Mar 18, 2014 07:10 PM
(This post was last modified: Mar 18, 2014 09:58 PM by Goodies.)
Hello everyone! :D
Today, I'll be writing a tutorial on Windows Post-exploitation. If you followed the last tutorial LOCATED HERE you have an NT AUTHORITY meterpreter shell running regardless of the user's privileges on the box. Now, we're going to use this to our advantage and find out some information about the box.
What is information Gathering?
Essentially, we want to gather information pertaining to this machine. This can mean passwords as well as files or network information.
What is a Backdoor?
A backdoor is an application that sits idly on the victim's computer until we intrude and connect to it.
Upon running sysinfo, we can see:
![[Image: kzXaycG.png]](https://i.imgur.com/kzXaycG.png)
Typing shell in the meterpreter session will spawn a windows system shell. Here, you can see that running net users shows me the users of the computer.
![[Image: CC7U5ac.png]](https://i.imgur.com/CC7U5ac.png)
Okay, great! How about we look at some users.
net user goodies
![[Image: 3Dfi926.png]](https://i.imgur.com/3Dfi926.png)
Just getting a feel for the owner
run hashdump will dump both the password hints and the password hashes.
![[Image: A9AmRUr.png]](https://i.imgur.com/A9AmRUr.png)
In my case, the password hint is the password. However, you can use JTR, Hashcat, or simply use googledorks to try and crack the hash. This is not what that tutorial is about though :P That will have to be done on your own time.
This can also possibly be used, in an NTLM authenticated SMB usershare, to log into other machines via pass the hash, psexec, or smbexec.
My personal favorite :)
First, run ipconfig so we can see which interface has the IP address assigned to it.
![[Image: jKULI98.png]](https://i.imgur.com/jKULI98.png)
In my case, it's Intel® PRO/1000 MT Destop Adapter. That's important, remember that.
Next, load the sniffer module by typing use sniffer . You can then type help to show the commands specific to the sniffer module.
![[Image: 3aTeuCn.png]](https://i.imgur.com/3aTeuCn.png)
![[Image: oJ85qsA.png]](https://i.imgur.com/oJ85qsA.png)
running sniffer_interfaces shows that interface ID 2 is what I must use for the sniffing.
![[Image: o0nMCfn.png]](https://i.imgur.com/o0nMCfn.png)
Let's start the sniffer:
sniffer_start 2 100000
100000 = The max number of packets allowed capture.
After a while, when you want to dump it, you can dump it by running:
sniffer_dump 2 /tmp/something.pcap
where 2 is the ID and /tmp/something.pcap is the pcap file that will be created and saved.
Stop and flush the sniffer with:
sniffer_stop 2
sniffer_release 2
Today, I'll be writing a tutorial on Windows Post-exploitation. If you followed the last tutorial LOCATED HERE you have an NT AUTHORITY meterpreter shell running regardless of the user's privileges on the box. Now, we're going to use this to our advantage and find out some information about the box.
Part II: System Information Gathering
What is information Gathering?
Essentially, we want to gather information pertaining to this machine. This can mean passwords as well as files or network information.
What is a Backdoor?
A backdoor is an application that sits idly on the victim's computer until we intrude and connect to it.
1. Sysinfo
Upon running sysinfo, we can see:
- Computer Name
- Operating System & Build
- Architecture
- Language
- Meterpreter Payload Type
2. Shell and Windows Scripting
Typing shell in the meterpreter session will spawn a windows system shell. Here, you can see that running net users shows me the users of the computer.
Okay, great! How about we look at some users.
net user goodies
Just getting a feel for the owner
3. Hashdump
run hashdump will dump both the password hints and the password hashes.
In my case, the password hint is the password. However, you can use JTR, Hashcat, or simply use googledorks to try and crack the hash. This is not what that tutorial is about though :P That will have to be done on your own time.
This can also possibly be used, in an NTLM authenticated SMB usershare, to log into other machines via pass the hash, psexec, or smbexec.
4. Packet Sniffing
My personal favorite :)
First, run ipconfig so we can see which interface has the IP address assigned to it.
In my case, it's Intel® PRO/1000 MT Destop Adapter. That's important, remember that.
Next, load the sniffer module by typing use sniffer . You can then type help to show the commands specific to the sniffer module.
running sniffer_interfaces shows that interface ID 2 is what I must use for the sniffing.
Let's start the sniffer:
sniffer_start 2 100000
100000 = The max number of packets allowed capture.
After a while, when you want to dump it, you can dump it by running:
sniffer_dump 2 /tmp/something.pcap
where 2 is the ID and /tmp/something.pcap is the pcap file that will be created and saved.
Stop and flush the sniffer with:
sniffer_stop 2
sniffer_release 2
Thank You for Reading Part II
SRPP Discord Server
I am a professional network/cloud security architect.
My Old Tutorials
I am a professional network/cloud security architect.
My Old Tutorials
![[Image: 2EOBWgX.png]](https://i.imgur.com/2EOBWgX.png)