Windows keylogging.
In this video, we will be exploring
the process of performing keylogging on a Windows target
once you have gained access to it.
So again, keylogging is a fairly simple concept to understand.
And let's get an idea of what it is.
So keylogging is essentially the process
of recording or capturing the keystrokes entered on a target
system.
However, you must also know that this particular technique
is not limited to post exploitation.
There are plenty of programs or USB devices
that can be used to capture and transmit
the keystrokes entered on a system to the attacker
or to a target system.
So keylogging is not just part of a penetration test or post
exploitation for that matter.
It's also used by intelligence agencies and governments
to monitor people to essentially gather data, as well
as malicious actors.
So the typical way or the typical access vector
is they would gain access to your target system
either physically or remotely and install
a piece of keylogging software that runs in the background.
Or some of the other techniques that are leveraged
or that are utilized are malicious USB devices
that are plugged in at the back of the system.
And they essentially capture all the keystrokes or all the input
that's being inputted by your keyboard and mouse as well
and then sends that data back onto the attacker's system
or to the system that has been specified
by the actual malicious actor.
Now, we do need to explore all of these programs
because Meterpreter on a Windows system
provides us with the ability to capture the keystrokes entered
on a target system and download them back to our local system.
So why is this important?
Well, let's say we don't want to interact
with the target system via RBP because it's
too much of a risk.
And, of course, we risk getting caught because we're actually
physically interacting with the system with a mouse
and clicking around.
So what we can do is we can set up
keylogging through Meterpreter so
that every keystroke or every piece of data that's
entered by the user on the target system
like website passwords, maybe other credentials
will all essentially be captured.
And then we can get that data back and then utilize
that data to essentially exploit the target environment further
or to gain access to some of the websites or accounts
that the target individual is logging into.
So again, it's a very, very important process.
And it's one that I think you guys should be familiar with.
So let's take a look at how we can do this.
And all you need to do, of course,
is to start up your lab environment,
and I'll join you in.
And we can get started with essentially
exploring the process of performing
keylogging on a Windows target.
So I'll see you there.
So I'm back within the lab environment.
And within this lab environment, you
have the option of switching between the attacker machine as
well as the target machine.
And the reason this is enabled is that--
or is so that you can actually perform the actual keylogging
process and visualize or see that it actually works.
So we'll actually enable the keylogger
and then head over to the target system,
type in a few usernames and passwords.
We're enter some data with a keyboard
and then see that indeed it does work.
Now the target system is running Bad Blue Enterprise Edition,
so we are going to be utilizing that vulnerable service
in order to gain access.
So I'm just going to copy the target IP,
and I'm going to open up a terminal here.
Maximize it.
And let's increase the font size,
so you can see what's going on.
And I'm just going to start up the PostgreSQL Database
Service and also MSF console.
The reason we're starting the PostgreSQL Database
Service in this case is because all of the keystrokes
will actually be saved within the MetasPloit framework
database within our current workspace.
So I'm just going to wait for this to actually complete.
There we are.
And as you can see, we have access to a MSF console.
So I'm going to create a workspace here,
and I am going to call it--
we will call it Keylogging.
Fantastic.
So given that we know that the target
system is running Bad Blue, we can search for the Bad Blue
exploits.
I'm going to just say search badblue.
There we are.
And we are going to utilize--
we are going to utilize this particular exploit module here.
However, before we do that, let's
set up the global variable for the RHOSTS option
to the target IP so that we don't
have to type in the target IP every time we load a module.
So I'm going to say copy, and I'm
going to paste that in there.
So we're going to say use that particular exploit module.
If we show the options, you can see that the target
IP is specified.
The target port is specified.
The only option we need to change is the exploit target.
So I'm going to say set target to BadBlue Enterprise Edition
2.7 Universal.
And it exploit, and we should get a Meterpreter session
on the target system.
There we go.
We get a Meterpreter session on the target system.
And we can perform some quick enumeration here.
So I'm going to say sysinfo and maybe get user ID.
There we are.
So we currently have administrative access.
So what we can do now is, of course,
get started with the keylogging.
But before we do that, I'm going to migrate to the Explorer.exe
process because, for some reason,
the keylogging service or functionality
within Meterpreter doesn't really work very well when it's
not done on the Explorer process or when we don't have
access or Meterpreter's not running
within the Explorer process.
So I'm going to just search for Explorer.exe
And we can migrate to 2312.
And, of course, that will give us a 32 or rather
a 64-bit Meterpreter session.
There we are.
So that should migrate relatively easily.
Now that is done, we can open up the documentation
for Meterpreter.
And if we head over onto the actual user interface commands,
you can see that we have the ability to, again,
capture keystrokes, stop capturing keystrokes,
and dump the keystroke buffer.
So these are the three commands that we will be utilizing.
Now there are a few others that you can use like the ability
to send keystrokes.
But that really is redundant if you have access via Meterpreter
because you can pretty much execute
all the commands that you want to execute
remotely using Meterpreter.
So the key commands here are the key scan commands here.
So what we can do is head over to the target machine.
And I'm just going to open up a Notepad session really quickly.
There we are.
I'm just going to open up Notepad
so that we can enter some test data
and see whether it's being captured.
And what we'll do is head over back to the attacker machine
and start the key scan.
So I'm going to say keyscan_start.
There we are.
That's going to start the key stroke sniffer.
If we head over to the target machine
and start typing in some data maybe like a username.
Maybe we can say the username is just admin,
and then the password is maybe hacked321 or something
really simple.
So essentially, any data that's being input by the keyboard,
whether it's in the browser or within any text
editor like Notepad or really any input from the keyboard
is going to be captured, so it's not limited just to Notepad.
So we've started the keystroke sniffer.
We can then say keystroke_dump or keyscan_dump.
That will dump the buffer.
And as you can see, it will dump the captured keystroke.
So it says right over here we used the-- so
it actually highlights some of the function keys.
So it says shift, username, shift, shift, admin,
shift, password.
And the reason it's saying shift is because I actually
set this to uppercase.
So whenever you're working with the keyboard,
you use shift to essentially set the actual letter to uppercase.
So that's why you're seeing it.
And then, of course, in this case,
we actually performed a backspace
and then typed in hacked.
So you can see that this does work.
We can also continue entering data like this is sample data.
And we can then head over back in here
and perform the keyscan_dump.
As you can see, this is some sample data.
And again, it's fairly simple to understand.
We can also open up maybe a partial session here
and type in ipconfig.
There we are.
That'll give us all the interfaces.
We'll give that a few seconds.
PowerShell is relatively slow.
So there we are.
And we can then say keyscan_dump.
And in this case, it doesn't actually capture that.
So what we can do is stop the actual key scan sniffer.
So we're going to say stop and then start it again.
So you may experience this issue.
So I'm going to say start again.
And now if we type in ipconfig on the target,
and let's see whether that's actually going to be dumped,
so keyscan_dump.
As you can see, ipconfig is now captured.
So you may need to start and stop it
depending on the application that's currently being
used on the target system.
So it's a good idea to keep that in mind.
So that is the process of performing
keylogging on a Windows system.
And as you can see, this can be very
helpful in capturing some really important data
that the user on the target system may be entering.
So that is going to conclude the practical demonstration
side of this video.
In the next video, we will be exploring
the process of clearing our tracks on a Windows system.
So we will be taking a look at how
to clear the Windows event logs on a Windows target system
and why this is so important once you're
done with your assessment or penetration test.
So that's what we're going to be exploring in the next video,
and I'll see you there.