-: Meterpreter, a crowd favorite for payloads. 2 2
So we've talked about bind and reverse payloads, 3 3
and now we're gonna talk about Meterpreter. 4 4
So Meterpreter is gonna be used in our gaining access 5 5
and then we're gonna use that throughout 6 6
the rest of our stages, our escalation of privilege, 7 7
maintaining access, and covering our tracks 8 8
and setting our back doors. 9 9
Now, what is Meterpreter? 10 10
Meterpreter is a multi-faceted payload that operates via 11 11
a Dynamic Link Library injection, so a DLL injection. 12 12
And it's included as part of our Metasploit Framework, 13 13
which is that MSF that we're using inside Kali Linux. 14 14
That's gonna allow us to load it 15 15
and attack onto a victim platform. 16 16
The nice thing about Meterpreter is that it 17 17
resides in volatile memory of the target 18 18
and it leaves no traces on the hard drive. 19 19
So, it's difficult to detect when you're using 20 20
conventional forensic techniques, 21 21
which makes it great for us an attacker, 22 22
not so great for us if we're the defenders. 23 23
The nice thing about Meterpreter is that it uses 24 24
DLL injection to get exploited processes, this getpid. 25 25
Now what happens is it's gonna actually hook the Windows 32 26 26
API LoadLibrary, and by doing that it's gonna change 27 27
these lower level APIs inside of Windows to allow us to load 28 28
the met server DLL from memory. 29 29
By keeping it all in memory, it keeps it out of the logs, 30 30
it keeps it off the hard drive, it makes it very hard 31 31
for the defenders to go back and find it afterwards. 32 32
The other great thing we're gonna find with Meterpreter 33 33
is that it just has loads of functionality for us. 34 34
So, when we set up Meterpreter, we're gonna do this inside 35 35
the Metasploit framework. 36 36
So if we're inside the the msf console, 37 37
we're gonna do use exploit slash multi handler, 38 38
we're gonna then set our payload, 39 39
so set payload windows/meterpreter/reverse tcp. 40 40
We're gonna set our host and our port, 41 41
so that's our Kali IP and whatever port we're gonna use, 42 42
2541, 4444, 443, whatever it is, 43 43
and then we're gonna do our exploit. 44 44
Now, once we've set our payload, 45 45
our listening host, and listening port, 46 46
we'll be able to receive a callback from our exploited host. 47 47
Now once you get you get into Meterpreter, 48 48
you'll see there's a ton of different commands. 49 49
Now I'm not gonna show you all of them, 50 50
but if you wanna see them all just type help or "?" 51 51
once you get to a Meterpreter prompt. 52 52
So, background is gonna move the 53 53
current session to the background, 54 54
and this is gonna allow us to hack multiple boxes at once. 55 55
So, if I have a first exploited target, 56 56
I can type "background," set up a second attack, 57 57
go after a second box, and then background that 58 58
and go back to the first one. 59 59
And I can go between multiple different targets at one time. 60 60
This is very useful to be able to 61 61
interact with background sessions. 62 62
Sessions: if I type in sessions, 63 63
I'll be able to see all the active sessions I have. 64 64
So again, I can have two, three, 65 65
four different targets online, 66 66
and have active connections with each of them, 67 67
and then switch between them. 68 68
I can also kill those sessions, 69 69
kill all of them, or kill specific sessions. 70 70
So to do that, I'm gonna use sessions-i, 71 71
and then the number that's interact, 72 72
so if I was gonna interact with my first session, 73 73
it'd be session-i1. 74 74
Then if I wanted to go to the other one, 75 75
I'd type background sessions-i2, 76 76
and that would get me to the second one. 77 77
If I want to kill that connection, 78 78
I would just type sessions -k1, 79 79
and that would kill the connection to one. 80 80
If I want to kill all of them, 81 81
it's sessions -K. 82 82
So some other Meterpreter commands that are helpful: 83 83
the Help, the Load, the Migrate, and the Quit. 84 84
So when you type in Help, you're gonna get the list 85 85
of all the commands that Meterpreter understands. 86 86
This is useful when you're first starting out 87 87
to start learning how Meterpreter works and what different 88 88
things there are that you can do. 89 89
These screen shots you're seeing now 90 90
come from that Help menu. 91 91
Now, if we go into Migrate, that's gonna migrate 92 92
our server from one process to another. 93 93
Now when we talk about server, 94 94
we're talking about the Meterpreter server. 95 95
That's the connection that we have with our victim. 96 96
So, we're gonna fork our Meterpreter 97 97
into a different process. 98 98
So, for instance, if my attack went in 99 99
through Internet Explorer, that tends to crash a lot. 100 100
So I would wanna migrate out of Internet Explorer 101 101
into something more stable, like Explorer, 102 102
which is the file system browser. 103 103
You also can do this while you're doing your 104 104
maintaining access and covering our tracks phases, 105 105
we'll talk about that more later, to hide ourself, 106 106
or to migrate into another process that might have better 107 107
permissions that gives us higher level access. 108 108
So, here's an example of Migrate: 109 109
so you'll see up top we have some legitimate processes, 110 110
we have win logon, lass, service host, 111 111
explorer, and web 32 res. 112 112
Now, when I initially broke in, 113 113
I'm gonna break in using a calc program, 114 114
a calculator program, so therefore I'm now sitting in Calc. 115 115
Now, if I migrate you're gonna see that 116 116
the Calc is gonna go away, but I'm gonna maintain my access. 117 117
And the way we do that is my doing Migrate, 118 118
and we'll migrate from the PID of 3028 119 119
into where I wanna go, 120 120
which might be the Explorer PID of 1064. 121 121
Some other nice things that Meterpreter allows you to do 122 122
is you can download and upload files. 123 123
You can also get your lurking directories 124 124
and figure out where you are. 125 125
Some exploits you do are not gonna give you 126 126
the path name of where you are. 127 127
So you're not gonna see this C:/32. 128 128
You might just get a blank prompt. 129 129
So by using the, printing the working directory, 130 130
I'll be able to figure out where I am 131 131
on the victim's system. 132 132
Now, the download and upload work just like they say. 133 133
You type in download and a file name 134 134
and it will take that file from the victim 135 135
and bring it to your local Kali machine. 136 136
That way, you can do that information gathering, 137 137
and be able to use that as part 138 138
of your exploitation later on. 139 139
Some other commands we have, we have arp and ifconfig and 140 140
ipconfig and netstat and port forwarding and route. 141 141
We're gonna talk about more of these later on in other 142 142
lectures as we start playing through some of these commands, 143 143
but this is really just some of your networking commands 144 144
that you have inside Meterpreter. 145 145
Here's some additional commands 146 146
that we have inside Meterpreter. 147 147
We have clear ev. 148 148
This is clearing your event log. 149 149
This is useful during covering your tracks phase. 150 150
We also can drop tokens or steal tokens so that we can start 151 151
pretending that we're some other user on the system. 152 152
So for instance if I got onto a user box 153 153
and the domain admin had also been on that box, 154 154
I might be able to steal their token 155 155
and impersonate them and start going around 156 156
the network as if I was the domain admin. 157 157
We can execute commands, we can get the PIDs 158 158
so we know what process we're currently in, 159 159
we can migrate into other processes, 160 160
we can reboot the computer, we can revert ourself 161 161
back to the initial user we were. 162 162
We can drop into a shell. 163 163
Just typing shell will get us to the C prompt, for instance. 164 164
There's lots of different things that we can do 165 165
and as you play with Meterpreter 166 166
you're gonna get better and better at using it. 167 167
So one of the things I really like with Meterpreter is that 168 168
it comes with built-in keystroke capturing. 169 169
So, if I have gotten onto a user's machine, 170 170
I can actually use keyscan start, 171 171
and start a keylogger on that machine. 172 172
So if they start going into their bank accounts, 173 173
their Facebook, their email, I start capturing 174 174
all those keystrokes, the user names, the passwords, 175 175
the things that they're writing. 176 176
And when I go ahead and do a key scan dump 177 177
I'll be able to see that on my screen. 178 178
Some other things that you can do here is 179 179
you can actually do a screen shot, 180 180
and by doing a screen shot, you can actually capture 181 181
what's on their screen and see what they're seeing, 182 182
and you'll get that as a ping image, 183 183
and that'll be again on your local KALI machine, 184 184
so you'll see what the victim is seeing. 185 185
It allows you to see in our Graphical User Environment 186 186
world what that user is seeing in their world. 187 187
And so again, to use the keylogger, 188 188
key scan start starts your keylogging, 189 189
key scan stop stops your keylogging, 190 190
key scan dump shows you those keystrokes 191 191
that have been captured. 192 192
So, here's just a quick example on the screen 193 193
of what it will look like in Meterpreter. 194 194
Getuid will tell me what I am. 195 195
In this case, I wanna be system. 196 196
Ps tells me the processes that are open, 197 197
and I'll be able to see what processes are there. 198 198
Migrate pid will migrate me from the current process 199 199
I'm in, that Internet Explorer process or Calc process 200 200
into something like Explorer or System. 201 201
Getuid verify where you should be. 202 202
I wanna be the current user, because 203 203
if I wanna capture somebody's keystrokes, I have to be them. 204 204
So I have to migrate into a user process to do that. 205 205
And now I'll be able to see if I go on a Notepad, 206 206
start typing notepad on your victim box, 207 207
and then you'll key scan dump, 208 208
you'll be able to see all those keystrokes that you've had. 209 209
You'll also see here that Meterpreter 210 210
gives you the ability to actually access the webcam. 211 211
You can record audio from the microphone of the webcam, 212 212
you can see what webcams are available, and you can start 213 213
taking snapshots from the webcam. 214 214
So I can actually see the victim that I'm 215 215
seeing through their computer. 216 216
Now, ours is a virtual target. 217 217
It doesn't have a webcam, so these will 218 218
actually fail if you try it in our virtual lab, 219 219
but in the real world, you can do this and start 220 220
stealing pictures off their camera. 221 221
Another one is elevation commands. 222 222
We talked about once we gain access we wanna 223 223
migrate up to a higher user level. 224 224
Well, one of the ways we do that is get system. 225 225
It's just automated. 226 226
You type get system, and on a windows machine, 227 227
it will elevate you up to a system-level user if it can. 228 228
This works about 50% of the time, 229 229
so it works pretty well and it's worth a shot. 230 230
It will get you where you wanna go most of the time. 231 231
So, some other ways that we can elevate 232 232
our privileges is we can do a hash dump. 233 233
Hash dump is actually gonna dump 234 234
the contents of the SAM database, 235 235
and we'll talk more about the SAM database 236 236
when we talk about elevation of privilege later, 237 237
but it's the way that Windows stores its credentials. 238 238
So if I can dump the SAM database, 239 239
I get the encrypted hash of all the passwords, 240 240
I can then break those hashes and 241 241
figure out what the passwords are, 242 242
I now have additional accesses. 243 243
And then finally, here at the bottom you'll see timestomp, 244 244
and timestomp's really useful because 245 245
as we into our covering our tracks later, 246 246
we'll use timestomp to actually change 247 247
the time that files were accessed. 248 248
A good use of this is if I go into a logfile and edit a 249 249
piece of that log, it's gonna change 250 250
the date and time to the time that I edited it. 251 251
Now what I wanna do is go back and timestamp it 252 252
back to the last time it was actually touched, 253 253
which might have been three or four weeks 254 254
ago by the system administrator. 255 255
And that way I can help cover my tracks further. 256 256
We'll cover this again in the covering tracks lesson.