Now that we have an active Materne Twitter session, that's the Metis Boyte interpreter session, we're
going to see how we can use Materne operator to gather information about the machine that is phoned
home or called into our Caleigh Linux computer.
So we know that we sent this out.
Maybe you sent it to a person working at the organization that you're doing a security test for.
And you said, hey, but check out this invoice and make sure that this is the right thing or make sure
that this is the right file or run this update.
We've seen a security problem with your computer.
What we can do with maturer once that machine phones home is we can.
Well, we saw in the last lesson, we can run help.
To see a listing of commands inside Materne Twitter so we can see that there are commands here to control
the Web cam, we can see things like key Skåne, key start, key stop, so we can actually do a key
scan dump of all of the characters that a user who's infected their computer with a virus is typing.
So that means their Amazon password.
That means their corporate password, the email password, just about anything they ever type on a keyboard
we can capture.
We can see a screen share.
We can view the remote desktop.
We can take a screen shot.
We can change the current desktop.
We can do lots of different things.
We can run a lot of different commands, just like if we had a direct access to that remote computer.
So what we want to do is show you just a couple of quick commands.
So if we look down through this list.
We see that we've got a lot of the same commands that we would run on our Caleigh Linux box or on a
Windows machine, we can do an L.
S to list files, dear directory to list files on the Windows machine.
We can see specific information about the machine itself.
So if we scroll down just a little bit.
We'll come down to system commands and we can see that we've got some commands like.
CIS info.
So if you want to gather some information about the machine that is called in using the typewriter,
the CIS info commands a good first place to start.
So we just type start typing.
S y.
S i n f o.
It will give us some information about the Windows 10 and message went in Windows 10 64 bit machine
that we infected.
That's our other virtual machine, our Windows VM.
We can actually see information about the build number so we know what operating system is running on
it.
We know the build and we can even find out where the user ran the file from.
P WD is the print working directory.
They ran it from their downloads folder.
Well, that's where we downloaded the file onto our computer DRM Windows Virtual Machine.
So this this virus is running right now inside downloads.
It's running on the message Win Tin named computer.
And we can see lots of information about that.
And we've already run the help command so that we can see everything that we're gonna be able to do
for the rest of this section.
And honestly, you could spend hours just going through interpreter and the many tools that it allows
you to launch when you're hacking a Windows tin box or checking the security of a network with Windows
10 computers on it.
But let me show you one other really important piece.
Sometimes you'll have more than one computer.
In fact, you could send this virus to hundreds or even thousands of computers on the same network that
can access your IP address.
And you can take.
You can actually work in multiple sessions.
So we saw earlier that when the Windows 10 computer ran the virus, it created a mature Sprouter session.
That is a connection to this Caleigh Linux box.
So if I say background, there we go.
You can see it's backgrounding session one.
So I'll control L just for a moment to get it back to the top of the screen.
I can always check to see how many infected computers are connect to Demy O'Kelley Linux box with sessions
the concessions command.
Now we can see we've only got one open connection.
It's going out to Tendo at nine dot nine, our Windows Virtual Machine.
And I can interact or I that session start by saying Sessions Dasch.
I won.
So if you ever need to get back out to your regular meds play framework, not the materne fritter shell.
Remember, Materne critter is running on the Windows computer, the infected windows machine meds boit
as our framework we can load all kinds of other exploits.
We may even want to run a second exploit after we get into the Windows computer.
We might want to establish something called persistance, where we try to avoid being deleted by Windows
Defender.
We're going to see how to do that one in the next lesson and we're going to upload a copy into another
folder.
So of four right now, you've got the ability to look at multiple sessions and then to interact Sessions'
Dash I with a certain session.
Number one, in our case, we've seen how to run the systems info.
We can run the help command and more sharper to find other commands.
And we know that we're running from the print working directory of C users, i.e. user downloads.
When we come back in the next lesson, we're going to see how to view, how to download and how to upload
files on a compromised Windows 10 computer.
We'll see in the next lesson.