Keyloggers are a really powerful technique during a pen test or red
team engagement. It allows you to capture username and passwords that
can be used to log into other systems. The good news for us is that
Meterpreter has its own keylogger.
We don't have to use any additional software for that.
You just enable the feature meterpreter and then
later go collect the keystrokes.
But similar to recording audio and video, using
keyloggers might be legal in some countries.
So check your local laws and get formal approval from the
client before using this technique.
Alright,
let's go to our lab environment, and let's see how to
use the Meterpreter keylogger. Also,
we'll take a quick look on how to clean up your tracks using Meterpreter.
Hey there, we're back to our lab environment.
As always, I have in here a Meterpreter session with admin privileges.
So, let me show you how simple it is to use the Meterpreter keylogger.
All I have to do is type keyscan_start,
and this will start a keylogger in my victim computer.
Perfect.
Now,
everything that a person types will be recorded, and if you don't believe me,
take a look.
Let me type some credentials here in the victim computer.
I'm typing my username and password.
Now, when I go back to the Meterpreter,
I can simply type keyscan_dump, and this will get all the key
strokes that are typed in the victim computer. And note here
that I get every single keystroke.
For example,
I press Tab to change from the username field to the password field,
and I use Right Shift when I was typing my password.
In this way,
it is really easy to get credentials from users, so
then it can access other systems.
And the best part is it is totally transparent for the
victim. There's no alerts or suspicious items.
Also, even though I use the keyscan_dump function,
the keylogger is still active.
So, everything that I'm typing on the Windows box is
still being captured by the keylogger.
So later, I can go back to the Meterpreter session and use the keyscan_dump
again. And it is important to note a few things here.
First, Meterpreter only shows me the keystrokes since
the last time I ran the keyscan_dump.
Take a look, here we have only the new data. Also, note that
even things that are deleted are still here.
Every time you see this capital H keystroke here,
it means that I pressed backspace.
So in here, for example, I wrote the word deleting.
Then I pressed backspace eight times, and then I wrote writing. Really cool,
right?
And whenever I want to stop this keylogger,
I just have to type keyscan_stop, and this will stop the
keylogger process in the victim computer.
Perfect.
So before we go, I want to show you one more cool feature.
I want to show you how you can clear your tracks on the victim machine.
Even though we are using some stealthy techniques, some of our actions
generated logs in the Windows computer.
If we open the Windows Event Viewer, we can see in the security
logs some of the suspicious things we've done.
For example,
we have a security log for the account oracle, and
remember, that one we create as a backdoor.
There are also some failed login attempts that I made, and this can be
really suspicious for an administrator if they're checking the logs.
So, we can use Meterpreter to clear those logs for us. All we have to
do is go to our Meterpreter shell and then type clearev. The ev stands
for Event Viewer.
And when I run this command, Meterpreter would delete all
the logs in the Windows box. Interesting,
right?
So, let's go back to the Windows machine and take a look in there. In here, I
would just close and open the Event Viewer to refresh the data. And take a
look, the Event Viewer is basically clean now.
Meterpreter deleted pretty much all the events,
and we have here just one new event from a few seconds ago.
In my opinion,
I find this really cool because it's really used to cover your tracks.
But keep in mind two things. First,
if the company has a centralized log collector or a SIEM solution,
a copy of the logs is sent in real time to outside of the box,
meaning that if the company has one of those solutions, we're
able to delete the logs in the Windows machine.
But, the company will still have a copy of the logs in their detection system.
Another thing to keep in mind is that in a real pen test,
clients do not like the idea of a pen tester deleting their tracks.
So, make sure you talk to your client and ask them if you should
include hiding tracks on the scope or not.