
And all of that being really stealthy.
As you see, Meterpreter does not save anything on the disk,
so it is harder to be detected by your traditional antivirus solutions.
So let's take a look on what we'll be learning in this course.
First,
we start by discussing what Meterpreter is and how it
does all the attacks in a stealthy way.
Then we start the hands‑on part of this course.
You'll learn how to generate a Meterpreter payload and how to
get a Meterpreter shell in a victim computer.
With the victim computer compromised,
we then explore some of the basic Meterpreter commands,
such as downloading and uploading files.
After that, we'll cover some more advanced features,
such as privilege escalation.
In here,
you'll learn some of the main techniques using Meterpreter to get admin access.
And with the admin privileges in hands,
we can then use Meterpreter to dump the password
hashes from our victim computers,
so then we can try to move laterally and get passwords for other accounts.
And with that done, we can then create persistence on the system,
meaning we can create ways so we can access the
target machine at any time we want,
even if the IT team patches the vulnerability we exploited.
We also explore here in this course how to use the Meterpreter keyloggers
so then we can try to capture sensitive information,
such as usernames and passwords.
And in the last part,
you'll learn how to use Meterpreter to search and exfiltrate data.
You'll see that with Meterpreter, we can easily search for sensitive files,
take a screenshot of the victim machine,
or even take a picture using the webcam of the victim,
which, in my opinion, is pretty creepy.
As you can see, we're going to cover a lot of stuff.
But don't worry, by the end of this course,
you'll be mastering Meterpreter,
and you'll be happy that you have this awesome tool in your skill set.
One thing to keep in mind is that this course is a really hands‑on course,
meaning that we have a lot of demos and hands‑on tasks.
Personally,
I do recommend you trying to practice the skills you learn here in your
own environment, so then you can get used to the tool.
To make this course more interesting,
we'll be following a course scenario in here.
So imagine that.
Imagine that you're a penetration tester for Globomantics,
which is an insurance company.
You're the middle of a pen test,
and you already found some initial access vectors for a server.
For example,
you found some vulnerabilities in a web server that could be compromised.
Now, since you have this vulnerability,
it's your job to exploit it and use the Meterpreter tool to escalate privileges,
establish persistence, and search for sensitive data.
This course is an intermediate course,
meaning that is expected that you have some basic
cybersecurity knowledge before starting here.
It is expected that you're familiar with the main
vulnerabilities and the security concepts.
For example,
it is expected that you know what a firewall is and how an SQL injection works.
Also, it is expected that you have some basic understanding of Metasploit.
For example,
you should know how to install Metasploit and how to run basic attacks with it.
Also, if you're brand‑new to Metasploit and you've never used it before,
I do recommend you watching two of our previous courses here at Pluralsight.
The first one is called Metasploit: Getting Started,
and the other one is called Perform Attacks with Metasploit.
Those two courses give you a really good base for this Meterpreter course.
Okay, so enough of introductions.
Let's understand what Meterpreter is and what Meterpreter can do for us.
The formal definition is that Meterpreter is an advanced Metasploit payload,
or, in other words,
Metasploit is a really complete payload that allows you to
remotely execute several attacks in your target.
So okay, to better understand this,
imagine that you're doing penetration testing against a web server.
So you poke around and you find a vulnerability that can be exploited.
Let's say this vulnerability is a remote code execution on a web server.
Then you use Metasploit to exploit this vulnerability,
and instead of sending some basic commands as a payload,
you send the Meterpreter payload to the server.
So then, when the remote code execution vulnerability is triggered,
it will load the Meterpreter code into memory and
create a callback to your machine,
so then you can execute Meterpreter commands remotely.
And when I say "executing commands remotely," it is not
only operational system commands, but also taking screenshots,
enabling keyloggers, doing privilege escalation,
memory dumping, and credential dumping.
One interesting thing about Meterpreter is that how
the code is executed in memory, and nothing is saved to the disk.
Also, no new processes are generated,
and this makes it really hard for your traditional antivirus
solution to detect this kind of attack.
So let's understand how Meterpreter accomplishes that.
First, when we're exploiting a vulnerability,
we will send a Meterpreter initial stager as a payload.
The vulnerable server will then execute this initial stager,
which you would then inject a malicious DLL into the exploited process.
For example, if you're exploiting a vulnerability in the Tomcat,
then a malicious DLL will be injected into the Tomcat process.
Once this malicious code is injected into the existing process,
the initial stager will then start an encryption TLS
connection back to the attacker machine.
In this connection we'll allow Meterpreter to send additional libraries.
Also,
we have a direct connection to the target, so then
we can execute commands remotely,
and those commands are executed directly into the memory.
And I know this might sound complicated at first, but bear with me.
During the demos, we will see those things working in real life,
and then everything will make sense.
The thing to keep in mind is that the Meterpreter
framework has three main goals in mind.
First, the Meterpreter is stealthy,
meaning that the conventional antivirus tools have trouble detecting it.
As I mentioned, Meterpreter does not save anything to the disk,
and no new processes are generated, so the tool footprint is really small.
Only advanced detection systems can detect Meterpreter.
Also, Meterpreter is really powerful.
Since we have access to several libraries and APIs,
we can do pretty much everything we want with Meterpreter.
For example, want to harvest saved credentials?
You got it.
You want to dump the Windows RAM memory?
No problem.
Also, Meterpreter is extensible.
Although it comes with several features out of the box,
anyone can create modules for Meterpreter.
For example,
you can create your own custom scripts to run in memory in your target.
Pretty cool, right?