The capability to expand Meterpreter is provided through extensions. We have
powerful and extremely effective extensions we can use to gather even more
data and improve our access into the victim machine.
Meterpreter extensions allow you to enable a variety of
things all from within the existing shell.
As we see here, we have powerful extensions,
we have PowerShell, these can be used to run a variety of scripts for us
where we can custom tune and create our own scripts.
Then we have Mimikatz, which in the modern day the extension that
is recommended to load is the Kiwi extension.
The Kiwi is in reference to the founder and creator of
Mimikatz being from New Zealand.
This tool is one of the most popular,
not just for us and our testing, but also for the advanced hacking groups.
There are so many things you can do with the tool when it
comes to data extraction, it is amazing.
Next, we have the API, or application programming interface, call.
This is where Meterpreter provides the capability for interaction
with the victim machine at the lowest level. The client on the
attacker's machine loads of the local extension API and can now
call the extension's functions.
This entire process is seamless and takes approximately one second to complete.
An example of this is using the webcam tools. We can snap a
picture and control the cam from within the Meterpreter shell. We
have two more things we'd like to talk about when it comes to
extensions. Meterpreter, as we said, has all these different features.
So more for us is the keyloggers.
We can set up a keystroke logger on the victim and record
any and all keystrokes that are entered including
credentials and other important data.
This is not something you'll typically do in a
professional assessment, but it could be used.
The next thing we have are the controls and how we can control
the different things that we have commands for.
We talked a little bit about the webcam tool, that's
an example of using these controls.
If there is a webcam we can snap a picture.
We do the keystroke logger, we can take the different
types of captures of the keystrokes.
We can also take screenshots and copies of the desktop.
All this is from within Meterpreter when we load these extensions
and we also can pull a lot of additional data from the actual
machine itself, that's what Meterpreter is made for, the advanced
exfiltration of the data.
There are many things for us to explore.
We even have the capability to modify the modified,
accessed, and created time of files.
This can be used to defeat forensics and it actually was created as part of
the anti‑forensics project that Metasploit used to be a part of, but was no
longer continued, but it's still, the capability is there in the Meterpreter
shell. This brings us to our demo.
In this demonstration,
we're going to look at some of the extensions and the capabilities of what we
can expect when using these extensions. Enjoy the demo.