Kali 5

GETPID & PS COMMANDS – As you use Meterpreter, two of the commands that you will use
somewhat frequently are getpid and ps.
● Getpid – tells you what process ID your shell is running on

● Ps – lists all processes running on the remote system
So if I type, “getpid” I see this:
This is the process ID number that our shell is using. If I type “ps” I can see all the processes:
If we go further down the list, looking for our pid number of 3824 we see this:
3824 3796 powershell.exe x86 1 WIN-LOANLOTDQLU\Fred
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
This shows our process ID of 3824. It also shows that we are running under a powershell.exe process
as the user “Fred”.
This information comes in handy when we want to “migrate” out of this low level process and into a
process with a higher level access. We can move our shell off of this PID to a process that has higher
level access.
Migrating also allows us to merge and hide our shell into another more common process, in essence
hiding our connection. Explorer.exe is one of the more common processes to migrate to.
Simply find the PID# of the process you want to use (1736 on our system) and type, “migrate
<PID#>”
We will talk about migrating and some of the other Meterpreter commands more in later sections. For
now let’s talk about screenshots and using the remote webcam!
Capturing Webcam Video, Screenshots and Sound

When I was listening to the news a while back I remember them going on and on about a brand new
“advanced persistent threat” that could actually allow attackers to turn on your webcam and even
record sound. I thought this was completely ridiculous as you have been able to do this with
Metasploit for years.
WEBCAM VIDEO
From the Metasploit shell, typing “run webcam -h” displays the help menu.
Then just type “run webcam” and add any options that you want. This will remotely display the
webcam from the target system.
If you use the “-l” option it will continuously grab webcam snaps until you hit “CNTRL-C”.
The only hint you get on the target machine that something is wrong is that your webcam recording
light (if yours has one) comes on. Other than that, you cannot tell that someone is remotely viewing
your webcam.
The webcam screenshot above is an actual image I got one day of my cat. Not sure why cats must
sleep on laptop keyboards, but I do know now who has been ordering all that Tuna fish online…
SCREENSHOTS
You can grab a snapshot of whatever is currently being displayed on your target’s monitor using the
“screenshot” command:
If we open the file we see this:
Well, along with getting his system infected with a backdoor exploit, it seems that our star employee
also spends his valuable time at work playing video games online.
Nice…
SOUND RECORDING
Recording sound is very similar, just type, “run sound_recorder -h” for options, or if you want to
grab a 30 second sound clip, run the command without any options:
You can then open the saved file on your Kali system to listen to it:
Running Scripts
The last topic we will cover in this section is running scripts. Meterpreter has over 200 scripts that
you can run to further expand your exploitation toolset.
We actually have already touched on these. We used the “ run” command to use the sound and
webcam script attacks. We will take a moment and cover a couple more of them.
To see a list of all the available scripts just type “Run <tab><tab>”:
Then just type, “run” with the script name that you want to try.
Here are a couple of the more interesting ones:
CHECKVM:
Sometimes when you get a remote shell you are not sure if you are in a Virtual Machine or a
standalone computer. You can check with this command.
As you can see it correctly determined that our target was a VMware VM.
GETGUI:
Getgui is a neat little script that will allow you to enable remote desktop on a Windows machine (if it
isn’t already enabled) and create a remote desktop user.
The user is added to both the remote desktop user group and the administrators group. This makes it
handy if you want to connect back to the machine at a later date.
First type, “run getgui -e” to enable remote desktop:
Then just run the program again and give it a username and password to use:
Now we just need to open a terminal and run the “rdesktop” command that comes with Kali to
connect to the Windows Remote Desktop:
The “-p -” switch tells rdesktop to prompts you to enter a password. This is a bit more secure as you
are not sending clear text passwords over the wire.
Once we login we will get a graphical Windows desktop on our Kali machine:
There are additional scripts to try to turn off Anti-Virus, disable the target’s firewall, grab artifacts
and credentials from multiple programs like Firefox, ftp programs, etc., plus many more.
Take some time and check them out.
Remote Shell
Lastly, let’s see how to get an actual C:\ prompt. This is extremely easy once we have a Meterpreter
session. Just type the command, “shell”.
That’s it! We can now run any DOS command that we want.
Playing with Modules - Recovering Deleted Files from Remote System

Now let’s take a second and talk about something a little more advanced. Let’s see how to use one of
the included Meterpreter modules to recover files that have been deleted from a remote drive.
The “recovery_files” script allows you to recover files that the target user has deleted from his
system. This could be very handy, as deleted files could contain information of interest for both the
forensics and pentesting realm.
System files and logs, account information, and important documents are just a small sample of what
could be recovered.
To prep for this example, I simply took my Windows 7 system and created a fake “Accounts
Passwords.txt” file and saved a copy of nmap’s “Discovery.pdf” manual on the E: drive.
I then deleted the files:
Using the Module

The module requires that you have an open session to the target that you want to check. Once you get a
successful remote session, simply type, “background” to temporarily back out of the session back to
the msf prompt and use the module as shown below:
As you can see in the screenshot above, there are a couple settings that need to be set.
If you just want to see what files are there, you only need to set the “Drive” and “Session” settings as
shown above.
Then just run the exploit:
The exploit ran and found four files that it could recover, the two that we deleted and two other ones.
Now, say we only wanted to recover the txt files. Simply type, “set FILES txt” and run the exploit
again:
It recovered the text files and stored them in the /root/.msf4/loot directory. If we surf to that directory
we can find and open the text files that were saved:
And view the file:

And there we go, looks like there are 3 user accounts, including passwords, which we were able to
recover from the remote machine!
But what if we wanted to recover pdf files?
Again, simply “set FILES pdf” and run the exploit again:
As last time the recovered files were stored in the loot directory. We can open the PDF to verify that
it worked:
You can also set the module to recover multiple file types at once by simply listing what you want in
the FILES variable and separate them with a comma.
Lastly, the files can also be recovered by the ID number (not shown).
Recovery File Module Wrap-Up

The module seems to work really well on data drives, but not so well on drives where there are a lot
of files to recover, like on the main drive of a single drive system.
I ran this on a Windows 7 boot drive on a VM that I have used a lot and it literally took hours to run.
Granted it probably found about a thousand files, but I just can’t see how feasible this would be in
real life as it would create an enormous amount of suspicious network traffic.
Here is a network packet capture of the module running against a drive with a lot of deleted files:
But then again, how many people actually record and analyze their data traffic?
The module does function extremely well though on smaller drives that don’t have an enormous
amount of deleted files. It was lightning fast and worked very well.
Conclusion
In this chapter we learned a lot about Metasploit’s Meterpreter shell. Though we covered some of the
basics of getting around and using the shell, we only touched on a fraction of its capabilities.
Hopefully you can see why getting a Meterpreter shell gives you a whole lot more functionality than
just getting a straight remote access shell.
Grabbing video and sound may seem to be a bit theatrical, but social engineers could use information
they glean. For instance from video they could grab images of people’s badges, and have a glimpse
into the target’s physical environment.
Sound is interesting too. A social engineer could learn a lot about the target facility by being able to
have a live microphone inside the building. And not too long ago “Sinn3r” from the Metasploit
development team showed how you could grab recorded audio and search it using AT&T’s Watson
speech program and Metasploit to look for keywords like “password” or “social security number”.
(See “Resources” above for link to article)

Kali 5

Uploaded by

Copyright:

Available Formats

Kali 5

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Kali 5

Uploaded by

Copyright:

Available Formats

GETPID & PS COMMANDS – As you use Meterpreter, two of the commands that you will use

somewhat frequently are getpid and ps.

● Getpid – tells you what process ID your shell is running on

Capturing Webcam Video, Screenshots and Sound

If we open the file we see this:

Playing with Modules - Recovering Deleted Files from Remote System

Using the Module

And view the file:

Recovery File Module Wrap-Up

You might also like