Core Meterpreter Post-Exploitation Features
In previous sections,
we used the Meterpreter payload to navigate the file system,
obtain information about the target system,
and transfer files to and from the machine.
Apart from the commands we already used,
Meterpreter contains numerous post-exploitation features.
Let’s explore some of these features.
We should note that the Linux Meterpreter payload
contains fewer post-exploitation features than the Windows one.
Therefore, we’ll explore these features on the Windows target ITWK01.
Let’s assume we already gained an initial foothold on the target system
and deployed a bind shell as way of accessing the system.
To begin, we’ll create an executable Windows binary with msfvenom
containing a non-staged Meterpreter payload,
and name it met.exe.
After we set the payload, we launch the previously activated multi/handler module
in Metasploit as our options remain the same from the previous section.
Our Python web server is still running,
so we’ll connect to the bind shell on port 4444 on ITWK01.
Once connected,
we can download met.exe with PowerShell and start the Windows binary.
Once the Windows binary is executed,
Metasploit notifies us that it opened a new session.
Now that we have an active Meterpreter session on a Windows target
we can start exploring post-exploitation commands and features.
The first post-exploitation command we’ll use is idletime.
Which displays the time for which a user has been idle.
After obtaining basic information about the current user and operating system,
this should be one of our first commands
as it indicates if the target machine is currently in use or not.
The output states that the user hasn’t been interacting with the system
for 9 minutes and 53 seconds,
suggesting the user may have stepped away from their computer.
If the result of the idletime command indicates that the user is away,
we can take this as an opportunity to execute programs or commands
which may display a command-line window
such as CMD or PowerShell for a brief moment.
For several post-exploitation features,
we need administrative privileges to execute them.
Metasploit contains the command getsystem,
which attempts to automatically elevate our permissions to NT AUTHORITY\SYSTEM.
It uses various techniques using named pipe impersonation and token duplication.
In the default settings,
getsystem uses all available techniques (shown in the help menu)
attempting to leverage SeImpersonatePrivilege and
SeDebugPrivilege.
Before we execute getsystem, let’s start an interactive shell
and confirm that our user has one of those two privileges assigned.
The output shows that the user luiza has SeImpersonatePrivilege assigned.
Now, let’s use getsystem to attempt to elevate our privileges.
The output shows that getsystem successfully elevated our privileges
to NT AUTHORITY\SYSTEM by using _Named Pipe Impersonation
as we did manually in the Windows Privilege Escalation module.
Another important post-exploitation feature is migrate.
When we compromise a host, our Meterpreter payload is executed inside the process
of the application which we attack or execute our payload on.
If the victim closes that process, our access to the machine is closed as well.
In addition, depending on how the Windows binary file containing the Meterpreter
payload is named,
the process name may be suspicious
if a defender is searching through the process list.
We can use migrate to move the execution of our Meterpreter payload
to a different process.
Let’s view all running processes
by entering ps in the Meterpreter command prompt.
The output shows that the process met.exe has the process ID 1236.
The name and path will easily make the process stand out to a defender reviewing
the process list.
The output shows that offsec started a process related to OneDrive
with process ID 7120.
If our payload runs within this process,
it is far less likely to be detected by reviewing the process list.
We should note that we are only able to migrate into processes
that execute at the same (or lower)
integrity and privilege level than that of our current process.
In the context of this example, we already elevated our privileges to
NT AUTHORITY\SYSTEM so our choices are plentiful.
Let’s migrate our current process to OneDrive.exe of the user offsec
by entering migrate and the process ID we want to migrate to.
The output shows that we successfully migrated
our process to the OneDrive process.
When reviewing the process list, we’ll find our original process,
met.exe with ID 1236, does not exist anymore.
Furthermore, we’ll notice that the ps output
contains less information than before.
The reason for this is that we are now running in the context of the process
with the ID 7120 and therefore, as user offsec.
Instead of migrating to an existing process
or a situation in which we won’t find any suitable processes to migrate to,
we can use the execute Meterpreter command.
This command provides the ability to create a new process
by specifying a command or program.
To demonstrate this,
let’s start a hidden Notepad process and migrate to it as user offsec.
For this, we’ll use execute with -H to create the process hidden from view
and _notepad as an argument for -f to specify the command or program to run.
Then, we’ll migrate to the newly spawned process.
Nice!
This concludes this section.
We explored several post-exploitation features of Meterpreter.
First, we used idletime to check if the user
is actively working on the target system or not.
Next, we elevated our privileges with the help of getsystem.
Finally, we used migrate to move the execution of our Meterpreter payload
to a different process.