Tactical Meterpreter Scripting Carlos PerezDarkoperatorCarlos_perez[at]darkoperator.com DarkoperatorCarlos_perez[at]darkoperator.com

Who am I Member of Pauldotcom Member of Metasploit Project Owner of web site “Shell is Only the Beginning” at Solution Architect by day to pay the bills Member of Pauldotcom Member of Metasploit Project Owner of web site “Shell is Only the Beginning” at Solution Architect by day to pay the bills

What we will Cover Pointer for automating post exploitation. Making sure we run the right task on the right target with the right permissions Going beyond the standard Meterpreter API. Pointer for automating post exploitation. Making sure we run the right task on the right target with the right permissions Going beyond the standard Meterpreter API.

Advantages Stealthy – No disk access and no new process – Limited forensic evidence and impact – User Reflective DLL Injection – Uses Windows Native API Powerful – Channelized communication system – Encrypted channel with SSL – TLV protocol has few limitations Extensible – Runtime feature augmentation – New features without rebuilding Stealthy – No disk access and no new process – Limited forensic evidence and impact – User Reflective DLL Injection – Uses Windows Native API Powerful – Channelized communication system – Encrypted channel with SSL – TLV protocol has few limitations Extensible – Runtime feature augmentation – New features without rebuilding

Built-In Extensions Stdapi – Provides “unix-like” tools for the Windows platform – Manipulate file system, registry, network, processes, upload/Download files... – Automatically loaded when Meterpreter starts Priv – Provides in-memory pwdump alternative – Includes timestomp for anti-forensics work Incognito – Utilities for finding and hijacking security tokens Stdapi – Provides “unix-like” tools for the Windows platform – Manipulate file system, registry, network, processes, upload/Download files... – Automatically loaded when Meterpreter starts Priv – Provides in-memory pwdump alternative – Includes timestomp for anti-forensics work Incognito – Utilities for finding and hijacking security tokens

Scripting Meterpreter takes advantage of most of the Metasploit Framework API Not limited available API alone – Use of Windows Command Line Tools – Upload of Necessary Tools – Use of Windows own scripting capabilities Scripts can be run upon session creation Meterpreter takes advantage of most of the Metasploit Framework API Not limited available API alone – Use of Windows Command Line Tools – Upload of Necessary Tools – Use of Windows own scripting capabilities Scripts can be run upon session creation

Think Tactically Not all versions of Windows are the same in shell System is not the same as Local User or Domain User Use Environment Variables Use Random Names for any files created on target host Check for countermeasures Cleanup after your self Use Functions so as to keep code reusable Manage Exceptions Not all versions of Windows are the same in shell System is not the same as Local User or Domain User Use Environment Variables Use Random Names for any files created on target host Check for countermeasures Cleanup after your self Use Functions so as to keep code reusable Manage Exceptions

Versions of Windows Availability of commands Different Countermeasures Features installed Location of Files Different switches of commands Use client.sys.config.sysinfo[‘OS’] for OS version Availability of commands Different Countermeasures Features installed Location of Files Different switches of commands Use client.sys.config.sysinfo[‘OS’] for OS version

Level of Access Newer versions of Windows limits access to Administrator Administrator != System – Incognito (Vista, Windows 7 and Win2k8) – Hashdump (Vista, Win7 and Win2k8) Domain access is some times is better than System Newer versions of Windows limits access to Administrator Administrator != System – Incognito (Vista, Windows 7 and Win2k8) – Hashdump (Vista, Win7 and Win2k8) Domain access is some times is better than System

Checking for Right Permission and OS We execute according to target and privilege

Use Environment Variables Useful for enumeration Counter security thru obscurity Find best location to store files Use client.fs.file.expand_path(“varname”) to expand an environment variable Use variable with cmd /c when executing commands Useful for enumeration Counter security thru obscurity Find best location to store files Use client.fs.file.expand_path(“varname”) to expand an environment variable Use variable with cmd /c when executing commands

When uploading or creating files use random names for files. – Prevents overwriting by several instances of a script running – Offensive by obscurity Use the ruby rand function for creating random numbers for file names When uploading or creating files use random names for files. – Prevents overwriting by several instances of a script running – Offensive by obscurity Use the ruby rand function for creating random numbers for file names Do not use Static Naming

Execution of WMIC

Check for Countermeasures We make sure we get a unique and useful name Check for presence of AV/HIPS/Firewalls If setting a listener check for Windows Firewall Mode Check for UAC Check Policy Settings * Check checkcountermeasures script Check for presence of AV/HIPS/Firewalls If setting a listener check for Windows Firewall Mode Check for UAC Check Policy Settings * Check checkcountermeasures script

Check for UAC

Clean Up Reusable Code Delete any Uploaded File Clear the Eventlog log = client.sys. eventlog.open('security') log. clear Change MACE on Files – Copy MACE of Another File – Clear MACE of file or directory Kill any processes not needed Delete any Uploaded File Clear the Eventlog log = client.sys. eventlog.open('security') log. clear Change MACE on Files – Copy MACE of Another File – Clear MACE of file or directory Kill any processes not needed

Clear Event Logs

Change MACE

Some Final Recommendations Build a good lab for testing with different scenarios Test in as many versions of Windows as Possible Make sure your code is compatible with Ruby 1.9 for future compatibility Build a good lab for testing with different scenarios Test in as many versions of Windows as Possible Make sure your code is compatible with Ruby 1.9 for future compatibility

Reference Metasploit Documentations - t/ t/ My Script Collection - er/ er/ Meterpreter Section of Mastering Metasploit Class pdf 9.pdf My blog in Metasploit Documentations - t/ t/ My Script Collection - er/ er/ Meterpreter Section of Mastering Metasploit Class pdf 9.pdf My blog in

Special Thanks To – HD Moore – Pauldotcom Crew Paul Larry John Mick – HD Moore – Pauldotcom Crew Paul Larry John Mick

QUESTIONS?