[ELECTRONIC MUSIC]
Meterpreter fundamentals.
In this video, we are going to be exploring
the process of utilizing the Meterpreter
shell, or the Meterpreter session,
as it's also known as, to essentially navigate around
the target system, perform a few commands--
or execute a few commands, and of course just get
an understanding of how to utilize a Meterpreter
session as well as how to manage your Meterpreter sessions.
So before we actually get started with that,
we are currently within the post-exploitation section
of this course.
So if we take a look at the graph that we highlighted
or that we explored during the introductory section
to this course, you can see that we've
completed information gathering, enumeration, as well
as vulnerability scanning.
And we've also explored exploitation on both Windows
and Linux systems.
We are now at the post-exploitation phase,
which also consists of its own sub-phases.
And, again, as an introduction to post-exploitation,
post-exploitation essentially refers
to the actions performed on a target system
after initial access has been obtained,
or after you've successfully been able to exploit the target
system.
Now, the post-exploitation phase of a penetration test
will consist of various techniques,
like local enumeration.
So that's essentially enumerating as much information
as possible from the target system
once you have access to it.
So this is different from performing enumeration
externally on the services that are running on a target.
Given the fact that we now have access to the target,
we can get more important information
regarding the target, like the operating system version,
the distribution release version,
what users are currently on the system, what
groups are currently on the system, et cetera.
We can also perform privilege escalation
if our current Meterpreter session is not elevated.
We can then perform the process of dumping hashes or dumping
credentials from memory.
We'll also take a look at the process
of establishing persistence on the target system,
so that if the system is changed or shut down
in any way or shape or form, we can always
establish persistence without having
to go through the entire exploitation process again.
We'll also take a look at clearing your tracks.
So once you're done on the system
and once you've essentially got what you wanted,
you also need to learn how to clear your tracks on the target
system.
And then we'll also explore pivoting
and how that can be facilitated through the Metasploit
framework.
All right.
Now, we've already explored what Meterpreter is,
and we've taken a look at how to gain a Meterpreter
session by either performing a client-side attack
or through service-based exploitation on both Windows
and Linux.
However, let me just give you an introduction
to Meterpreter again.
So Meterpreter stands for Meta-Interpreter.
It is a payload--
or an advanced multifunctional payload
that operates via DLL injection, and is executed in memory
on the target system, which, again, consequently makes
it very difficult to detect, because the payload,
if you go through the typical service exploitation route,
the payload is never stored on disk.
And it's always executed in memory
once you pair it with an exploit module.
All right.
So the way it works is that it communicates over a stager
socket, and then provides an attacker
with an interactive command interpreter on the target
system, that, again, can facilitate
the execution of system commands, file system
navigation, key logging, and much more.
Now, Meterpreter also allows us to load custom scripts
and plug-ins dynamically, and that's something
that we'll explore as we progress
through the post-exploitation section.
And, again, the Metasploit framework
provides us with various types of Meterpreter payloads
that can be used based on the target environment
and operating system architecture, which we already
explored during the client-side section,
or the client-side attack section, where
we took a look at how to generate payloads
for both Windows and Linux, as well as both operating system
architectures, either 64-bit or 32-bit.
Now, one important thing that you need to remember
and that you need to keep in mind
is that Meterpreter works different on Linux
and it works different on Windows
in regards to advanced features or functionality.
And, of course, that will become very clear
when we move to the Windows post-exploitation section,
and then, consequently, to the Linux
post-exploitation section.
So, again, just keep that in mind.
As I said, we'll be utilizing Meterpreter throughout,
and you'll learn more and more about how to utilize it
throughout this entire section.
All right.
So let's get started with the lab environment.
You can start up your lab environment,
and I'll also join you in-- or join in with you,
so we can begin taking a look at how to utilize Meterpreter.
So I'll see you there.
All right.
So I'm back within the lab environment.
And the first step that we want to perform
is of course obtaining-- or involves
obtaining the target IP address, which can
be done by typing in ifconfig.
And we want to take a look at the interface ethernet 1,
as the target IP is going to be on the same subnet as our Kali
Linux instance.
So, again, in your case, the subnet will change.
However, the target IP or the target server
is running on the third IP address, or the next IP
address on this subnet.
So all you need to do is just change the 2 to a 3,
and that's the target IP.
So I'm just going to copy this here.
We're then going to start up the PostgreSQL database service
so that we can essentially interact with the Metasploit
framework database.
So I'm going to say, service postgresql start,
and hit Enter.
That will just take a few seconds.
There we are.
And we can then launch the Metasploit framework console.
That will take another couple of seconds.
All right.
That is started up.
So we can now create a workspace for all our activity.
So I'm going to create a workspace,
and I'm just going to call it meterpreter.
And we are now going to set up the global variable
for the RHOSTS option, which will essentially save us
from having to type the target IP address whenever
we want to utilize a module.
So setting the global variable will essentially
set the RHOSTS value, or the IP that we
specify for the RHOSTS option, whenever we load a module.
So I'm going to paste in the IP address here.
And, of course, we're just going to change that to a 3.
Hit Enter.
And now we actually need to perform an nmap scan
on the target system in order to identify the services that
are currently running on it that we can exploit,
to essentially gain access, and, consequently,
obtain a Meterpreter session.
So, again, we need to gain access
before we can start exploring how to utilize Meterpreter.
So I'm just going to use the db_nmap command
to perform an nmap scan from within the Metasploit framework
console.
And I'll say I want to perform a quick service version detection
scan based in the IP there.
And we change that to a 3.
All right.
So the db_nmap scan--
or the db_nmap command will essentially run the nmap scan,
and will consequently save the scan results
into the Metasploit framework database
within the current workspace that we are currently
working in, which is the meterpreter workspace.
So I'm just going to hit Enter, and we're
going to give that a couple of seconds to actually complete.
All right, so that completes.
And, as you can see here, we have two services
running on the target system.
We have a web server running on port 80.
So no SSL certificate.
And the service version is Apache httpd 2.4.7.
We also get the banner, which tells us
that the target server is running Ubuntu, or Linux.
The target server is also running a MySQL database
server on port 3306.
And, of course, that's running MySQL version 5.5.4.7.
In this case, we are going to be targeting or exploiting
the web application that's currently running on the Apache
web server.
And in this case, we actually don't have a browser
that we can utilize to access the actual website or the web
application being hosted on the web server.
So we can utilize the curl utility
to essentially download the home page of the actual website
or the web application that we're going to be exploiting.
So I'll just copy the target IP, and we'll say curl.
And we can then download it by specifying the actual address
here.
So we just specify the IP, hit Enter.
That will download the home page.
And in this case, you can see that the web application
in this particular scenario is XODA,
and we can exploit XODA, as an exploit module
for this specific version of XODA is currently available.
So we can say search, and specify the actual web
application.
In this case, it is xoda.
And we hit Enter.
And that is the exploit module that we want to use.
So I'm going to say use, paste in the actual exploit module
here.
And we can show the options for this particular exploit module.
As you can see, the RHOSTS option has already been set.
The RPORT option is configured to port 80, which is fine.
And in this case, we don't have an SSL certificate,
so we don't need to set the SSL option to true.
The TARGETURI option is currently set at xoda.
We need to change that because xoda is currently
running on the root of the web server
and not within a subdirectory or a directory on the web server.
So we are going to say, set TARGETURI,
and we're going to set that to the root of the web server.
In this case, this particular exploit module already
has a Meterpreter payload configured,
so we actually do not need to set the payload here.
We can just here run.
There we are.
As you can see, we get a Meterpreter session.
So we're going to give that a few seconds to actually open
up.
All right.
So we eventually get a Meterpreter session,
and we can just clear out our screen.
There we are.
So, as I mentioned previously, a Meterpreter session
is essentially an advanced version of the Linux terminal
if you have access on a Linux target,
or an advanced version of the Windows command
prompt if you have access to a Windows target.
So the first commands that I would typically
recommend running is the sysinfo command,
which will give you an idea as to what operating system.
And in this case, we can see that the target
is running Ubuntu.
And we also get the kernel version here.
And, again, in this case, the computer name is victim-1,
and the Meterpreter payload, or the actual session--
the type of session that we have is a php/linux Meterpreter
session, which is perfectly fine.
So that gives us information regarding
the actual system itself.
The next step, or the next command,
is the getuid command, which will essentially tell us what
our permissions currently are.
So if I type in getuid, you can see that the user
that we currently have access--
that we currently have access to via the Meterpreter session
is the www-data service account, right?
And that makes sense, because we exploited a web server,
so we will consequently get the permissions associated
with the service account responsible for managing
the web server, which in the case of Linux
is always going to www-data.
All right.
So we have an unprivileged session,
or we essentially do not have root privileges,
which means we cannot do anything that requires root
privileges.
However, in this case we are focused on Meterpreter.
So in order to open up the documentation for Meterpreter,
you can type in the help command, which will essentially
display a list of commands.
And they're sorted based on category.
So you have your core commands here.
You then have your file system commands,
which essentially allow you-- or provide you
with documentation in regards to how to navigate around the file
system.
We'll take a look at how to use all
of these commands in a second.
You then have your networking commands,
and your system commands here, as well as your audio output
commands.
Now, if you have a Meterpreter session on a Windows target,
you're going to find that you have a few more commands here
that allow you to perform key logging, record the webcam,
try and elevate privileges automatically, dump hashes,
so on and so forth.
But those are advanced features that we
will be exploring when we reach the Windows post-exploitation
section.
In this case, we are primarily focused with how to, again,
manage our Meterpreter session, how
to utilize it to navigate around the file system,
migrate processes, et cetera.
So that is how to access the actual documentation,
or the help menu for Meterpreter.
Now let's talk a little bit about sessions,
because a session is essentially a session on a target system
that you have obtained.
And, of course, this is in the context
of the Metasploit framework.
So we are currently working within a Meterpreter session.
We can put this session in the background
by typing in background.
We can also exit and kill this session
by simply typing in exit, and that will kill this Meterpreter
session.
In this case, let's put this session in the background.
That can be done by typing in background
or using the keyboard combination Control and Z.
All right.
So we'll hit Enter.
That's going to say Backgrounding session 1.
All right.
So we can list out our sessions by typing in the sessions
command.
And in this case, you can see that we
can have as many sessions that we want on a target system,
and the sessions command allows us to manage all our sessions,
our active sessions on the target system.
So the way it's sorted here is that it
will display the actual session ID, which
is unique to every session.
So session ID 1 is unique to this particular session
and none other.
You can then specify the name of the session, which
I'll get to in a few seconds.
It will then tell you the type of access
you have to the target system, and in this case
we have an Meterpreter session.
If you had a command session, it will tell you right over here.
It will then give you some basic information regarding
the privileges or the current user that you have access
to on the target system.
It will then highlight the actual connection type,
or rather the IP address and the port
that you're actually using to get--
or to essentially facilitate this session
or this connection.
So in this case, you can see that we received
a reverse connection from the target server on our Kali Linux
IP address on port 4444, which we have already covered how
you can actually modify that.
So that is one session.
Now, we can open up the help menu for the sessions command
by using the sessions -h command.
And right over here, you can see that we
can, first and foremost, run a Meterpreter
command on the session without interacting with it.
So if we wanted to run a quick command on a session
without having to actually interact with it,
we can say sessions, and then specify the C,
and that is a capital C. We can then
type in a Meterpreter command, like sysinfo,
and then specify the session ID using the i option, that
is, -i, and then specifying the actual session ID.
So in this case, we only have one session,
so I'm just going to type in 1.
We hit Enter.
As you can see, that command is executed on Meterpreter session
1, and we get the output of the command right over here.
However, if you actually see, we're
not-- we currently don't have a Meterpreter
session, because we didn't interact with that session.
We only executed a command.
You can also terminate all sessions using the -K option,
and that is an uppercase K. You can also
interact with a supplied session,
or simply open up a session by typing in sessions,
and then providing the actual ID.
So we can say sessions 1, and we get the Meterpreter session
right over there.
So you can essentially switch between your sessions
like that.
And, again, we can put this in the background really quickly.
And let's open up the session's help menu right over here.
OK.
We can also terminate sessions via the session ID.
So I can say, for example, sessions -k,
and then say kill session 1.
And that will kill session 1.
You can also list your active sessions
by saying sessions or sessions -l,
and that will list your active sessions.
The other great thing that you can do
is also provide a name for your session.
So you can currently see that our session
doesn't have a name.
So we can provide it with the name
by essentially saying sessions -n,
and then we provide the name that we want to provide.
So in this case, we are just going to say xoda.
And, of course, that's the web application that we exploited.
And, of course, feel free to rename your sessions
to whatever you're comfortable with.
So I'm going to say sessions -n xoda,
and I'm then going to specify the session ID that I
want to provide this name to.
And in this case, it's 1.
So I hit Enter.
You can see it's going to tell you, Session 1 named to xoda.
So if I list out my sessions, you
can see that the name is now xoda.
So I can now interact with it by saying sessions and then saying
xoda or specifying the actual ID.
So that's how to switch between sessions, rename sessions, et
cetera, et cetera.
All right.
So that's pretty much it in regards
to managing your sessions.
It's fairly simple to understand.
You can kill sessions.
You can manage their names.
You can interact with a session.
You can specify a command that you
want to run in a particular session, et cetera, et cetera.
So let's head over back to sessions 1,
and let's explore some of the commands that I was interested
or that are very, very important.
So given the fact that we're running on Linux,
we can navigate or--
navigate and interact with the file system
first and foremost by typing in a command like ls, which
will essentially provide us with the actual directory
listing for the current directory
that we're working in.
If we want to learn what directory we're currently
working in-- and, of course, this is on Linux--
we can type in pwd.
And that will also work on Windows, by the way.
So these commands will essentially
work on both systems.
So it tells us we're working within /app/files.
We can also navigate to a particular directory
or take a step back by saying cd dot dot.
If we list the files within the app directory,
you can see that it will actually provide you
with the permissions that that particular file or directory
has, the size, the type, when it was last modified,
and, of course, the name.
Now we are going to go through a few challenges that
will highlight the fundamentals of how to utilize Meterpreter.
So the first flag that we want to actually get here
is the flag1 file right over here.
So in order to get the flag, and in order to display files--
or the contents of a file within Meterpreter,
we can use the cat command.
So we can say cat flag1, and that will
cat the content of the flag.
So there we are.
That's how to cat the content of a file.
You can also edit a file by saying edit flag1.
And that will open up the actual file within vim.
And then I can exit by using the q and e option, or just quit.
There we are.
So that is how to, again, cat out the content of a file,
and also how to edit a file.
We can also navigate into various directories,
like secret files, for example, by saying cd.
And if it has spaces within the file name,
we can put it in double quotes.
So we can say, I want to change my directory into Secret Files.
And we hit Enter.
If we list the contents of Secret Files,
you can see that we have flag2 here.
So let's also cat out the contents of flag2.
There we are.
So I'm going to say cat flag2, and we
get the contents of flag2.
Fantastic.
I can take a step back to the previous directory,
and we are back within the actual app directory here.
All right.
So that is how to navigate between--
or how to actually switch between directories,
how to edit files, how to cat the contents
of a file, et cetera.
Now, if we want to download a file like flag5.zip,
we can do that by saying download and then specifying
the file flag5.zip.
And this will download it to our current--
to your current working directory within the Kali Linux
system, or you can specify a custom directory
where you want to download it.
In this case, we're just going to say download flag5.zip.
Hit Enter.
And let's put this in the background.
So I'm just going to say Control-Z. That's going
to background the session.
And I'm going to hit Yes.
And if we list the actual files within our current directory
here-- and, of course, we're not interacting with the sessions--
you can see that we have flag5.zip.
So we downloaded that zip archive successfully.
We can then unzip that flag archive.
So I'm going to say, unzip flag5.zip.
There we are.
That is going to unzip it.
And then we can again provide the password.
And in this case, within the lab environment,
the password is 56784.
So I'm going to hit Enter.
We list out the contents there.
You can see that it should have extracted the actual flag.
So let's see.
Yeah, there we are.
The file that was extracted was list.
So we can cat out the content of list.
And you can see that within that particular file,
it says get the MD5 hash of /bin/bash on the target system.
So let's head over into sessions 1 again.
And in order to get the MD5 hash of a particular binary, what
we can do is essentially, again, utilize the md5 command.
So we can utilize the checksum command.
So we can say checksum, and then say md5,
and then say /bin/bash.
And that's essentially the flag right over there.
Now, in terms of Linux, we can also
get the current environment variables.
So if we want to learn more about how this particular Linux
system is configured and, in specific,
how this particular user has been configured, we can say--
we can use the get environment variable,
and then we specify the actual environment variable
that we want to enumerate.
So if we want to enumerate our current path for this user,
we can say getenv PATH, and this will provide you
with the actual variable PATH and its value.
If we wanted to learn more about the actual terminal that
has been assigned to this particular user,
we can say get environment variable TERM.
And in this case, it says None of the specified environment
variables were found or set, which makes sense,
because we currently have access via the www-data service
account.
That is typically-- or that cannot be accessed using
a terminal session.
So that's why it doesn't have the environment
variable TERM set.
In terms of searching for files, which is very, very important,
we can search for files by saying search and then
specifying the actual directory we want to search--
that we actually want to search in.
Or you can just perform a search,
and this will perform a search within the entire system,
or, rather, within the entire file system.
In this case, what we are going to do
is we are going to be searching for--
we're going to search within the /usr/bin directory,
which is where binaries are stored.
And we then want to limit--
or we actually want to find a file with the following
parameters.
So we want to find a file with the file name backdoor.
So I'm just going to encapsulate that in an asterisk,
or in two asterisks there.
I'm going to hit Enter.
And as you can see, under /usr/bin,
we get the actual backdoor binary there.
We can also search for specific file extensions.
So if I say search for file extensions, and then I say--
we can use the wildcard again.
And we can say we're looking, maybe, for jpg files.
So I can say--
if we're looking for jpg files, we can run that.
We can also search for, maybe, php files.
There we are.
And you can see it gets you all the php files on the system.
So you can utilize the search feature-- or the search command
to search for specific files.
You can also limit the results or search for files
with specific extensions.
All right.
So that is essentially how to navigate around the file
system.
As I said, you can also download a file from the target system.
So if we want to download the flag, or flag1,
we can essentially say, download and then flag1.
Hit Enter.
That will download it onto your system within the directory
that you're currently working in.
So if I put this in the background
and I list out the current working directory,
you can see that we've downloaded flag1 successfully.
So I'm going to say sessions and go back into session 1.
All right.
So that is the file system, generally speaking.
Now let's take a look at a few other interesting commands
that we can utilize with Meterpreter,
as they're going to be very, very important.
The first one is the shell command.
So if you want to pop a shell on a target system-- so,
again, this, when I'm referring to a shell,
I'm referring to the native shell of the operating system.
So if you're working on Windows and you
want to get a command prompt session, you can say shell.
And if you're working on Linux, this
will open up a terminal session.
So I hit shell.
As you can see, it will not give us any output in regards
to a shell.
But if we type in ls, that's being executed.
We can open up a bash session by saying /bin/bash -i.
And there we are.
So we now have a native Linux terminal session
on the target system.
This is not a Meterpreter session.
It's a native Linux terminal session.
And if you did the same for Windows,
you would get a command prompt session.
So, again, I can now perform or run the native Linux commands,
like, for example, ps, which will list of the process tree,
et cetera, et cetera.
So if I want to terminate this particular shell session,
I can use Control and C on my keyboard.
And that will tell me-- or ask me
whether I want to terminate the channel.
I want to hit Yes.
This will not terminate the Meterpreter session.
It's going to terminate the actual channel.
So there we are.
We are back to our Meterpreter session.
The next command that I want to explore here--
and this is going to be quite important-- is the process
command, which is ps.
That will allow you to list out the process
tree, or the processes that are currently
running on the system.
So there we are.
It will sort them by process ID, name, the user,
as well as the path.
Now, why is this relevant?
Well, if we wanted to migrate to any of these processes,
we could do that by typing in migrate, and then
specifying the actual process ID or the name of the process.
So in this case, let's say we wanted
to migrate into this process right over here.
All right.
So we can migrate to it by specifying the process ID, 580.
So we can say migrate 580.
We hit Enter.
And in this case, you can see that it's not going to work.
But, again, in many cases--
in this case, it has not worked because we-- for some reason,
we cannot migrate into this process.
And it comes down to, in this case,
the lack of sufficient privileges or permissions.
And, again, on Windows, you can also do this.
You can migrate to a process that you currently have
the permissions to migrate to.
In the case of Linux, if I wanted to migrate--
maybe let's try and migrate into the process--
let's see-- maybe process 868.
I can hit Enter.
And as you can see, it's going to tell us
that we have an error here with the Meterpreter session.
But don't worry about that.
Again, in this case, we're just going through the commands
here.
We can migrate to a process via the actual process name
by saying migrate -N, and then saying maybe apache2
or any of the process.
And in this case, you can see that that did not work,
because, for some reason, we cannot migrate our processes
within this particular Meterpreter session.
All right.
So that is how to essentially utilize--
how to utilize Meterpreter.
As I said, you can also run other networking commands,
like ifconfig.
And in this case, it doesn't run.
So we can execute a command on the target system
through Meterpreter by saying execute -f, and then
either saying ifconfig-- so we can say ifconfig right
over here, and that will create a process,
and it will execute it directly.
But we can utilize all of that.
If we list out the actual help menu here,
you can see, for networking, in regards to Linux
we don't have much that we can actually perform.
So that will not make much sense at this particular point
in time.
But, yeah, you can pretty much do what you typically
do if you had a terminal session or a command
prompt on a target system.
So I can create a directory, like I can say mkdir,
and we can say test.
I can list out the directory or the contents
of this particular folder, and you
can see that we have the test directory created there.
I can remove this particular directory
by saying remove directory and test.
That will remove it.
It's fairly simple to understand.
All right.
So that is really the fundamentals
of utilizing Meterpreter.
As I said, we'll be exploring more
as we progress through the post-exploitation sections
for both Windows and Linux.
So don't worry about the operating system specifics
in regards to Meterpreter and what we can and cannot do based
on the target operating system that we currently have access
to.
All right.
So go through the actual exercises
here, and try and download the flag, cat
out the contents of the flag, unzip the flag,
essentially test out the functionality of Meterpreter.
And get a good feel for it because we'll
be utilizing it quite a bit.
That being said, that is going to conclude
the practical demonstration aspect or side of this video.
All right.
In the next video, we will be exploring
the process of how to upgrade a standard command
shell into a Meterpreter session or a Meterpreter shell,
and we'll be exploring two techniques
that we can utilize to do this.
So I'll see you in the next video.