[ELECTRONIC NOISES]
Upgrading command shells to Meterpreter shells--
in this video, we are going to be exploring the process of how
you can upgrade a standard command
shell into a Meterpreter shell.
And of course, we've already explored
how to do this very briefly during the Windows and Linux
exploitation section, where we essentially obtained or gained
access to the target system via a typical command shell.
And we then upgraded our command into a Meterpreter session
or shell through the use of a post-exploitation module.
In this particular video, we'll be going over that process,
and we'll also be exploring an easier way or an easier
technique that can essentially allow
us to upgrade our standard command
shell into a Meterpreter session or a Meterpreter shell,
depending on what you call it.
So in this particular case, we are
going to be utilizing the same lab environment that we
utilized in the Linux exploitation section
where we were exploiting a SAMBA or a SMB server on Linux.
So I'm just going to switch over to the lab environment,
and we can go through this process.
So I'm back in the lab environment.
And the first step, of course, will
involve getting the target IP address, which we can actually
do by typing in ifconfig.
We can get the target IP address by heading over
to the ethernet 1 interface.
And right over here, this is our current Kali Linux IP address.
And the IP address, or the target,
is going to be on the next IP address within the subnet.
And of course, in your case, the subnet
is going to be different.
And the target IP is essentially going
to be on the third IP address within this subnet.
So we just need to replace the 2 with a 3 here.
So I'm just going to copy that.
We then need to again start up the PostgreSQL Database
Service.
So I'm going to say service postgresql start.
And we can also run a second command
using the two of the ampersand symbols
and saying msfconsole to essentially run
both of these commands together to save us
a little bit of time.
So there we are.
It's going to start PostgreSQL or, rather, the PostgreSQL
database server.
And it's also going to start up the Metasploit framework
console.
So there we are.
The Metasploit framework console is started up.
We can then create a workspace.
We're just going to call it upgrading_shells.
There we are.
We're then going to set the global variable
for the rhosts option to the target IP, which
will essentially save us from having to type in the target IP
whenever we load in a module as the variable is going
to be set globally.
So we'll change the 2 to 3.
There we are, fantastic.
We now need to gain access to the target system.
So the first step will involve performing an Nmap scan
on the target system.
And we will utilize the db_nmap command
to perform the Nmap scan from within MSF console, which
will again consequently save the Nmap scan
results into the Metasploit framework database.
So I'll perform some service detection on the target.
And we will specify the target IP.
So change the 2 to a 3.
Hit Enter.
And I'm just going to wait for this scan to complete.
So as we explored during the Linux exploitation section,
this is running a SAMBA version 3, both on 139 and 445.
So we can search for the exploit module by saying search.
And in the type, we will limit it to exploit.
And then we can just say samba.
And we are going to be utilizing the samba is_known_pipename
exploit module right over here, which will essentially
allow us to upload an actual shared object or a shared
library.
So we are going to say use, show options.
And in this case, the rhosts option
has already been specified for us as well as the port option.
We do not need to set any other options,
so we can just hit run.
This will give us access to the target system
by a typical command shell which, as we know,
is not an advanced session or really is not
as advanced as Meterpreter.
So there we are.
So this is a typical Linux command shell.
So I can hit ls.
And in this case, it doesn't display anything,
so I can type in pwd.
There we are.
And I can then say /bin/bash -i.
And of course, as I said, this is not
a reliable way of accessing or interacting
with the target system.
So what we'll do is we'll put this
in the background using the Control and Z keyboard
combination.
There we are.
And of course, we've already taken a look
at a session management.
So if I say sessions, you can see we have session 1 there.
And this, you can see that the type right over here
says that this is a typical command
shell on Linux or on Unix.
There we are.
So we can upgrade this particular command shell
session into a Meterpreter shell through the use, firstly,
of a post-exploitation module.
And the name of this module is called shell_to_meterpreter.
There we are.
I'm going to hit Enter, and that's the module here.
And we've utilized it previously.
So it's fairly simple to use.
So we'll say use, paste it in there.
If we show the options, because it
is a post-exploitation module, we need to set the session ID.
So we're going to say set session to 1.
And then we set the lhost option as that
is the actual IP address of the Kali Linux instance.
That is, again, right over here, the IP address of the host
that will receive the connection.
So we're going to set that to ethernet 1.
Specifying the interface will automatically
set up the IP for us there.
And we then do not need to specify the port
because the port is 4433.
And our current session that we currently have
is using port 46451.
So we can run, and that will upgrade the command shell
into a Meterpreter shell or a Meterpreter session.
So we'll give that a few seconds.
So once that is done, if we list out our sessions
you'll be able to see that we now have a Meterpreter
session on the target system that we obtained by, again,
upgrading our command shell.
And we can then interact with it by saying sessions 2.
There we are.
And we now have a Meterpreter session on the target system.
So I'm just going to exit or close
this particular Meterpreter session
and show you how we can shave off
that entire process of utilizing a post-exploitation module.
So I'm going to say exit.
That will kill the Meterpreter session.
And in order to upgrade the actual command shell session
through a very, really useful command,
we can say sessions and then open up
the Help menu right over here.
And you can see that the sessions command essentially
allows us to upgrade a shell or a command shell
to a Meterpreter session on quite a few platforms.
And in this case, it will or should work.
So we can say sessions, and then we say upgrade.
And then we can specify the actual session ID.
So we hit 1, and that is going to execute
that same post-exploitation module.
But it's automating that process for us.
So there we are.
You can see just by typing in this one command, that
has been facilitated and automated for us.
And we should get the Meterpreter session
opened in a few seconds.
There we are.
So if we list out our sessions, you
can see that we have sessions 3 here.
So I can say sessions 3, and there we are.
We have a Meterpreter session on the target system.
If we type in sysinfo, you can see
that is executed successfully.
We can say getuid, and we also get the current user ID
that we currently have access to.
So that is the process of essentially upgrading
your command shell into a Meterpreter session,
or a Meterpreter shell.
And the reason this is important,
as we explored earlier during the exploitation section,
is because some exploit modules may actually not
have the support or may not support the ability
to pair a Meterpreter payload to begin with.
So the only way to gain initial access
is through a command shell.
And then once you've gained initial access
and established a command shell session,
you can then upgrade it either through manually loading
the post-exploitation module, the shell_to_meterpreter
post-exploitation module, or you can automate that process
through the sessions command.
And, again, it's very simple to do.
And you can upgrade as many sessions
that you currently have, and that,
again, will help you save time as you progress
or as you utilize the Metasploit framework.
So that is going to conclude the practical demonstration aspect
or side of this video.
So that concludes the post-exploitation fundamental
section.
In the next video, we will begin the post-exploitation process
on Windows.
So we will get started by taking a look at some
of the various useful post-exploitation modules
available for Windows.
And, again, we'll be exploring the process
of utilizing them and, of course, getting
an understanding of what we can do
with the various post-exploitation modules that
are currently available for Windows.
So I'll see you in the next video.