Welcome back, everybody.
Today we're just gonna continue from where we left off.
I am going to do a couple of things with Metasploit, and
those will include making our reverse shells persistent on another system and
escalating privileges in order to do that, because we do need an elevated
set of privileges to do certain things on a system elsewhere.
Now, I can just see the question in the discussions now,
can we actually do a remote desktop?
Yes, you can actually have a desktop of another person being displayed on
your own screen but I strongly, I strongly recommend against it.
Okay, if you're doing this in LAN, fine, it can pass, but
if you're doing this over the net, having a remote desktop is a waste of bandwidth.
I mean, complete waste of bandwidth.
I do not understand what it is exactly that you would like to see
on their desktops.
You can take screenshots if you want of certain things.
If you need passwords,
you can use keyloggers which are embedded in Meterpreter.
You just need to issue a command to log keystrokes, I don't know,
stuff of a kind, but I really don't see the point of a remote desktop.
If you want to see if they're browsing something on the net and
if they're watching something on the net, you can obviously see the addresses,
you can see the IP addresses of what they're visiting on the net.
Not the IP addresses but you can also see the domains and
then you can just copy them into your own browser and
have a look at whatever you want to see almost in real time.
I know that would be a bit of a drag, but believe me, it saves up on bandwidth,
and if you do a remote desktop over the net, you are very likely to render
the other person's web browsing experience practically inoperable.
They won't be able to browse the web, I mean, they will, but
it will be very slow unless they have a really good connection.
And unless you have a really good connection, you won't be able to do that.
Try running TeamViewer and you will see that it's not
the fastest of applications out there, not because of the way it was built,
but because of the amount of information that is passing in between two points.
Anyway, you should have pretty much the same setup as from the previous tutorial.
You should not have closed anything, I sincerely hope that you didn't.
It doesn't matter, if you did, you can just repeat it.
Here, we're gonna go ahead and
open up our shell, so just do the same things.
It's still running, I believe, on my Windows 8.1 machine,
and let's see, will it actually work out here.
Or, hold on.
Oh, I already have it running.
So it's working, and let me show you how is it working.
I'm going to go over these commands with you, don't worry about it.
I just want to get into Meterpreter now, excellent.
So we are now in the Meterpreter.
Let me just prove to you that I am in fact a Windows machine.
So cd.
There we go, these are obviously Windows files, cygwin.
I even have that installed on my Windows machine.
Amazing.
Doesn't really matter.
Anyway, now you can see that I am in my Windows machine.
I've just closed the Meterpreter.
I've actually placed my Meterpreter shell into background.
And that is something that you can do and that you will be forced to do during
certain hacks, primarily because you will want to do other things with that session.
You will want to open up a session and
then you will want to do different things to that session.
You want to pass that session to different exploits so they can use it as well.
And you obviously can't do that like this.
Now, what you would do is put it in the background.
But before we do, just go ahead and type in help.
This is going to give you a list of commands.
This is a very nice command, getsystem.
Attempts to elevate your privileges.
But this doesn't really always work.
And here you have webcam commands.
I can't do this demonstration on a virtual machine.
But this is only for physical machines,
unless you have a USB camera or something of a kind.
It's not really that hard.
You just type in run and then one of these commands.
You will see later on, we will do something.
We will use some of the commands, not for webcam, but we will some other commands.
I do believe that it is just run and then this and
the rest will simply fall onto the system, the system will be able to do the rest.
Anyway, so you have these things, you can take screenshots,
you can start capturing keystrokes, stop capturing keystrokes.
I don't know, you can do pretty much whatever you want,
you can list accessible desktop and Windows stations, well, that's very nice.
System information,
this will list information on the current system, so not a bad idea.
Shell, we have already used shell, drop into the system command shell,
which means you get the CMD in Windows,
practically, a CMD prompt in Windows, although the tab does not work there.
I'm not sure if reboot would work, I think I've tried it before,
but it gave me some errors.
You will need to use shutdown space /r command in order to reboot the system.
ps will list the running processes.
And up here, where is it, so
I would suggest just taking a look at all of these commands.
The text for them is not that long, just go ahead and read through all of them,
if you can, go through all of them,
at least go through a few more than we will use in this tutorial.
Just to get an idea of what this thing can actually do.
Here, you can type in netstat and it displays network connections,
so you can see what they are doing on the net in real time.
Which is very nice.
As you can copy that, as you can pretty much copy those addresses on to your
machine and you can see which sites are they visiting or what they're doing there.
As opposed to having, as opposed to running a remote desktop,
which is highly inefficient.
Here you have some simple file system commands,
I'm pretty sure that some of them won't work, but most will.
And up here is the background, which we have started.
So, if you type in background, it backgrounds the current session.
Let's just go ahead and do that.
Please, I cannot stress how important
it is that you take a look at some of these commands.
They are very simple to understand.
You won't need to bash your head against the wall to figure out what they do.
You just take a look at them and type them in, so for example,
to background a session, you type in background.
It's the same principle.
I don't think that you actually need to use run, that was my bad here.
But just rather instead type in a command.
Before I type in background, I'm gonna type in getsystem.
And this is gonna fail.
I have a bad idea.
Yep, there we go.
Operation failed.
The environment is incorrect.
For shell command, you just type in shell.
And it puts you into a CMD, it gives you the command prompt.
And let's see, do we have any elevated privileges?
Even though the getsystem command did not work out to the best, but
there was still a better way to check this, just to know for sure.
Because these things tend to bug out.
I mean, this is a reverse shell, so don't expect perfection.
cd into Windows.
Tab doesn't work here.
See, if I press Tab, it just keeps on jumping.
System32.
And, nope, cd Windows/System32,
am I right now, okay, there we go.
Now we're gonna try to make a directory here, so mkdir test, does this work?
Uh-uh, nope.
mkdir test, Access is denied, I cannot make a directory here, so proof enough.
Anyway, we're gonna now background.
And tab does work here to finish your commands.
Backgrounding session 5, and you see it exits out of the Meterpreter.
It doesn't exit out of Meterpreter, but it puts into the background.
And in your foreground is your msfconsole.
Now, you can type in sessions dash help to get a list of help commands for sessions.
You can also type in session -l to get a list of running sessions.
You can have pretty much as many as you want here,
as many as your system can handle.
To get back into a session, type in -i and type in the number of the session, the ID,
press Enter, and there we go.
We are once again into the Meterpreter session number five.
You can again type in background and
put it in the background, remain where you are.
And the msfconsole from where you can do various things.
Now, I have decided to use this one, and you see,
I've described it here, ask for privileges.
Now, there are numerous ways that you can attain elevated
privileges on a remote system upon opening a Meterpreter shelf.
The best one in my personal experience is to simply ask the user for
the permissions.
If they don't give them to you the first time around, I don't know.
Wait a while and then ask them again.
And if that doesn't work, I don't know.
Wait a while, ask them again.
Eventually, they will click, more often than not, yes.
I don't know why, but such are the things in Windows.
You don't need a password.
You can just click Yes or No and
you have admin privileges, which is fascinating to me, to say the least.
Anyway, before I use that exploit,
I'm gonna type in use post, so
post exploitation, windows.
Yes, display all 149.
And anyway, you got here escalation, so
you can gather credentials, different types.
But, okay, so you can even have a keylogger here, but
you don't really need it.
If you have an Meterpreter session,
you can start it from the Meterpreter session immediately.
Rather, instead, I want escalate.
So, there's more if you just wanna take a look down there,
it's like 149 things there.
So use escalate.
Press tab.
Excellent.
So we got, like, drop link, getsystem,
golden_ticket, screen_unlock, kbdlayout.
Actually, I don't know what this one is.
Anyway, you can use getsystem as well.
That one is being used by your Meterpreter if I'm not mistaken, but
that doesn't always work.
That's why I said it's the best thing you can do.
I just wanted to show you some other ways of escalating privileges, so
you can pretty much use any one of these in pretty much the same way as I am going
to use this one.
There is little or no difference.
If you get stuck somewhere, feel free to ask.
So use exploit/windows/local.
And what do we got here?
Still too many.
ask.
Excellent, so now we have entered this exploit,
and for this exploit, you type in show options.
And I have configured this to session one,
as that is what is was previously, you only need to configure session one.
Payload options, that's already configured, so you see, it's using
Windows Meterpreter reverse_tcp, the one that we have used previously.
What you need to do is just change the session.
You won't immediately get this, I think.
You need to set the session.
This is from my previous session.
So just type in set session 5.
Excellent, so show options.
Excellent, so it's session five, and these things are loaded accordingly.
Yes, they are the same, but I was just doing some testing before this, and
just testing out will it actually work or not, and how it would actually work,
how it would look like, just to bring you guys quality content.
Anyway, now that we have this done,
you just type in exploit, and it's gonna transmit a signal.
[SOUND] There you go, not sure if you heard that.
If we open up our Windows machine, you see User Account Control.
So you're basically asking the user for the control.
If you want it, sure, type it, Yes or No.
But even people sometimes by mistake will click Yes, and
then they'll be too lazy to reverse it or anything of a kind.
That's just one of the ways, but there are others, as I have showed you.
You can use them in pretty much exactly the same way.
Now it says Meterpreter session 6 opened,
it has opened up a new session, and this Meterpreter has elevated privileges.
Let's see if that is true,
getsystem, what, get me help.
Yes, of course.
Exit.
Get.
Okay, got system via technique 1, it does actually work, no problems.
And now we can do shell, and see, can we actually make a file in Windows\System32?
Apparently, we should be able, so mkdir test.
Test has been created.
A subdirectory or file test already exists.
Okay, fine.
mkdir test1.
So it does actually manage to make it.
So if I type in del test.
Are you sure you want to?
Yes, I'm sure.
del test1.
Sure you want to do that?
Yes. So we can manipulate files in System32,
which means we have pretty much full control.
If we can place files and run them from there,
we are omnipotent, pretty much, on the system.
Anyway, let's go ahead and exit this,
clear the, not exit, but background.
Clear the screen.
Anyway, that was one of the processes which we could've used
to elevate privileges, but there are other ones that I've showed you, and
you can use them pretty much the same way as I have used this one.
You just pass the session ID and then just, if there are some other
parameters that are required, just type in show options like this.
show options.
And it tells you here, is something required or not?
So it says SESSION 5 is required, TECHNIQUE EXE.
And this should be configured by default, but you only need to have a session here.
So you can see what fields are required and not.
You basically just type in set and type in the name of whatever you wish to set.
That's it.
No problems there.
However, again, if you encounter problems doing some other stuff in Metasploit,
please do not hesitate to post it in the discussion section on Udemy,
and I'll be more than happy to attempt to assist you.
In any case, I bid you farewell until the next tutorial,
where we will actually do, where we will make a persistent shell,
so every time a machine resets, we will gain an open reverse shell over here.
Anyway, until then.