In this module,
we're going to talk about the advantages of the powerful Meterpreter shell.
This is an advanced shell that automates many of the manual
tasks like adding a route to a hidden network,
handling bulk file uploads and downloads,
lots of different things we can do with this powerful payload.
Now if we look here at the overview,
the first thing you see is we're going to explore the
power of the Meterpreter shell, and as we mentioned,
it is an extremely powerful tool.
In the previous module, we saw some of the capabilities of the shell,
but we've barely scratched the surface of this powerful tool.
The next thing we'll do is look at the methods of persistence.
The concept is once we gain access, we want to make sure we maintain that access.
We do this with a variety of different methods.
And the last thing we'll look at in this module are the
extensions and how we can leverage these to do even more
powerful techniques with this shell.
In this section,
we're going to get to know more about the Meterpreter shell payload
and the different things that make it so special.
Here are some examples of why many consider this to be the king of payloads.
We have a fileless capability.
That fileless capability is powerful because that means nothing
that is used in this payload hits the file system.
All of the capabilities are carried out within memory,
so unless the defensive tool we are up against is scanning memory,
we go undetected for the most part.
One of the often overlooked features, and a favorite,
is that of file manipulation.
Some will use the upload and download features,
but there's so many more features than that.
You can create advanced installer packages,
as well as cabinet files or scripts to run on the different
local machines once the payload is implanted.
And again, this implant is all in memory, nothing touches the file system.
That is powerful stuff.
If that's not impressive enough,
we also have the fact that all the communication channel is encrypted.
So if we're using protocol analyzers,
it's not visible to any type of monitoring device.
Then we have the capability to do migration.
We can migrate across memory space to other processes.
This has a couple of benefits for us.
The first is we do not know if our initial access will be stable.
So by using the migrate capability, we can migrate to a more stable process.
The other benefit is there is a chance that that process we migrate
to will have a higher level of privileges for us,
and that's powerful stuff.
And then we have pivoting.
This is a concept that not all networks will be directly reachable to us.
We may need to gain initial access and then leverage that
access and pivot into another network.
This requires routing and other items to be configured and set up.
The Meterpreter shell allows most of this to be
configured with one or two commands.
We can now discuss some of the features.
We mentioned it is fileless.
It accomplishes this by injection of code directly into
the memory of the running process.
With a Windows machine, this is done with dynamic‑link library,
or DLL injection,
and is a popular way to gain and leverage access against a Windows machine.
Meterpreter is an advanced dynamically extensible payload
that uses in‑memory DLL injection stagers and it's extended
over the network at runtime.
It communicates over the stage or socket, a comprehensive client‑side Ruby API.
It features command history, tab completion, channels, and more.
Think of it like a shell that runs in computer memory rather
than from disk so that your actions are less likely to trigger
an antivirus software program.
Now that we've discussed the injection capability, let's talk exfiltration.
From a military standpoint,
this is seen as to escape from an area under military control.
For IT purposes, we are extracting the data from a victim's system,
and in short, an unauthorized transfer of information.
There are many features of the tool, so these are offered as an example.
You are encouraged to explore on your own.
The next feature we want to talk about is the ability of
port forwarding. In its simplest terms,
it's like taking something in one port and then forwarding out on another port.
We can use this to diverse networks that have filtering at their boundaries.
We are now ready for a demonstration.
In this demo,
we'll review the power and see some of the capabilities that we can use
once we have implanted the Meterpreter shell on a machine.
Enjoy the demo.