In this demonstration, we're going to look at the power of Meterpreter.
We start as we did before, with the client providing us access to the machine.
We've accomplished this already,
so we'll start from within the Meterpreter shell.
As you see here, we've already got our session.
We've shown we can use this access and perform privilege escalation.
So now what we want to do is look at some of the
additional features of the Meterpreter tool.
The quickest way is by entering a question mark.
As you see, there are a lot of options here.
We see here we have Timestomp commands, which is forensics.
We've got Password database Commands, Elevate Commands,
and Audio Output Commands.
And there's a lot of different features we have here.
So when you look at it, it's an extremely powerful tool.
And that's what we've been saying all along, the tool is very powerful.
There's your Webcam Commands.
You see record_mic, chat, list, snap, webcam_stream.
Your keystroke logger stuff.
So you've got all the different things you can do for keystroke logging,
enumdesktops, getdesktop, all these different types of things.
So a lot of information.
So one of the first things you want to do is we want
to look at the system we're on.
So sysinfo command comes up and shows us we're on a Windows 10.
And since we're on a Windows 10, we know it's a domain server‑AD.
Right there is the Active Directory's Logged On Users 7.
So we've extracted information, it's an x64,
but as you notice, our Meterpreter's an x86.
Now we'll want to prove that in the future.
So now the next thing we have to do, let's enter hashdump.
As you see, the parameter operation failed.
We get an error.
Why is this?
Because there's protections in place.
So we have to load extensions for the newer operating systems.
We'll save that for later when we do that.
We can try some enumeration scripts that have been
created to make our task easier.
Why else it might fail?
Remember the level of access in the shell?
What do we currently have?
What access level, right?
So these are the types of things to start.
So we can try the getsys as we did before and see if we have any luck.
So if we do getsys, see it fails.
So that doesn't give us any luck.
So we've got different types of mechanisms that we can do.
So we can use the same,
that method before and get a module for privilege escalation.
So now I've background the session, I'll do a search for the suggester,
remember the exploit suggester, there it is,
use 0.
Now I'm in the exploit_ suggester, remember the info,
there you go, information we can get all about it,
and what do we need?
We need to set the sessions.
So we know we've got set SESSION 2.
And now we just run exploit, and we look at the local exploits.
Now the key here also is we've got x86/windows,
so we want to improve on that in the future,
but right now we'll stick with the x86.
You see now we've got these different vulnerabilities that
the target appears to be vulnerable to.
Now remember, it's not 100%, so sometimes it won't work.
But let's try this one here, tokenmagic.
Copy this, we use it, and we paste it.
As always, you get into info and you read about it.
And you see it module leverages a User Account Control bypass,
TokenMagic,
in order to spawn a process/conducts a DLL hijacking
attack to gain SYSTEM‑level privileges.
Windows 7‑10, and we know we've got Windows 10 from the sysinfo.
So that's some good stuff.
So now what we want to do is what's required.
Well, always safest is to say show options.
And you see the one requirement that we don't have is the session.
So we do a set SESSION 2, and then see if we can exploit it.
We forgot our LHOST.
Nice thing is the tool tells us when we miss something.
And now we do the exploit.
Now it's trying to PrivEsc. There it goes, running the exploit, enjoy the shell.
And if all goes well, we'll get another Meterpreter shell.
But remember, exploitation's not 100%.
So sometimes we have to do it again.
Sometimes it takes more than one try.
And we try it, if we don't get it on a third try,
we usually document it and move on.
So we need to get that same privilege level that we had before.
So if we don't get that, we're going to have to try again.
So, so far, we're not doing any good here.
It's saying enjoy the shell, but nothing's happening.
So we'll Ctrl+C break it, and we do a clear to get, put exploit.
So we try again.
There it's sending the stage.
There it is.
So now we have our Meterpreter session.
As soon as we get that, we try our command hashdump, and we're successful.
So that's all it took.
We didn't have the privilege level we needed to have.
But now we have a privilege shell, so now we could crack passwords.
For now we'll look at some other methods.
A good way to look at it is to ask the tool.
So if we do a run post/windows/gather, and we hit Tab,
and it says all 130 possibilities,
and you look at all the different options we have for post exploitation,
and that's what this process is.
So now we see we have lots of options.
Any one of these can be used.
So we'll look at one here.
Let's do gather/tcpnetstat.
This is going to run a netstat on the machine.
As you can see here, we have our connections.
So we see our connections and they're identified here the two sessions, right?
Because we had the one session, and now they have the privilege session.
And what their identifier is, is the port.
And you see here our port of four things.
So we have one more tool we'll run, and it might crash the system,
but it's a good time to try it out.
It's a post module, and we'll run bloodhound.
Before we do that, let's clean up our screen.
So we'll background the session, and then we'll clear the screen,
and then we'll interact with it.
It's good practice anyway.
Remember there's our sessions we want.
The highest‑level of privilege is NT AUTHORITY/SYSTEM.
Now we can run our post/windows/gather/ and bloodhound.
And there it goes.
And it starts running all these different things.
So you see it's got the IP, it's using a bunch of PowerShell scripts,
downloaded information from the machine,
so we have a lot of different things that it's doing.
All these different options in Meterpreter gives you extreme power,
and that's why we wanted to show you the different options so
you can practice doing the different ones.
And really,
it's one of those things that's going to determine how your
approach is based on your scope of work.
So you're going to get a scope of work when you're doing professional testing,
and that scope of work will tell you what you can and cannot do.
As you see here, it's dumping.
It's going in here and dumping some trusts, it's dumping directory services.
And then the domain, it didn't pick up the domain.
And then it gets some XML information in here that's going to
be included inside of your actual database.
And that's another thing that we'll cover in another time.
So we wanted you to see the powerful feature of bloodhound.
As we said, you're encouraged to explore the different ones on your own.
And there we go, we've got the Meterpreter shell.
So if we background the session and we do our clear,
and we do our sessions ‑l,
we see we've got our two sessions still there and available.
We've got pretty much anything we want.
So we'll do one more thing here.
If we do ‑i 4, we get into it and we go shell, that puts us in a regular shell.
So now we're in the regular shell on the machine.
We can do netstat ‑an, and there's our connections there as well.
So just different things you can do because of the
extreme power of the Meterpreter shell.
And with that, we've accomplished what we wanted in this demonstration,
and we'll conclude the demonstration here.