-: Time to finally figure out our possibilities
with the meterpreter shell.
In the last section, we focused so much
on how to gain access in many different ways,
and we popped a meterpreter shell so many times.
But we never got to see its true power
and all of its commands.
We only ran a few of them.
Just to make sure the connection was successful.
Now we are going to go real quick
through the basic commands,
that we can do with the meterpreter shell.
And then after it, we will see some
of the post exploitation modules, and how we can run them.
So for this, I already got the shell opened.
As we can see right here, Meterpreter session 1 opened.
I ran my file, which is shell.exe
and by now all of us should know how to do this.
Just send the payloads to the target, execute it,
and you should have a meterpreter session on their machine.
From here, we can run the help command to see all
of the available commands with the meterpreter shell.
If I scroll all the way up,
and we are going to start from the beginning.
The first section of the commands
that we get are called Core Commands.
And these commands we are going to brush through real quick.
We're just going to mention a few of them
that we already know,
such as for example this background or bg.
If you type background in your meterpreter shell,
this will background your session.
And you will be able to use
your method plate framework module.
When is this command useful?
Well, if I type the command sessions that we already know,
we got one session currently.
But you might have a session with multiple targets.
And in order to navigate between each and every session,
you can use the background command
to put this meterpreter session in the background,
and for example enter a different session
with a different machine.
So that command is useful in that sense.
Of course, you don't need to type the background command.
You can simply just type instead bg,
and it will do the same thing.
So if you go back to my session,
and go back to my help command.
We can scroll back to the core commands,
and read some of them, and what do they do?
So just go to this menu,
and most of them we are going to cover later on.
From now we are not going to touch them,
because most of these are not needed for us at the moment.
For example, you know that you can exit
the meterpreter shell with this exit command.
Background command.
Here we can see how we can switch
between different sessions.
And you can get the user ID.
I believe get UID command is right here.
Here it is.
Get UID. Get the session UID.
So if I type that right here,
it will tell me the session UID.
We also know the command get user ID.
And this will tell us,
which user are we on the target machine.
Okay, so these are just some of the core commands,
and of course you can experiment with others.
But some of them we're going to cover later on.
For now on you can just read through this menu,
and go to the file system commands.
And these file system commands,
you can just picture them as commands that we use inside
of a terminal.
So we can change directories.
We can print current working directories,
list all of the files on the target system,
and let's see how that would work.
So if I go down here, and to see in which directory I am.
I can type the command print working directory.
It will tell me that I am currently
in this slash desktop directory on the target machine.
Now why am I here?
Well, because this shell.exe inside of that directory,
and once the target executed it,
our meterpreter session will automatically be inside
with the directory where the payload is.
Okay, if I wanted to list all of the files inside of here,
I can type the dir command.
And I can also type the ls command,
so it supports both Linux command and Windows command.
Dir is used to list files inside of a Windows system,
so we can see what files we have right here.
And maybe we could find something interesting right here.
For example, we get this passwords.txt file, and
of course, I created this on purpose just for this tutorial.
But this is something that occurs quite often.
Matter of fact, years ago even I had this file
where I've written down all of the passwords
that I couldn't remember for different websites.
And to read the content of this passwords.txt file,
we can use a familiar command for us,
which is the cat command.
See if I type cat passwords.txt, press enter.
This will print out all of the content inside of this file.
We can see the router: username, and password;
the Facebook: username and password;
and the PayPal: email and password.
So this is something that you could possibly run on,
and you want to see the contents just type the cat command.
Of course, we don't need to be inside of these directory,
if we don't want to.
We can use our regular cd command to go one directory back.
And if we type pwd, we're no longer
in the slash desktop directory.
Here, we can type dir once again
to list out all of the files inside of this directory.
If we wanted to choose one of these directories,
we can go back to them.
But for now let's just go back to the desktop directory.
Great.
If I type dir, here are our desktop files,
and if we wanted to we could also download the file
from the target machine.
So how can we do that?
Well, it is as simple as just typing download,
and then the file name.
In this case, let us say we want to download,
for example passwords.txt.
I press enter and here it is. It'll download it for us.
Now, I'm not sure where
by default the meterpreter saves these files.
But it could be right here on the desktop.
And here it is, here is the passwords.txt.
And you can also upload files, if you want to.
For example,
let's say we want to upload this RatBackdoor.exe
from one of the previous videos to the target machine.
We can see right now, we don't have it on the desktop
on the target machine.
But if I type upload, and then RatBackdoor.exe,
press enter,
go back to the desktop just to check it out.
And here is our file.
We successfully uploaded another executable
to the target system.
Then we could use something like a shell
to execute that file.
Okay, but we are not going to do that right now.
Let us exit out of the shell.
And run the help command once again,
just to see what else we can do.
Inside of the file system commands we also get the commands
on how we can create and remove files.
So we can use rmdir to remove a folder.
We can use rm to delete the specified files.
So for example, we want to delete the file on their desktop.
We can do that using the regular rm command.
We can also create a directory, and create files if want to.
So let's see, for example,
if we manage to delete the ratbackdoor
that we just uploaded.
We don't want it there.
So let us just delete it real quick.
Run the rm command, and it is no longer here.
And let's say we want to create the test directory,
and we want to copy passwords.txt in the test directory.
Hmm, access is denied.
Let us just check out right here.
We got the test directory,
but for some reason we can't seem to copy this file.
And this could be due to many different reasons,
but the main reason will probably be,
because we are not an administrator on the target machine.
And we are going to check out in some future video,
how we can become an administrator in system level account,
just by getting them meterpreter shell as a regular user.
Remember if I run the getuid, we're just a regular user.
We are not the system level account,
but more about that later on.
For now on, let us run the help command once again.
And you can play with this file system commands
that we have right here.
But they're just regular commands that we can run inside
of a Kali Linux terminal.
Just this time you're running it on the target machine.
Inside of the networking commands,
we only have a few of them,
so lets just test two or three of them.
For example, this arp command,
will display the host ARP cache.
So with this, we should be able to see the IP addresses,
and their correspondent MAC addresses.
These are all of the IP addresses that are inside
of our ARP tables on the Windows machine.
So we have our Kali Linux IP address
because we are currently communicating
with our target machine from our Kali Linux IP address.
Therefore, it must have our Kali Linux IP address
in the ARP tables.
We also get the router's IP address,
the broadcast IP address,
and all of these down here are not that important.
If I run the ifconfig command, of course,
I will be able to see all the networking interfaces
on the target system, as well as the IP address
that the target currently has.
If I run the command, for example, netstat,
this will print out all of the connections
that our target machine currently has.
So we can see right here, the connections, the IP addresses,
which protocol are they using in case these are using tcp,
and down here we have udp protocol.
If I go up here,
we should be able to find our shell.exe
that established the connection
with the Kali Linux IP address.
So we know that 192.168.1.4 is the IP address
of my Windows 10 target machine.
And here if I go and find the IP address
of Kali Linux machine, and here it is.
We can see, it is running on port 5555.
The connection is established,
and the process that is causing this connection
is Shell.exe or our payload.
Great.
Now if you want to, you can go up here,
and experiment with the other commands as well.
But these are not that interesting
or important for us at the moment.
What is important and what we will cover
in the next video are these system commands
and user interface commands.
We want to see some of the cool stuff such as
capturing keystrokes, or running a keylogger,
running a screenshot on the target desktop,
maybe for example, recording microphone, recording webcam,
all of that we want to check out.
And see how we can run them.
And we will do that in the next video.
So experiment with the commands
that we covered a little bit.
Feel free to run the others as well,
if you want to check out what do they do.
And I will see you in the next lecture.