Meterpreter Payload
In the previous sections, we used a common TCP reverse shell.
While we do have interactive access on a target system with this type of payload,
we only have the functionality of a regular command shell.
Exploit frameworks often contain more advanced payloads providing features
and functionality such as file transfers, pivoting,
and various other methods of interacting with the victim machine.
Metasploit contains the Meterpreter payload,
which is a multi-function payload that can be dynamically extended at run-time.
The payload resides entirely in memory on the target
and its communication is encrypted by default.
Meterpreter offers capabilities that are especially useful in the post-exploitation
phase and exists for various operating systems
such as Windows, Linux, macOS, Android, and more.
Let’s display all compatible payloads in the exploit module from the previous
sections again and search for Meterpreter payloads.
Once we find a non-staged 64-bit Meterpreter TCP reverse shell payload,
we’ll activate it and display its options.
After selecting the 64-bit non-staged version of meterpreter_reverse_tcp
as payload, we can review its options.
For this particular payload,
the same options apply as for the previous payloads we used.
Now, let’s run the exploit module with our Meterpreter payload.
Once we obtain a Meterpreter command prompt,
we’ll display its available commands by entering help.
The commands of Meterpreter are divided into categories,
such as File system Commands,
and Networking Commands and System Commands.
Let’s get familiar with some of the Meterpreter commands.
We’ll start gathering information by entering sysinfo and getuid.
The commands provide us with information about the target computer,
operating system, and the current user.
As we’ve already learned,
Metasploit uses sessions to manage access to different machines.
When Metasploit interacts with a system within a session,
it uses a concept named channels.
Let’s start an interactive shell by entering shell,
execute a command in the context of a channel,
and background the channel the shell runs in.
To background a channel, we can use Control Z.
Next, we’ll start a second interactive shell,
execute a command,
and also, background the channel.
Now, let’s list all active channels and interact with channel 1 again.
To list all active channels, we can enter channel L,
and to interact with one, we can use channel -i and the channel ID as argument.
The output shows we can execute commands in the context of channel 1 again.
Using channels will help us tremendously to manage system access
and perform postexploitation operations.
Next, let’s use the download and upload commands from the category
File system Commands to transfer files to and from the system.
For this, let’s review the commands of this category first.
The ouput shows us various commands that we can use to upload, download,
or manage files on the local and target system.
Commands with “L” as prefix operate on the local system; in our case our Kali VM.
For example, we can use these commands to change the directory
to where we want to download or upload files.
Let’s download /etc/passwd from the target machine to our Kali system.
For this, we’ll change the local directory on our Kali machine,
to /home/kali/Downloads first.
Then, we’ll enter the download command and /etc/passwd as argument.
The output shows that we could successfully download
/etc/passwd to our local machine.
Next, let’s assume we want to run unix-privesc-check
as in a previous module to find potential privilege escalation vectors.
Let’s upload the file to the temp directory on the target system.
The output shows that we successfully uploaded unix-privesc-check
to the target machine.
So far, we’ve used the linux/x64/meterpreter_reverse_tcp payload
in this section to explore various features of Meterpreter.
Before we head into the next section,
let’s use another 64-bit Linux Meterpreter payload.
Therefore, we exit the current session,
and use show payloads in the context of the exploit module again.
The output shows that index 10 is x64 meterpreter_reverse_https_.
Instead of a raw TCP connection, this payload uses HTTPS to establish
the connection and communication between the infected target and our Kali machine.
As the traffic itself is encrypted with SSL/TLS,
defenders will only obtain information about HTTPS requests.
Without further defensive techniques and technologies,
they will be unlikely to decipher the Meterpreter communication.
Let’s select this payload and display its options.
The output shows there is an additional option for this payload named LURI.
This option can be used to leverage a single listener on one port capable
of handling different requests based on the path in this option
and provide a logical separation.
If we leave the Current Setting option blank,
Metasploit just uses a forward slash as path.
Now, let’s launch the exploit module by entering run
without setting a value to the LURI option.
The output shows that the payload provided us with a Meterpreter session.
The output displays the handling of various requests
until the Meterpreter session is established.
If a defender monitors the payload’s communication,
it seems like regular HTTPS traffic.
Furthermore, if they would check the address of the communication endpoint
(our Kali machine in this example),
they’d only get a Not found page with HTTP code 404 in the browser.
In a penetration test, we can use this payload to improve our chances
of bypassing security technology and defenders.
However, as Metasploit is one of the most well-known exploit frameworks,
the detection rates of Meterpreter payloads are quite high
by security technologies such as antivirus solutions.
Therefore, we should always attempt to obtain an initial foothold
with a raw TCP shell and then deploy a Meterpreter shell
as soon as we have disabled or bypassed potential security technologies.
However, this kind of obfuscation is outside of the scope of this Module.