So let's get started with our demos.
In here, you'll learn how to gather and exfiltrate sensitive files,
audio from microphones, and even webcam snapshots,
but before we go to our demo,
it is important for you to know the legal considerations of doing this.
First,
recording audio or video without the consent of the person
is illegal in most of the countries.
You can go to jail for that.
So check in your country if you can do that,
and if yes, get a formal approval from the client.
Make sure you have everything in writing.
And the best advice I can give you is stay out of trouble.
Don't try to hack your ex‑girlfriend or record things.
This is just wrong,
and it is also illegal, and the last thing you want is going
to jail for that, so don't be a criminal.
So let's go to our lab environment.
In there, we'll see how to gather sensitive files,
how to record audio and video, and how to take screenshots of a computer.
Hey there!
Welcome back to our lab environment.
In here, I already have a Meterpreter shell to my victim computer.
This shell has administrator privileges,
and I created this using the Meterpreter executable
payload in my Windows machine.
And actually, for this demo, it doesn't matter how you got the shell,
as long as it has admin privileges.
So to get this demo started,
I want to show you how to search for sensitive files using Meterpreter.
And the good news is, it couldn't be simpler.
All I have to do is type search,
and then use the flag ‑f to define the keywords that I want to search.
For example, if I want to search for all the .key files,
I just have to search * .key.
If you're not familiar, the .key files are usually SSH private keys,
and those you can use to log into other servers and move laterally.
And if you find this in a pen test, you should consider yourself lucky.
The cool thing about the search feature is that we can
search multiple terms with just one command.
For example, I can add here another ‑f flag, and then add one more search term.
For example,
if I want to find any file names that have the word user in the file name,
I just use *user*.
And again, you can do this as many times as you want.
So I will also search for files containing the words pass and creds.
Once I have the search defined,
all I have to do is press Enter, and this might take a couple minutes,
depending on the size of the disk of your victim computer, but to save us time,
I will speed up this video.
There you go, Meterpreter found a lot of files,
and to be honest,
it is kind of hard looking at those results in this Meterpreter shell.
So let me show you one trick.
Let me show you how to save the result of any Metasploit command to a file.
To do that, let me first background this session,
and then use the command spool with the name of the
file that I want to save the output.
Basically, this is saving to a file, anything I type on Metasploit,
and anything that Metasploit outputs to us.
It is a good command to keep track of everything
you do and everything you gather.
Perfect!
Now let's go back to our Meterpreter session,
and let's run the same search command again.
And a couple minutes later, we are done.
So let's take a look at the spool file.
There you go.
Take a look.
I have here a list of all the files that contain
the keywords that I searched for.
In here, there's a lot of useless stuff,
but you might find some interesting files.
And once you find the files you want,
you can use any exfiltration techniques I mentioned in the slides.
In here, as I just want to download one single file,
I will simply copy the path of the file I want,
and then use the Meterpreter download function.
Oh, wait, take a look.
It's saying here that the file was not found,
and that's because I forgot to escape the forward slashes.
Remember, this is a Linux environment,
so we need to always have double forward slashes
when referencing our Windows path.
Perfect!
Now let me rerun the download command, and that's it.
Now I have the file saved on my disk, and I can easily go to that folder,
and open the file to check what is inside.
This technique is really useful to find credentials
saved in plain text files on the disk,
and those credentials could be used to log into
other systems and move laterally.
Pretty interesting, right?
Perfect.
Now let me quickly disable the spool recorder,
because I want to show you some other cool features of Meterpreter.
And to disable the spool, I will just use spool and then off.
Perfect.
Now,
let's say that for some reason you want to see the
webcam of your victim computer. First, remember,
this might be illegal in some countries,
so make sure you have the authorization for that.
Once we have the authorization, then we can proceed.
The first step is to see if the victim computer has a webcam.
And for that, I'll use the command webcam_list, and this will tell me
all the webcams connected to the victim computer.
As you can see here, my victim computer has no webcams,
and that's kind of normal.
If you're doing a pen test against the server,
it most likely will not have a webcam.
Normally, you see webcams on laptops of employees.
So if in your case you have a laptop as the victim computer,
you could simply type webcam_snap, and then Meterpreter will take a
snapshot of the webcam of your victim computer,
or even cooler than that, we could use webcam_stream to
get a livestream from the webcam.
And in my opinion, that's really creepy.
And that's why I always have something covering my webcam. Similar to this
webcam command, we can also use the feature called record_mic,
and this would record the microphone of your victim computer. Again,
as I'm exploiting a server, there's no microphone connected to it, but
if you're exploiting someone's laptop, then that would work.
Okay, the next one is one of my favorite features.
I can use the command screenshot to take a screenshot of my victim computer.
Take a look. Easy like that.
I've got an image file in my attacker machine. So let's check it out.
See, this is a perfect screenshot of my victim computer,
and I could take as many screenshots as I want,
and this could be really useful to know what the machine is used for,
or even to discover some services that you didn't know about.
But wait, cooler than the screenshot command is the screenshare command.
Basically,
this creates a live feed from the victim computer to our computer, so then
we can watch what the person is doing. After running the command, all we
have to do is open this HTML file that Meterpreter created for us. And take
a look. We have here a live feed.
So if you do anything on the victim computer,
I will be able to see that in my attacker machine.
And this can be really useful to see what the administrators
are doing and where they serve their files.
For example,
in here we found out that the administrator has
some credentials saved in a file.
Pretty cool, right? Now, after we are done with this spying thing,
you can just go back to the Meterpreter shell, and press Ctrl+C,
and this will stop the live feed collection.