[AUDIO LOGO]
Windows post exploitation modules.
Welcome to the Windows post exploitation section
where we will be focusing on the various post exploitation
techniques on Windows.
And then once we're done with the Windows post exploitation
section, we'll then move on to Linux.
So to get started with this section,
one of the key or one of the most important elements
of the Metasploit framework as we already explored
is the various modules available.
And we've taken a look at how to utilize exploit modules
and it's now time to begin exploring the various post
exploitation modules.
And in specific, we're referring to the Windows post
exploitation modules.
So the Metasploit framework, as we already know,
provides us with various post exploitation modules
for both Windows and Linux.
We can utilize these post exploitation modules
to enumerate information about the Windows system
that we currently have access to,
and some of this information that we're interested in
is, for example, the user privilege information.
So we have the ability to enumerate the user privileges
for the current user that we have access
to within our Meterpreter session.
We can also enumerate the logged on users,
which is very, very, very helpful in getting
an idea of what users are currently logged in
as well as users that have previously logged
in or recently logged in.
We can also check whether the actual target
system is a virtual machine, and that
again, can be important in staging your next attack
within the network.
You can also enumerate the programs that are currently
installed on the target system, which again can be very
helpful during the privilege escalation process
because you may find a specific version
or a specific program that's installed
that could be vulnerable to a privilege escalation attack.
We also have the ability to enumerate the antivirus
solutions that are currently installed on the system,
giving us an idea of what we can and cannot do.
We can also enumerate the computers that
are connected to the domain.
So again, if the target system is part of a Windows domain,
we can enumerate the other computers
that are a part of the domain, which again
can be very helpful in performing pivoting or getting
an idea of what other systems are currently on the target
network.
We can also enumerate the installed patches
or the installed updates on the Windows system.
So we can get an idea of what patches have been installed,
which again can be very useful if we are trying to identify
what exploits can actually be used
to elevate our privileges on this particular Windows system.
And of course, you have the ability to enumerate shares.
So there are post exploitation modules
that can be used to enumerate all of this information.
And that's what we are going to be exploring within this video.
We are also going to be taking a look at the various Windows
Meterpreter commands that we couldn't
explore during the Meterpreter fundamentals video.
And again, this will give you an idea
of what we can do on Windows.
And then once we move on to Linux or the Linux post
exploitation section, we'll also explore
the various post exploitation modules associated with Linux.
So in this case, the lab environment
that we're going to be utilizing is the Windows HTTP file server
lab that we utilize when we were exploiting the HTTP file
server.
And again, it's going to be fairly simple.
We're going to gain access to the target system,
and then we're going to begin performing
the local enumeration or performing enumeration
with the various post exploitation modules available.
All right, so I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And in this case, we actually get the target IP address
specified for us, which is great.
So I'm just going to copy that, and we'll
open up a terminal here.
There we go.
I'll just maximize it and increase the font size
so you can see what's going on.
All right, so first and foremost,
we need to start up the PostgreSQL Database Service.
So I'm going to say start service postgresql start
and we can also execute the msfconsole command
by using the double ampersand commands or keys, if you will.
So we're going to say msfconsole,
and this will essentially start up both the PostgreSQL database
server and msfconsole within a single command, which again
will save us a lot of time.
So there we are starting the Metasploit framework console,
and we want to create a workspace here,
and we are just going to call it windows_post.
There we are.
Fantastic.
So we are going to set up the global variable for the RHOSTS
option so that we don't need to keep
typing the IP address or the target IP
address whenever we load a module.
There we are.
And as I said, in this case, we still
need to gain access to the target system.
And in this case, we are going to be
exploring the vulnerable Rejetto HTTP file server.
So we are just going to perform a quick Nmap
scan on the target.
We're using the db_map command, which
allows us to perform an Nmap scan from within msfconsole
and consequently save the Nmap scan
results into the Metasploit framework database.
So I'm going to perform a service detection scan,
and I'll provide the target IP there, hit Enter.
And I'm just going to wait for that to complete.
All right, so once the Nmap scan is complete,
as you can see here, we have the HTTP file server running,
and this is the Rejetto HTTP file server
version 2.3, which as we know, is vulnerable,
so we can essentially just search for the exploit.
So I'm just going to say search rejetto.
And this is the exploit module that we
had utilized during the Windows exploitation section.
So I'm going to say use, paste that in there.
If we show the options here, the only option
that we need to specify is the target IP,
which is done for us automatically
because we set the global variable for the RHOSTS option.
So we can just hit run.
All right, so it looks like we get a Meterpreter session.
So we're just going to wait for it to actually pop up.
There we are, so we get the Meterpreter session
and we can actually explore some of the Windows Meterpreter
commands that we couldn't explore previously.
So again, if I type in sysinfo, which will work either way,
you can see that the computer hostname is right over here.
We then have the operating system version, in this case,
we are running a Windows 2012 R2 6.3 build 9600.
The target operating system architecture is 64-bit
and the Meterpreter architecture is 32-bit.
So we can actually upgrade that.
But before we do that and we'll be exploring
a post exploitation module that can automatically
do that for us, before we do that, again, if we type in
get user ID, you can see that we're currently
the administrator on this particular system.
But if we open up the Help menu or the documentation
for Meterpreter, you can see that we now
have additional commands, and this
is because we are now on a Windows system.
So we have the ability to type in the
get system command, which will attempt
to elevate your privileges and we'll test that out
in a second.
We can also dump the contents of the SAM database
using the hashdump command.
A few others are like the webcam command.
So if the target system has a webcam attached,
we can essentially list out the webcams, take a snapshot,
start a video chat, record audio from the microphone.
So there is really, really cool stuff that we can do here
when we are again running on a Windows target
or when we have an Meterpreter session on a Windows target.
We also have some user interface commands.
So we can essentially list all accessible desktops and Windows
stations, we can also start a key logger.
So we can essentially say keyscan_start,
and then we can stop it whenever we are done
and then dump the actual keystroke buffer.
And in this case, we can pretty much interact with the mouse,
take a desktop of the screen or rather a screenshot
of the desktop.
So again, if we type in screenshot,
give that a few seconds, you can see
it's going to be saved within the actual current working
directory.
So if I open up a new tab here or if I open up the actual File
Explorer, you can see that we actually
get a screenshot saved.
And you can see, indeed, it is running Windows Server.
So Meterpreter on Windows is really, really, really powerful
in regards to what we can do on the target system.
There are a few other commands that we can also
perform or execute, and we'll be exploring them as we progress.
But in terms of navigating the file system,
it's pretty much the same on both Windows and Linux.
So let's explore some interesting commands
that we can utilize to perform some local enumeration manually
with Meterpreter operator before we explore the post
exploitation modules.
So we can utilize the getsystem command to essentially
try and elevate our privileges.
So if I say getsystem, you can see
it's going to say got system via technique 1, which is the named
pipe impersonation or token impersonation privilege
escalation technique.
So if I now say getuserid, you can see we now
have administrative privileges.
So we have anti-authority system privileges which, as we know,
this is the highest level of privilege on a Windows system,
which is great.
We can also run the hashdump command to dump hashes.
And in this case, it looks like that failed primarily
because we may not have access to the SAM database, which
is perfectly fine.
A few other really, really cool commands that we can run
are commands like the show_mount command.
So if I just type that in, show_mount,
this will essentially display a list of mounts or drives
attached to the system.
So you can see we have the C drive here.
It also tells us the type, whether it's fixed
or whether it is actually removable.
In the case of removable, that would typically
indicate that this is a USB flash drive
or an external hard drive.
So the size is 30 gigabytes and the amount available
is eight gigabytes.
It can also display whether this particular disk has
been mapped, which is awesome.
So that is the process of essentially enumerating
the actual mounts and drives attached to the Windows target.
We can also run a few other interesting commands.
So we list out the process tree, you
can see that we have all of these processes here,
and they are sorted by process ID, PPID, name.
the architecture, session, user, and the path.
So if we wanted to migrate maybe to explore a .exe,
we can do that by, again, either utilizing the process ID
or the actual name of the process.
So I can say migrate, and then to the process ID 2212, which
is, again, is a 64-bit process, which means our Meterpreter
session will also be upgraded.
So if I say migrate 2212 and hit Enter,
you can see it's going to say migrate,
it's going to migrate that process.
There we are, migrations completed successfully.
So if I type in sysinfo, you can see
that we now have a 64-bit Meterpreter
session, which is awesome.
So we can do quite a lot of interesting things
that we couldn't do on a Linux system,
primarily because Linux systems are
different in terms of the architecture
and the way they are built.
So we can pretty much do what we could before.
So we can download files, upload files.
If I say directory here or ls, this
will list out the current working directory,
and then I can navigate to the root of the C drive
and then list out the actual directory here
or the directory is here.
And we have a flag.txt file.
So let's actually cut the content of that flag.txt file
and we get the flag there.
We can print out our current working directory,
we can download the flag.txt file.
So you can say download flag.txt, that'll download it
for us onto our local system.
Really, really simple.
OK, so that is Meterpreter on Windows.
And you can, of course, explore all of the other commands.
What we're going to do now is put this in the background
because we want to run some post exploitation modules.
So I'm going to say sessions.
And as you can see, we currently have our Meterpreter session
here.
So let's take a look at some of the post exploitation
modules we can use.
So first and foremost, if you ever
want to migrate or essentially change
the architecture of the Meterpreter payload,
we can utilize a module called upgrade.
So I'm just going to search for upgrade here.
And we can actually limit this to Windows
and we should have the upgrade, we
should have the upgrade modules somewhere here.
For some reason, I can't see this because
of the way this is actually--
I'm just going to zoom out a little bit here.
Right, I can't actually see that here.
Let's change or get rid of the platform there.
If we search upgrade or migrate, there we are.
So we have the ability to migrate or essentially change
the architecture.
So there's the architecture migrate module.
We also have the post/windows/manage/migrate
module, which allows you to essentially migrate
your process like we did manually with the actual
Meterpreter session.
So again, if we were to try and do this here,
so let's just try and use this module and let's see.
Again, we'll say use show options.
In this case, this will allow us to essentially create
a new process and then migrate into it.
So we can specify the name of the process.
It's not required, but you can if you
wanted to give it a very clandestine or name that's
not easily recognizable.
You can also specify the process ID
of the process you want to migrate to,
similar to what we did within Meterpreter.
In this case, I'm just going to set this session to 1,
and we're just going to run it.
And in this case, it looks like it says current server
process is explorer.exe.
The reason that failed is because we are currently we
already migrated our process.
So if we check our sessions, we should still
have access to our session one here.
There we are.
So I'm just going to put that in the background.
And let's take a look at some of the other post exploitation
modules we can use.
All right, so the first post exploitation
module we can explore is the Windows privileges module.
So we can search for it here.
So I'm going to say search win_privs.
This will essentially enumerate the privileges
of the current user that we have access to.
So you can see Windows gather privileges enumeration.
So we are going to say use, paste that in there.
And of course, you can see this is a post exploitation
module for Windows.
So that's the key thing to keep in mind there.
Show options, we can set the session here.
We're going to set it to session one, hit run.
As you can see, this will list out, first and foremost,
information about the current users.
So it's going to say is the user admin?
Yes, the user is admin.
Do we currently have system privileges?
No, we don't.
But of course, we were able to elevate our privileges.
But the technique through which we
did that was through token impersonation, which again
doesn't give our current user or rather our current session
administrative privileges, it essentially
means that current process or we have essentially
impersonated the token of an elevated process.
So we would still have administrative privileges
or anti-authority system privileges
within that Meterpreter session, but the actual session
itself will not be considered elevated.
So it's going to say, is it in the local admin group?
True.
Is user access control enabled?
True.
That can also be a very good privilege escalation attack
vector that we'll probably explode in the next video.
And then it gives you the user ID here,
and then the actual Windows privileges
which can give you an idea of what you can do currently
as these are the Windows privileges associated
with this particular user.
All right, so that can be very helpful in identifying
what privileges you have and what privileges you don't have.
Now the other important post exploitation module
is the post exploitation module that
allows us to check what users are currently logged on.
So we can search for it.
The name of the module is enum_logged_on.
So I'll hit Enter, and there we are, it's enum_logged_on_users.
So this will check and will actually
tell us whether we have any currently logged on users
or it'll essentially enumerate any of the previously logged
on users, which again, will give us an idea of what users are
frequently logging on to the system,
as well as the users that are currently on there.
And that can again help us or give us
a bit of a heads up in regards to whether or not
we are being watched or whether or not
our activities are being noticed.
So as you can see, we have the ability
to set the current option, which will check
for the or enumerate the currently logged on users,
and then the recent option here will enumerate
the recently logged on users.
So we only need to set the session.
In this case, we're going to set the session to one.
There we are.
Fantastic.
And we can just hit run.
Give that a few seconds.
There we are.
As you can see, it's going to give you the currently logged
on users and their SIDs.
In this case, this is the administrator.
That's currently the logged on user.
And then the recently logged on users are provided here.
So it looks like apart from the administrator,
we have only had a few other service accounts here
that have logged in.
So that's a good thing from an attacker's perspective
or a penetration tester's perspective
because the last thing you want is
to have someone detect your activity
and consequently terminate your access.
So that's a very, very, very helpful post exploitation
module.
Now, the other module that's really, really
interesting and really cool is the Check VM module,
which will essentially tell you whether the target system is
indeed a virtual machine.
So we can search for it and say check VM.
And the one we're looking for is the Windows one.
So as you can see, this post exploitation module
exists for Solaris as well as Linux.
So we'll use the Windows module here.
So I'm just going to copy that and say use, paste that
in there.
We can then show the options for this module,
and we only need to set the sessions, which is
exactly what I'm going to do.
So we're going to say set session to one and hit Run.
It's going to check whether it's a virtual machine.
And let's see what it tells us.
All right, so as you can see, this is a Xen virtual machine.
And this information is important
because if the target is a virtual machine,
then we could potentially utilize some VM
breakout exploit modules to essentially break out
of the virtual machine and consequently gain access
to the host operating system that
is hosting the virtual machine.
But again, that is a bit of an advanced technique
that we'll not be covering in this course.
But that is possible.
So we've been able to enumerate the user privileges,
we've also been able to get an idea of the currently logged
on users, and we have also been able to get
an idea of whether the target is indeed a virtual machine.
Let's take a look at how to enumerate
the installed programs on the target.
So we can do this by searching for a module called
enum_applications.
There we are.
That's the module here.
This will essentially tell us what programs are
installed on the target system.
So we'll show the options here, set the session
to the session ID, which in this case is 1, and we had Run.
All right, so that's done.
And as you can see, it tells us right over here
that these are the programs installed, as well
as their versions, which is very important because if we
identify a privilege escalation vulnerability within Mozilla
Firefox version 80.0.1, then we could potentially
utilize Firefox to elevate our privileges.
So this information is very, very useful.
In this case, we can see that there's really nothing
apart from Mozilla Firefox in regards to third party programs
here.
We have a few AWS drivers which might give us
an idea of where this virtual machine is running.
And in this case, it looks like the virtual machine is running
in an AWS cloud environment.
So that's also another important piece of information there.
Now whenever you utilize a post exploitation module,
you can see that the results will
be stored within the following directory,
and you can always access the locations
of these particular files by typing in the loot command.
So if you created a workspace and you started up
the PostgreSQL database server, then all of this data
is going to be stored within the Metasploit framework database
and you can access that data by typing in loot.
And as you can see here, it's going
to give you an idea as to what type of information it is.
So for example, the active users can
be found within this directory here
within this particular file.
So if we open up that directory within our File Explorer here,
and I'm just going to show the hidden files,
there we are, and we head over into the MS4 directory,
there we are, and we take a look at the loot folder,
you can see that all of this information we have enumerated
is stored for us, which is very, very helpful.
So let me just set this or actually list this out
as a list here.
So for example, we can list out the actual applications
install.
So if we open that up, you can see that information
is stored for you, which is excellent all right,
so let's take a look at a few other post exploitation
modules.
So we can actually check what antivirus software
or rather what antivirus solutions are installed
on the target system, as well as enumerate the excluded folders
that have been specified within the antivirus system.
So we can get an idea of what folders are not
being scanned by the antivirus solutions installed.
So we can search, we can say search,
the type is post, because we are searching for post exploitation
modules, the platform is Windows,
and then we can probably search av, so antivirus.
We can probably change that to something enum, maybe enum av,
there we are.
And in this case, we can enumerate the actual Windows
antivirus exclusions.
So Windows Antivirus or Windows Defender,
let me just clear that out, is the default antivirus solution
installed on Windows systems.
So if there are any excluded folders that are not
being scanned, then that again can be very useful information
as we could potentially use those directories to store
our exploit code or any payloads that we
want to transform the target and execute on disk.
So if we show the options here, you can set the session.
And you can see it allows you to specify
the actual setting for the following antivirus solution.
So Windows Defender, we have the Microsoft Security Essentials
antivirus system here, as well as the Symantec Endpoint
Protection solution.
So it will enumerate the excluded folders
for all of these antivirus solutions.
So we're going to hit Run.
As you can see here, it says found Windows Defender,
no extension exclusions for Windows Defender, no path
exclusions for Windows Defender.
So in this case, no excluded folders or extensions
have been set, which means pretty much
the entire file system is being scanned and monitored
by the antivirus solution.
OK, let's take a look at a few others like the ability
to enumerate the computers that are part of the domain.
So we can do that by searching for a module called
enum_computers.
And that's the one there.
So we're going to say use, paste that in there,
show the options, and we just need to set the session.
Now I'm not sure whether this particular target
system is part of the domain, but that's
why we are doing this.
We want to find this information or we actually
want to find out.
So as you can see, we had run, and it
says that this host is not part of a domain.
So we know that it's a sole system that's
running within AWS, and it's also a virtual machine.
That's all that we've been able to tell.
And of course, we know that it's running Windows Server 2012.
So now let's take a look at how to enumerate
the installed patches, which is very, very important
during privilege escalation.
So we can search for the enum patches
module, which is enum_patches.
And that's the one there.
This will essentially enumerate or gather the applied patches
on the target system.
So we'll use that module, show the options.
So we can specify a comma separated list
of KB or Microsoft patches to search for.
So these are the actual hotfix IDs here.
And you can specify your own list
if you want to check whether a specific batch has
been installed on a target.
So you can do this, or this is very important
if you are trying to identify whether a particular patch has
been installed, a patch that sorted out or fixed
a vulnerability that you wanted to exploit.
So in this case, we can get rid of the KB list,
but we can just leave it as default
and set the session to one and hit Run.
And in this case, it says known bug in the WMI query,
try migrating to another process.
So let's say session is here.
And if we head over into sessions or sessions one,
we'll list out the current process tree.
We can try and migrate to another process,
probably svchost.
And we can do that to the process
that has anti-authority system privileges.
So that is 896.
So we're going to say migrate 896.
So that completes successfully.
So I'm going to put this in the background.
And we can try and run that again.
And it looks like we're still getting an error.
All right, so that looks like it might be an issue within WMI.
So we might not be able to get that at this particular point.
But what we could do in order to identify this information
is we could open the session.
So we're going to say sessions 1,
and we can open up a shell session, which will essentially
open up a command prompt, and we can essentially
get this information by saying system info.
So if we type in system info, and this is a Windows
native command, this will give you
an idea of the installed patches on the target system.
So as you can see here, it provides you
with a list of all installed patches on the target system.
So these are the hot fixes and the hot fix IDs.
So if that post exploitation module fails on you,
you can always revert to manual search or manual enumeration.
So I'm just going to terminate this channel,
and we'll put our Meterpreter session in the background.
And we can look at or take a look at a few other modules
or rather just one or two more.
The one that we want to take a look at now
is the enum_shares module, which will essentially allow
us to enumerate any shares.
So we're going to say use, paste in that module
there, show the options, and we can then specify the session.
So we're going to say set session one.
And the other options essentially
allow you to display the current configured shares
to essentially enumerate the shares that
were entered as UNC ports.
So the shares that were entered manually
within Windows Explorer or within the File Explorer.
And then, of course, the recent shares.
So we can just hit run.
And as you can see, it says that the following shares were found
and that's the print share which is used again to facilitate
the sharing of printers.
OK, because shares or the sharing
of resources on Windows, as we know,
is facilitated through SMB, which we've already explored.
All right, so that is pretty much it in
regards to the post exploitation modules you can use.
There are a few others that we can explore, like the ability
to check whether RDP is enabled.
So we can search for that.
And RDP is essentially the remote desktop protocol,
and that protocol is used to remotely access
a Windows system.
And of course, we can essentially
get a graphical user interface instead
of utilizing a terminal.
So to check for that, we can search for RDP
and limit the platform maybe to Windows.
And we get a few modules here.
I'm not sure whether they apply to RDP,
but we can essentially try and check with the RDP enabled.
I believe there was a module for that.
But this module essentially allows you
to enable RDP on the target.
So we can say use and say show options.
We're going to set the session to one.
We don't have the RDP credentials,
so we will not be able to do that.
So we're going to hit run.
And as you can see, it says RDPs already enabled.
So we could be able to establish an RDP session with the target
system.
But as I said, we will be exploring RDP
during the Windows exploitation section.
So once we have explored privilege escalation
persistence, we'll take a look at how to enable RDP
and how to access the target via RDP.
All right, so that concludes the practical demonstration side
of this video.
All right, so that was quite a lot of information.
But again, it's all extremely useful during the post
exploitation phase.
In the next video, we are going to be exploring
the process of elevating our privileges on a Windows system
by bypassing UAC or User Access Control.
So I'll see you in the next video.