Welcome back everybody. Today, we're just gonna continue from where we left off. I
am going to do a couple of things with Metasploit, and those will include making
our reverse shells persistent on another system, and escalating privileges
in order to do that. Because, we do need an elevated set
of privileges to do certain things on a system elsewhere. Now I can just see the
question asked, I can just see the question in discussions, now can we
actually do a remote desktop? Yes, you can actually have a desktop of another
person being displayed on your own screen, but I strongly, I strongly
recommend against it. Okay, if you're doing this in LAN,
fine, it can pass. But, if you're doing this over the net, having a remote
desktop is a waste of bandwidth, and a complete waste of bandwidth. I do not
understand what it is exactly that you would like to see on their desktops. You
can take screenshots if you want to see certain things. If you need passwords you
can use keyloggers which are embedded into meterpreter. We just need to issue a
command to log keystrokes, I don't know, stuff of a kind. But, I really don't see
the point of a remote desktop. If they're browsing
something on the net, and if they were watching something on the net,
you can see the IP addresses of what
they were visiting on the net. And not the IP addresses but you can also see
the domains, and then you can just copy them into your own browser and have a
look at whatever you want to see, almost in real time. I know that would be a bit
of a drag, but, believe me, it saves up on bandwidth. And if you do a remote desktop
over the net, you are very likely to render the other person's web browsing
experience practically inoperable. They won't be able to browse the web. I mean
they will, but it will be very slow unless they have a really good
connection. And unless you have a really good connection, you won't be able to do
that. Try running TeamViewer and you will see that it's not the fastest of
applications out there. Not because of the way it was built, but because of the
amount of information that is passing in between two points. Anyway, you should
have pretty much the same setup as in the previous tutorial. You
should not have closed anything, I sincerely hope that you didn't. It
doesn't matter if you did, you can just repeat it. Here we're gonna go ahead and
open up our shell. So, just do the same things. It's still running, I believe, in
my Windows 8.1 machine, and let's see will it actually work out here. Or, hold
on...oh, I already have it running. So, it's working, and let me show you how is it
working. I'm gonna go over these commands with you, don't worry
about it. I just want to get into meterpreter now, excellent! So, we are now
in the meterpreter, let me just prove to you that I am, in fact, in a Windows
machine. So, cd...there you go. These are obviously Windows files. I see cygwin.
I even have that installed on my Windows machine, amazing! Doesn't
really matter. Anyway, now you can see that I am in my Windows machine. I've
just closed the meterpreter, I've actually placed my meterpreter shell
into background. And that is something that you can do, and that you will be
forced to do, during certain hacks. Primarily
because, you will want to do other things within that session. You will want to open
up a session, and then you will want to do different things to that session. You will
want to pass that session to different exploits so that they can use it as well,
and you obviously can't do that like this. So what you would do is put it in
the background, but before we do just go ahead and type in help. This is gonna
give you a list of commands. This is
a very nice command, getsystem. It attempts to elevate your privileges, but this
doesn't really always work. And here you have webcam commands. I mean, I can't
do this demonstration on a virtual machine, but you can,
this is only for physical machines, unless you have a USB
camera, or something of a kind. It's not really that hard. You just type
in run, and then one of these commands you will see later on. We will do
something, we will use some of the commands. Not for webcam, but we will use
some other commands. I do believe that it is just run, and then this, and the
rest will simply fall onto the system. The system will be able to do the rest.
Anyway, so you have these things. You can take screenshots, you can start capturing
keystrokes, stop capturing keystrokes. I don't know, you can do pretty much
whatever you want. You can list accessible desktop and Windows stations.
Well, that's very nice. System information, this will list information on the
current system. So not a bad idea. Shell, we have already used shell. Drop into the
system command shell, which means you get the CMD in Windows, practically a CMD
prompt in Windows. Although, the tab does not work there. I'm not sure if reboot
would work. I think I've tried it before but it gave me some errors. You
will need to use shutdown space /r command in order to reboot the system. Ps
will list the running processes. And up here, where is it, so I would suggest
just taking a look at all of these commands. The text for them is not that
long. Just go ahead and read through all of them. If you can't go through all of
them, at least go through a few more then we go, then we will use in this tutorial.
Just to get an idea of what this thing can actually do. Here you can type
in netstat and it displays network connection. So you can see
what they are doing on the net in real time, which is very nice. As you can copy
that, as you can pretty much copy those addresses onto your machine, and you can
see which sites are they visiting, or what they're doing there. As opposed to
to running a remote desktop, which is highly inefficient. Here
we have some simple file system commands. I'm pretty sure that some of them won't
work, but most will. And up here is the background which we have started. So, if
you type in background, it backgrounds the current session.
Let's just go ahead and do that. Please, I cannot stress how important it is that
you take a look at some of these commands. They are very simple to
understand. You won't need to like bash your head against the wall to figure out
what they do. You just take a look at them and type them in. So, for
example, to background an application, to background the session, you type in background.
It's the same principle, I don't think that you actually need to
use run, that was my bad here, but just rather instead type in a command. So if I
type in, before I type in background I'm gonna type in getsystem, and this is
gonna fail. I have a bad idea. Yup, there we go. Operation failed, the environment is
incorrect. For shell commands you just type in shell, and it puts you into the CMD,
it gives you the command prompt. And let's see, do we have
any elevated privileges? Even though that the get system command did not work out
to the best, to the best, but there is still a better way to check this. I mean,
just to know for sure, because these things tend to bug out. I
mean, this is a reverse shell, so don't expect perfection. CD into Windows, tab
doesn't work here. See, if I press tab it just keeps on jumping. System32, oops,
cd Windows/System32. Am I writing that correctly? Okay, there we go.
Now we're gonna try to make a directory here, so mkdir test. Does this work?
Ah, nope. mkdir test Access is denied. I cannot make a directory here, so proof
enough. Anyway, we're gonna now background, and tab does work here to finish
your commands. Backgrounding session 5, and you see it exits out of the
meterpreter. It doesn't exit out the meterpreter but it puts it into the
background, and in your foreground is your MSF console. Now you can type in
sessions -h to get a list of
of help commands for sessions, you can also type in session -l to get a list of
running sessions. You can have pretty much as many as you want here, as many as
your system can handle. To get back into a session type in -i and type in the
number of the session, the ID, press enter, and there we go. We are once again into
the meterpreter session number five. You can, again, type in background and put it
in the background, remain where you are in the msf console from where you can do
various things. Now, I have decided to use this one, and you see I have described it here,
ask for privileges. Now there are numerous ways that you can obtain
elevated privileges on a remote system, upon opening a meterpreter shell. The
best one, in my personal experience, is simply to ask the user for the
permissions. If they don't give them to you the first time around, I don't know,
wait awhile and then ask them again. And if that doesn't work, I don't know, wait
awhile, ask them again. Eventually, they will click, more often than not. Yes, I
don't know why, but such are the things in Windows. You don't need a password, you
can just click yes or no and you have admin privileges, which is fascinating to
me to say the least. Anyway, before I use that exploit I'm
gonna type in use post, so post exploitation, windows.
Yes, display all 149. And, anyway, you got here escalation. So, you can
gather credentials, different types, but, okay, so you can even have a
keylogger here. But you don't really need it if you have a meterpreter session, you
can start it from the meterpreter session immediately, rather instead I
want escalate. So, there is more if you want to just take a look down there, like
149 things there. So use escalate, press tab, excellent! So we got droplink,
getsystem, golden_ticket, screen_unlock, kbdlayout, actually, I don't know what this
one is. Anyway, you can use getsystem as well, that one is being used by your
meterpreter if I'm not mistaken, but that doesn't always work. That's why I said,
it's the best thing you can do. I just wanted to show you some other ways of
escalating privileges, so you can use pretty much any one of these in the same,
in pretty much the same way as I am going to use this one. There is little or
no difference. If you get stuck somewhere, feel free to ask. So, use exploit/windows/
local/, and what do we got here? Still too many. Ask, excellent!
So now we have entered this exploit, and for this exploit you type in show
options, and I have configured this. The session 1 is what it was
previously. You only need to configure session 1. Payload options, that's
already configured. So you see it's using windows/meterpreter/reverse_tcp, the one
that we have used previously. What you need to do is just change the session.
You won't immediately get this, I think you need to set the session, this is from
my previous session. So just type in set session 5, excellent! So show
options, excellent! So it's session five, and these
things are loaded accordingly. Yes, they are the same, but I was just doing some
of the tests I'm testing before this, and just testing out will it actually work
or not, and how it would actually work, how it would look like. Just to bring you
guys for the content. Anyway, now that we have this done, you just type in exploit
and it's gonna transmit a signal. There you go, not sure if you heard that. If we
open up our Windows machine you see it says user
account control, so you're basically asking the user for the control. If you
want, sure, type in yes or no. But, even people sometimes by mistake will click
yes, and then they'll be too lazy to reverse it, or anything of a kind. That's
just one of the ways, but there are others as I have showed you. You can use
them in pretty much exactly the same way. Now it says meterpreter session 6
open, it has opened up a new session, and this meterpreter has elevated
privileges. Let's see if that is true, getsystem, what? Get me help. Yes, of course.
Exit, getsystem, OK, got system via technique one. It does actually work, no problems. And
now we can do shell and see if we can actually make a file in windows system32.
Apparently, we should be able to. So mkdir test, test has been created, a
subdirectory or file test already exists. OK, fine. mkdir
test1, so it does actually manage to make it. So if I type in del test, are you
sure you want to? Yes, I'm sure. del test1, are sure you want to do that? Yes, so
we can manipulate files in system32, which means we have pretty much full
control. If we can place files and run them from there we are
omnipotent, pretty much, on the system. Anyway, let's go ahead and exit this,
not exit but background, clear the screen. Anyway, that was a
process, one of the processes which you could have used to elevate privileges,
but there are other ones that I've showed you, and you can use them in pretty much
the same way as I have used this one. You just pass the session ID, and then
if there are some other parameters that are required just type in show
options like this, show options, and it tells you here if something is required or not.
So, it says session 5 is required, technique exe. This is gonna be, this should be
configured by default, but you only need to have a session here. So
you can see what fields are required, or not, you basically just type in set,
and type in the name of whatever you wish to set. That's it, no
problems there. However, again, if you encounter problems doing some other
stuff in Metasploit, please do not hesitate to post it in the discussion
section on Udemy and I'll be more than happy to attempt to assist you. In any
case, I bid you farewell, until the next tutorial where we will
actually do, where we will make the persistent shell. So, every time a machine
resets we will gain an open reverse shell over here. Anyway, until then.