-: So in the last lesson, we went and used a command shell, 2 2
a just reversed TCP as our payload. 3 3
I want to show you what happens 4 4
if we use a different payload. 5 5
So, what we are going to do here is use a 6 6
different thing called Meterpreter. 7 7
So, we are going to set our payload. 8 8
And in this case, it's Windows/meterpreter/reverse tcp. 9 9
And then we will show our options. 10 10
You can see we have our same options as before. 11 11
We have our same exploit set, 12 12
our same volunerable Windows machine, 13 13
but now we have a different payload set up 14 14
even though it did carry over the fact that 15 15
we are still going to listen on 16 16
this particular coley machine. 17 17
So now we are ready to exploit. 18 18
Notice it sent the stage and it actually got it. 19 19
But, notice our command prompt is a little different. 20 20
This time it says Meterpreter. 21 21
Now the reason why is, we're not actually 22 22
using the Windows command prompt. 23 23
We're using Meterpreter as our shell. 24 24
Now Meterpreter is great, it has a lot of capability. 25 25
In fact, I'm going to go through 26 26
a couple of them with you real quick. 27 27
We're going to start out with a question mark, 28 28
which tells us all the things we can do. 29 29
If we scroll up here to the top. 30 30
You'll see the core commands. 31 31
We can send things to the background, we can get timeouts 32 32
just some basic housekeeping type information here. 33 33
But, what really gets fun is when we get down here. 34 34
File system commands. 35 35
If you're a Unix guy or a Linux guy, 36 36
this is great because all of our standard 37 37
Unix and Linux stuff will actually work. 38 38
In addition to that, we can use our Windows stuff too. 39 39
So, we still have dir, we still have cd, 40 40
but we also have ls for listing our files. 41 41
The other nice thing that I really like is 42 42
the fact that we can upload or 43 43
download files from our directory. 44 44
This is going to be really useful as well. 45 45
Now as we move further down, we'll show 46 46
you some other things that we have here. 47 47
We can display the arp cache, 48 48
we can do some proxy settings, 49 49
we can see the interface as they have 50 50
and figure out, 'cause sometimes you'll 51 51
get to a box that is used as a router 52 52
and we can pivot from one to the other. 53 53
We can also modify our routing tables. 54 54
That's some good useful information 55 55
as we get further into our hacking careers. 56 56
The other nice thing we have is our system and commands. 57 57
And, there are some things that you can do 58 58
that will help cover your tracks 59 59
but they are pretty blatantly obvious. 60 60
For instance, you can clear the event log. 61 61
If I clear the event log, the system 62 62
administrator is going to know he got hacked. 63 63
The good news is though, 64 64
he won't know I'm the one who did it. 65 65
There's a lot better ways of hiding 66 66
yourself then just clearing the event log, 67 67
but that's one way to do it. 68 68
The other thing you can do is, 69 69
you can execute commands, you can get 70 70
environmental variables and you can actually 71 71
grab tokens and steal tokens from another user. 72 72
So, if there was a domain admin who 73 73
ever logged into this box, I can steal 74 74
their token and then use it across the domain. 75 75
Other things I can do include, rebooting the computer, 76 76
or showing the process list, or killing processes. 77 77
If I want to get to that windows command shell, 78 78
I can do that too, just by typing shell. 79 79
Now, some more fun, is when you 80 80
get down here towards the bottom. 81 81
This is one of my favorite areas. 82 82
It is the user interface commands. 83 83
So, one of my favorite commands is actually here. 84 84
It's called grab a screenshot. 85 85
You just type in screenshot and it will steal 86 86
a picture of the person's desk top. 87 87
So if they are using their 88 88
banking account information, for instance, 89 89
now I can have their checking account information 90 90
because I'll see it on their screen. 91 91
The other thing I can do, 92 92
is I can start and stop key scanners. 93 93
This will actually start capturing every 94 94
key stroke that person makes 95 95
and sending it back to me once I type in scan dump. 96 96
As we move further down, 97 97
these won't work with our virtual machine we're attacking, 98 98
but if you had somebody's real machine, 99 99
we can actually stream their web cam. 100 100
So I can see what they are doing. 101 101
I can take a snapshot of their web cam. 102 102
I can start a video chat with that person 103 103
or record their microphone and 104 104
listen to what they are doing. 105 105
Lots of different things we can do here. 106 106
And then finally, as we get down here. 107 107
We have things like getsystem. 108 108
So, assuming I attack the person using a 109 109
user based exploit not an administrator exploit, 110 110
I want to elevate my permissions up to the 111 111
domain admin and up to a system admin. 112 112
By doing getsystem, I can get that system level access. 113 113
Now, to get domain admin I'm going to have 114 114
to get the Dumps of the SAM database. 115 115
If I hashdump it, I can steal those credentials 116 116
and then crack their passwords. 117 117
And then finally, we have timestomp, 118 118
and what timestomp does is, this allows 119 119
me to manipulate the time on files. 120 120
So, if there is a log file, I might 121 121
go in there and delete a single line or two 122 122
and then timestomp it back to the time 123 123
before I touched it. 124 124
That will allow me to cover my tracks a little bit better. 125 125
So, while we are here, I'm going to go ahead 126 126
and hit ls and see where we are. 127 127
And in this case, I'm in a directory 128 128
with a bunch of dlls. 129 129
Can you guess what directory that is? 130 130
It's probably the system 32, 131 131
but to double check that 132 132
what were going to do is type in PWD, 133 133
and you'll see that I'm in the Windows 32 directory. 134 134
Now I talked about screen shots. 135 135
Let's go ahead and try that one. 136 136
Screenshot. 137 137
It saved it to the root file of my calivox 138 138
under this jpeg name. 139 139
So, what I'm going to do, is open that up 140 140
and you can see right there, 141 141
that was that person's desk top. 142 142
There is the hack file we made in the last lesson. 143 143
So that's useful, because you can start 144 144
stealing information they have on their screen. 145 145
So what else might be good? 146 146
Well lets look at the hashdump. 147 147
So if I type in hashdump, 148 148
I get the hashes for all of those users. 149 149
I have the administrator, he is a 500 level account. 150 150
And here is the hash that's associated with him. 151 151
There is websites out there that 152 152
you can plug that hash into that it will 153 153
come back and tell you what those passwords are. 154 154
Because, there is a way to break 155 155
those passwords using landman hashes. 156 156
Same thing here with John Sim, 157 157
if we wanted that user account, 158 158
we could take his hash, pop that it into 159 159
that website and come back with 160 160
the user name and the password. 161 161
This is information that can be 162 162
very useful to us as we move on. 163 163
So, this was just to show you some of the 164 164
capabilities that you have inside Meterpreter. 165 165
We're going to play with Meterpreter a lot more 166 166
as we go into our Linux machine and start 167 167
going through those vulnerabilities. 168 168
But, I just wanted to give you a quick introduction 169 169
to show you that there is a lot of power 170 170
if you use something like Meterpreter, versus 171 171
using something like a reverse shell tcp.