Instructor: In today's lecture, 2 2
we're going to learn some basics 3 3
about how to interact with metaploits interpreter. 4 4
So I already have a session here, 5 5
and as as you can see it just meterpreter. 6 6
In Linux, in everything, in every command line, 7 7
the help command is always the best command you can run. 8 8
So the first thing we're going to do, 9 9
we're gonna do a help. 10 10
And as you can see we get a big list 11 11
of all the commands that you can run, 12 12
and a description of what each of these commands do. 13 13
So, I'm gonna show you some basics right now, 14 14
first thing that I want to show you 15 15
is the background command. 16 16
So background 17 17
will basically backgrounds the current session, 18 18
so in one terminator session, 19 19
it will just, it's very similar to minimizing a window. 20 20
So when I run background, I'll go back to metasploit 21 21
as you can see there, 22 22
and I can run other metasploit exploits 23 23
to further exploit the target machine, 24 24
or just to exploit other machines. 25 25
While maintaining my connection 26 26
to the computer that I just hacked. 27 27
So, to see a list of all the computers 28 28
or the sessions that we have, 29 29
we can just run sessions, 30 30
L, to list the current sessions, 31 31
and as you can see we have a session here, 32 32
meterpreter, so it's still there, we didn't lose it, 33 33
and it's between our device and the target device, 34 34
which is 206, 35 35
now in order if I want to get back into that session, 36 36
to interact with the meterpreter again, 37 37
all I need to do is run sessions again, 38 38
minus I for interact, 39 39
and then I'm gonna put number two, 40 40
which is the ID of the session. 41 41
And as you can see I'm back in the meterpreter session. 42 42
Another command that I wanna show you 43 43
is the sysinfo, 44 44
and you see me run this every time 45 45
I hack into a system, and the reason for this command, 46 46
it shows you information about the target computer, 47 47
so it shows us the computer name, right here, 48 48
we can see the operating system of the target computer, 49 49
and it's running windows 10, 50 50
we can see the architecture, 51 51
so it's a 64-bit computer, 52 52
so in the future if you wanted to run 53 53
some executables on that target, 54 54
we know it's a 64-bit and we create a 64-bit executables, 55 55
we can see that the language is English, 56 56
the work group that it's working on, 57 57
and the user ID that it's logged in, 58 58
and then we can see the version of meterpreter 59 59
that's running on the target machine, 60 60
and it's actually a 32-bit version 61 61
of meterpreter. 62 62
Another useful command for gathering information 63 63
is IP-config, now IP config is very similar 64 64
to the IP config that you get when 65 65
you run on the windows machine on the command prompt, 66 66
and it'll show you all the interfaces 67 67
that are connected to the target computer, 68 68
we can see for example, 69 69
here interface one, 70 70
we can see the MAC address, 71 71
we can see the IP address, 72 72
and for example here, this is the interface 73 73
that is connected to our network, 74 74
and the one that we got the connection from, 75 75
so if the device is connected to multiple networks, 76 76
you'll be able to see al the interfaces 77 77
and how to interact with them. 78 78
Another useful information gathering command 79 79
that you can run is PS, 80 80
now PS will list all the processes 81 81
that are running on the target computer. 82 82
So these might be background processes 83 83
or actual programs running in the foreground 84 84
as windows programs or GUIs. 85 85
You can see each process here, 86 86
the name of the process, 87 87
and then you can see the ID, or the PID, 88 88
in which it's running. 89 89
An interesting process is the explorer.exe, 90 90
and that's literally the graphical interface of windows, 91 91
and we can see that it's running on process ID 2116, 92 92
now a very good idea once you hack into a system, 93 93
is to migrate the process, the current process 94 94
that you're running on into a process that is safer 95 95
than your current process. 96 96
For example, the explorer is the graphical interface 97 97
of windows, so it's always running 98 98
as long as the person is using their device. 99 99
So, it's much safer than the process 100 100
that you gained your access to the computer through, 101 101
for example, if you gained your access 102 102
through an executable, or a program, 103 103
you will lose your process as soon as 104 104
the person closes that program, 105 105
so a better way to do is 106 106
to migrate to a process that is less likely to be closed, 107 107
or terminated, so what we're going to do, 108 108
we're going to use a command called migrate, 109 109
to move our current session into a different process, 110 110
and we're gonna use the explorer process 111 111
because it's very safe, 112 112
Put 2115, 113 113
and there's no such process obviously, 114 114
so it should be 2116, 115 115
and the migration's successful now, 116 116
so the meterpreter at the moment is running from 117 117
the explorer.exe, now if we go to the task manager 118 118
on the target computer, 119 119
and run my system monitor, 120 120
or resource monitor, sorry. 121 121
Now if we go on network, 122 122
and go into CP connections, 123 123
you'll see that the connection here on port 8080, 124 124
is coming from explorer.exe, 125 125
so it's not coming from a malicious file, 126 126
our payload or backdoor is actually running 127 127
through the explorer, 128 128
now if you see firefox or chrome, 129 129
you can migrate to that process, 130 130
and especially that you're connecting 131 131
through port 8080, or you can use 80, 132 132
then it's gonna look even less suspicious 133 133
because 80 and 8080 are the ports used by web servers, 134 134
so it's very natural or very normal 135 135
to have a connection on port 80 or 8080.