Perfect.
Now that we have a Meterpreter shell to our victim,
we can start to explore some of the commands that we
can execute in our victim computer.
The majority of the Meterpreter features are already
preloaded in the Meterpreter client.
So after having a session open, we can start to execute commands in the server.
For some more advanced features, like extracting credentials from memory,
we might have to load additional modules into the session.
But don't worry, this is really simple.
So let's go to our demo.
In here, we'll start to explore some of the basic Meterpreter features,
such as navigating between Meterpreter sessions,
using some basic Meterpreter commands,
running some OS commands via the Meterpreter this session,
and even downloading and uploading files to our target machine.
So enough of talking, let's go to our virtual machine.
Welcome back to our lab environment.
As you can see, I have here my attacker machine, and here my victim machine.
In this Windows machine, I already have my vulnerable server running.
But this time I'm logged as a low‑privileged user, not as an admin.
So let's start this demo by exploiting this
vulnerability to get an Meterpreter shell.
In here, I'm using the exact same configuration as I used in the previous demo.
So all we have to do is run this exploit.
Done. We have here our Meterpreter shell.
Usually, when I get a Meterpreter shell,
the first thing I like to do is verifying which user I'm logged with.
For that, I'll use this command getuid.
As you can see, now I'm logged as mjackson.
Also, I usually like to double check the IP machine that I'm logged into,
just to make sure I'm not attacking another machine by mistake.
For that, I'll use ipconfig.
Done.
As you can see, this is the right IP for the right machine.
Perfect.
Another thing I like to do is take a look on some of the
information about the operational system.
Remember, in a real pen test,
we don't know beforehand all the specifications of our target,
so it is really important to understand that.
And for that, I'll use this command sysinfo.
Perfect.
So we know that we are dealing with a Windows 2016 server.
Also,
I'd like to take a quick look on the processes that are running on the machine,
and for that I'll use the command ps, which will list all the processes for me.
And this is good just to have an idea of what is running the
machine and what the machine is used for.
Perfect.
As you can see, in less than 1 minute,
we're able to know which user we are logged into,
the network configuration, the operational system,
and even the processes running on the machine.
And this already gives us a lot of good information about the target.
Now, quick pause here.
Let's say I'm working on this machine,
but then I have to stop and work in the other machine.
I can background this session so I can use it later.
For that, I'll use the command bg.
As you can see, Metasploit put this session the background,
meaning that this session will still be open,
running in the background,
and you can check the open sessions by using sessions ‑l.
And take a look, we can see our Meterpreter session right there.
So now we can do anything we want on Metasploit,
and even work in other machines.
And then when we're ready to go back to that session,
we just use the command sessions ‑i,
and then the number of the session that I want to restore.
In my case, the session number is 8.
Perfect.
So we're back to the Meterpreter session.
And note here that we didn't have to re‑exploit the machine.
The session was already open.
But let's say that we really want to close the Meterpreter session.
You can just type exit, and his will close the Meterpreter session.
And this means that the processes running on the
victim computer will also be closed.
But keep in mind that you should only do that if you're really sure
that you don't need to work on this machine anymore.
Because if you have to reconnect to this machine,
you have to re‑exploit the vulnerability.
Perfect.
So before we continue, I want to show you the help page for Meterpreter.
To take a look at it, we just type help and press Enter.
In here, you get a list of all the commands from Meterpreter.
For example, the bg command that I just mentioned is there.
And also the getuid command is also here.
In this course we will cover the most important commands,
but I do recommend you taking some time and explore this list.
You might find in here some interesting commands that might be helpful for you.
For example, one of the most useful commands in my opinion is the shell command.
This command opens the shell to the victim computer.
And the good thing about using shell via Meterpreter is that if for
some reason this operation system shell freezes,
we can launch a new shell with Meterpreter.
We don't need to re‑exploit the vulnerability.
The thing to keep in mind that this now is a regular operational system shell,
so we can use Windows commands here.
For example, If you want to know all the local users in the server,
we can run net users.
And this can be really helpful to understand how many
people actually use this server.
And if you want to know more information about a specific user,
we can type net users, and then the username that we want to know about.
In my case, I will check the information for this user, mjackson.
As you can see, this user is just a regular user.
It is not part of the administrator group.
So we have one more piece of information.
We could also use this shell here to go through the files of this
user and try to find something interesting.
But instead of using the Windows shell,
we can also use the Meterpreter shell for that.
So I will exit this window here.
And don't worry, this will close only the operational system shell.
It will not close the Meterpreter shell.
And take a look.
As you can see,
I'm back to a normal Meterpreter session, and I
didn't have to re‑exploit the server.
So as I mentioned,
we can use the Meterpreter shell to go through the folders of this computer.
For example, I can use cd c:/Users/mjackson.
And here I can use the command pwd to confirm that I'm in
the right directory, and we can also use dir to check what
is inside of the directory.
Cool. Take a look; there's a lot of stuff in here. So let
me enter in the directory Documents.
Perfect.
So let's say that I want to copy a file from my
attacker machine to the victim machine.
For that, I can use the command upload, and then the
path to the file that I want to upload.
And that's it.
Pretty easy,
right? To check if the file was transferred properly, I can use dir and
check if the file name is in there. To double check, we can even use the
cat command to check what is inside of the file.
Now, let's say that we want to do the opposite.
Let's say that I found an interesting file on the server, and I want
to transfer that file to my attacker machine. For example, take a look
at this file here, oracle‑servers.txt.
It sounds interesting to me,
so let's take a quick look at it using the command cat and then the file name.
Nice, it looks like the file contains the addresses for Oracle servers,
which can be really interesting to me.
So let me transfer that to my attacker machine.
And for that, I'll use the download command and then the file name of the
file that I want to transfer. Done. And easy like that, I have the file
transferred to my computer into the root folder.
So if I open a new terminal and go to the root folder, I can see the
file that I downloaded in there. And take a look, we have here the
list of the Oracle servers for Globomantics.
Awesome.
I hope you enjoyed this module. We discussed a lot of topics in here, so
let's take a minute to summarize what we learned. First,
we discussed what Meterpreter is and how sessions work.
Then you learned how to get an Meterpreter shell. And
remember, that can be done by exploiting a vulnerability,
upgrading a Metasploit session, or even by using a malicious executable.
Also, you learned some of the basic Meterpreter commands,
like how to change folders,
how to download and upload a file, and how to run OS
commands using the Meterpreter shell.
Pretty cool, right?
Amazing.
We're off to a great start.
So now that we know all the Meterpreter their basics,
we can then start to do some more advanced things.
In the next module, we'll explore how to escalate privileges using Meterpreter.
So I hope you're excited.
I'll see you there.