In this demonstration,
we're going to look at the power of Meterpreter extensions.
As you see here,
we've already got our Meterpreter session by doing our backdoor client‑side,
putting the file on the machine, and double‑clicking it.
We've got access,
so we've accomplished this already, so now we're going to
start from within the Meterpreter shell.
We always use the privilege escalation method,
so let's see if we can get system.
And type it in right.
So we try to get system. Not getting anything back there,
so that's kind of interesting.
So let's see what kind of system we got.
Ah, we've got a server 2016, so this is a little bit different now.
We've got server 2016; that's going to take a little bit of work, right?
Since we're talking about extensions, we want to see different things.
So, what is our session at?
So, let's background the session and look at our privilege level.
So we do sessions ‑l, if we type it right.
So we want to go into the session, so we interact with the session 1.
Now we're in session 1.
Now we're going to load extapi.
Since we're looking at extensions here, this is the extapi.
So once we get that, we're going to do a question mark,
and it shows us all the different extended API commands that we have.
So let's take a look at a couple of these up here, and you see what we have.
We have a lot of additional things.
There, of course, is our webcam.
We looked at some of that.
There's the new desktops, the user interface,
but you see there's lots of different options here,
getenv, System Commands, ps kill for process kill,
pkill, reboot reboots to remote computer,
you get the idea.
So we have all these different types of things we can do with the extapi.
So we'll go down here, and let's look at some interesting ones.
Window_enum, enumerate all current open windows,
and service_control, service_enum.
So you've got these Service Management Commands.
You've got Clipboard Management Commands.
So you have all these different things we can do, ADSI Management,
WMI, we talked a little bit about WMI,
but it's extremely powerful on Windows to use WMI through different things.
So let's go ahead and do window_enum. That enums all
the open windows on our victim.
As you see here, we see the task windows,
all that other type of stuff. So all the connections and
everything are identified with that command.
So, nice little command we can use.
It also, Metasploit's extension offers Mimikatz and Kiwi
extensions to perform various types of credential‑oriented
operations. So we can dump passwords, hashes,
dump passwords in‑memory, generate silver tickets,
gold tickets, Kerberoasting, and all kinds of cool stuff.
So the command nowadays,
because the latest version of Mimikatz is carried under load kiwi, so when
we do a load kiwi here, we loaded the kiwi extensions.
You can see there,
this is by Benjamin DELPY, the gentilkiwi, and that's where the kiwi comes from.
So now what we want to do is enter the question
mark and look at all our options.
So you see here, we have the capability to retrieve credentials,
creds_all, creds_kerberos, right, and there's your tickets,
there's your purge tickets, all that type of stuff.
But we have an interesting one here.
We have lsa_dump_secrets.
So let's try it.
So we do lsa_dump_secrets.
Mmm, see that? So it's time to try to do our privilege escalation technique.
Now, since we're on a Server 2016,
we're going to have to try to see if we can get system.
So let's go ahead and background the session. Say yes.
Do a clear. Remember suggester. And we'll run exploit
suggester on the system to see if it can help us.
Remember, we'll actually show options, we know the info, we've already done it.
Set the SESSION,
give it the session number, and the session number in this case is 1.
We also probably want to set SHOWDESCRIPTION, just so we don't select
something that doesn't match our OS.
True for SHOWDESCRIPTION, make sure we typed it properly.
Once we do that, we look pretty good, we are ready to run the exploit.
There we go.
Notice the difference here.
It's getting exploits for x64 Windows. And there it goes.
So now it's given us some different ones,
impersonation and reflection_juicy, reflection, target appears to be vulnerable.
See Windows 10, all versions of Windows Server except for Server 2019.
Well, we don't have Server 2019, we have Server 2016.
So, so far that one, either the last one, or the one
next to it, looks like the best one.
Well, unfortunately,
there's no good positive way to figure out what's what without giving it a try.
Right?
We could try the first one on the list, right? When we
look at the first one on the list, see it's got some things, registry key,
all that information, hijacking, different things, spawn
a shell, modifies the registry key.
That one seems okay.
Permanent.
Don't like these; when they start saying permanent
elevated backdoor, that's kind of scary.
So let's try the first one.
Right?
Says it appears to be vulnerable. So remember, it's trial and error.
That's the way this process works.
So we'll try this one first.
Remember the rule of thumb.
We'll clear to get up to the screen.
Always three tries.
If we don't get it in three tries, move onto something else,
try something different. And that's just our SHOWDESCRIPTION.
Okay, so let's go here and set our session, still SESSION 1, do our show options.
We should be good.
I think we've got everything set. Looks like everything is good here.
We always do the clear just to be safe on the safe side.
Let's exploit. Already in elevated state, so that one
only gives us admin, evidently.
There's our suggester. And we run our show our options. Probably would
have been good to copy them down before we got this far,
but it's okay.
Everything looks pretty good.
So now we just go and do our exploit again.
Oh, we've got to use suggesters, sorry about that. So, search, suggester,
use 0, show options, and make sure we got our options.
We do.
So now clear this, get to the top.
We just run our exploit again. So that one didn't do any good.
Those permanent, I don't like those permanent things.
So when you see those permanent things, that's kind of scary as well.
So we did have 1 that was dedicated to Server 2016, we have 2. Again,
there's no exact formula for this, except for trial and error.
So we'll try reflection_juicy, and what works today might not work tomorrow.
That's another challenge as well because it just doesn't always work.
Windows Meterpreter versus TCP. Oh, we need to set the payload because we
want windows/x64/meterpreter/reverse_tcp. Show options, set SESSION.
Looks like that's all we've got to set here.
Clear to get to the top of the screen and run
exploit. Meterpreter 2 session died.
See that? So it didn't work. When you don't get it
the first time, you try it again.
Three tries.
If you don't get it in three tries, go try another one.
And we got the dreaded exploit completed, no session created. Well,
we're not doing very good here. Let's try again.
Third time's the charm.
Stage.
Yay! Third time's the charm.
It worked! That's why we always say use three times.
So we end with the question mark, and we see the different commands.
And remember, we've got to load Kiwi. So we load Kiwi. Once we load Kiwi,
the actual thing, and now we can do our lsa_dump_secrets.
Look at all the data.
Yay! Success! Well, kind of. We have some different types of things.
We've got some hashes, we've got information there. Again,
depending on the OS you're up against,
there's certain things you can and cannot distract us.
Just the reality. So you see there, there's our SysKey,
the information there, the server AD, the keys,
the NTLM hashes, so you see the hashes there, the NTLM in SHA‑1.
So that's some of the stuff we can do.
So that's interesting stuff we could try to crack. Remember the process is the
key we're trying to cover here, so you see it. Then we do creds_all, and
there's all the credentials. Now, because it is a newer system, Windows Server
2016, that pretty much was just patched, actually it was patching when we were
doing the lab, we used to get the actual password itself, but you see here now
it's null. The reason it's null is because Microsoft realized that Mimiktaz,
and all these other tools, were dumping the password hashes and all the other
stuff, so they say okay, we don't want this to happen anymore.
So their solution was to prevent us from doing it.
So we have to do different types of things. And again, try
experimenting and do different things on your own.
So the newer versions of the OS don't show the password.
So now if we do a Kiwi command, so we can do a Kiwi command, _cmd, and we do
kerberos::list, now we've got all the Kerberos information.
So this is the Kerberos.
So we got success, kind of, but the problem is everything we're
looking ahead here is aes256_hmac, hash message authentication
code, is what you want to be able to do.
Because if you're doing an assessment of an Active Directory environment,
you're looking for the KRBTGT,
the Kerberos ticket granting ticket, and you're looking for
RC4. So you can still get the ticket to work.
There's different things you have to do, the SID, other
details, you can discover in your research.
But before we do it,
since this is kind of how Microsoft changed the way they did their
storage, we can try to do some different types of things, and we can
try to look at some login passwords.
So, if we go kiwi_cmd sekurlsa::logonpasswords, and you
see we've dumped the hashes again, but it doesn't give us the password.
You see how the password there is listed as null. Let's go up and see if we
have any better luck on any of the other accounts. In this case, you see
pretty much everything we've got is the same as before.
And that's good because it's an improvement for security. You see right there,
the password's null. We do have the hashes, so we can do
different types of things with the hashes.
But we used to have in that password field, we used to have the actual password.
But again, Microsoft's improved, so that's a good thing.
We never want to actually never see improvements, so give them credit.
They've improved there. So, this is the process, so you'd
run through all these different commands, and I said, this
is Mimikatz using the Kiwi.
So from here,
what you would do is identify a service, once you've done that and you
need to pass the ticket of the service, and then attempt to remote into
the machine, and all those types of things.
But of course, it's going to depend on what the administrator has kept
figured on the machine, and that's the reality of any time you're doing
any type of this testing, in this case,
the actual extensions within the Meterpreter shell. Some
things work, some things don't work.
What might work today won't work tomorrow. But also, what doesn't work
today might work tomorrow when people make a mistake.
The key, as we said all along, is the process.
Once you understand the process and look at the way the process works,
then you're on your way to do an effective Metasploit attacking of
machines. And with that, we've accomplished what we wanted to in this
demonstration, and we'll conclude the demonstration here.