1. Tactical Meterpreter Scripting Carlos PerezDarkoperatorCarlos_perez[at]darkoperator.com DarkoperatorCarlos_perez[at]darkoperator.com

2. Who am I Member of Pauldotcom http://pauldotcom.com Member of Metasploit Project Owner of web site “Shell is Only the Beginning” at http://www.darkoperator.com Solution Architect by day to pay the bills Member of Pauldotcom http://pauldotcom.com Member of Metasploit Project Owner of web site “Shell is Only the Beginning” at http://www.darkoperator.com Solution Architect by day to pay the bills

3. What we will Cover Pointer for automating post exploitation. Making sure we run the right task on the right target with the right permissions Going beyond the standard Meterpreter API. Pointer for automating post exploitation. Making sure we run the right task on the right target with the right permissions Going beyond the standard Meterpreter API.

4. Advantages Stealthy – No disk access and no new process – Limited forensic evidence and impact – User Reflective DLL Injection – Uses Windows Native API Powerful – Channelized communication system – Encrypted channel with SSL – TLV protocol has few limitations Extensible – Runtime feature augmentation – New features without rebuilding Stealthy – No disk access and no new process – Limited forensic evidence and impact – User Reflective DLL Injection – Uses Windows Native API Powerful – Channelized communication system – Encrypted channel with SSL – TLV protocol has few limitations Extensible – Runtime feature augmentation – New features without rebuilding

5. Built-In Extensions Stdapi – Provides “unix-like” tools for the Windows platform – Manipulate file system, registry, network, processes, upload/Download files... – Automatically loaded when Meterpreter starts Priv – Provides in-memory pwdump alternative – Includes timestomp for anti-forensics work Incognito – Utilities for finding and hijacking security tokens Stdapi – Provides “unix-like” tools for the Windows platform – Manipulate file system, registry, network, processes, upload/Download files... – Automatically loaded when Meterpreter starts Priv – Provides in-memory pwdump alternative – Includes timestomp for anti-forensics work Incognito – Utilities for finding and hijacking security tokens

6. Scripting Meterpreter takes advantage of most of the Metasploit Framework API Not limited available API alone – Use of Windows Command Line Tools – Upload of Necessary Tools – Use of Windows own scripting capabilities Scripts can be run upon session creation Meterpreter takes advantage of most of the Metasploit Framework API Not limited available API alone – Use of Windows Command Line Tools – Upload of Necessary Tools – Use of Windows own scripting capabilities Scripts can be run upon session creation

7. Think Tactically Not all versions of Windows are the same in shell System is not the same as Local User or Domain User Use Environment Variables Use Random Names for any files created on target host Check for countermeasures Cleanup after your self Use Functions so as to keep code reusable Manage Exceptions Not all versions of Windows are the same in shell System is not the same as Local User or Domain User Use Environment Variables Use Random Names for any files created on target host Check for countermeasures Cleanup after your self Use Functions so as to keep code reusable Manage Exceptions

8. Versions of Windows Availability of commands Different Countermeasures Features installed Location of Files Different switches of commands Use client.sys.config.sysinfo[‘OS’] for OS version Availability of commands Different Countermeasures Features installed Location of Files Different switches of commands Use client.sys.config.sysinfo[‘OS’] for OS version

9. Level of Access Newer versions of Windows limits access to Administrator Administrator != System – Incognito (Vista, Windows 7 and Win2k8) – Hashdump (Vista, Win7 and Win2k8) Domain access is some times is better than System Newer versions of Windows limits access to Administrator Administrator != System – Incognito (Vista, Windows 7 and Win2k8) – Hashdump (Vista, Win7 and Win2k8) Domain access is some times is better than System

10. Checking for Right Permission and OS We execute according to target and privilege

11. Use Environment Variables Useful for enumeration Counter security thru obscurity Find best location to store files Use client.fs.file.expand_path(“varname”) to expand an environment variable Use variable with cmd /c when executing commands Useful for enumeration Counter security thru obscurity Find best location to store files Use client.fs.file.expand_path(“varname”) to expand an environment variable Use variable with cmd /c when executing commands

12. When uploading or creating files use random names for files. – Prevents overwriting by several instances of a script running – Offensive by obscurity Use the ruby rand function for creating random numbers for file names When uploading or creating files use random names for files. – Prevents overwriting by several instances of a script running – Offensive by obscurity Use the ruby rand function for creating random numbers for file names Do not use Static Naming

13. Execution of WMIC

14. Check for Countermeasures We make sure we get a unique and useful name Check for presence of AV/HIPS/Firewalls If setting a listener check for Windows Firewall Mode Check for UAC Check Policy Settings * Check checkcountermeasures script Check for presence of AV/HIPS/Firewalls If setting a listener check for Windows Firewall Mode Check for UAC Check Policy Settings * Check checkcountermeasures script

15. Check for UAC

16. Clean Up Reusable Code Delete any Uploaded File Clear the Eventlog log = client.sys. eventlog.open('security') log. clear Change MACE on Files – Copy MACE of Another File – Clear MACE of file or directory Kill any processes not needed Delete any Uploaded File Clear the Eventlog log = client.sys. eventlog.open('security') log. clear Change MACE on Files – Copy MACE of Another File – Clear MACE of file or directory Kill any processes not needed

17. Clear Event Logs

18. Change MACE

19. Some Final Recommendations Build a good lab for testing with different scenarios Test in as many versions of Windows as Possible Make sure your code is compatible with Ruby 1.9 for future compatibility Build a good lab for testing with different scenarios Test in as many versions of Windows as Possible Make sure your code is compatible with Ruby 1.9 for future compatibility

20. Reference Metasploit Documentations - http://metasploit.com/framework/suppor t/ http://metasploit.com/framework/suppor t/ My Script Collection - http://www.darkoperator.com/meterpret er/ http://www.darkoperator.com/meterpret er/ Meterpreter Section of Mastering Metasploit Class - https://metasploit.com/metasploit_bh200 9.pdf https://metasploit.com/metasploit_bh200 9.pdf My blog in http://www.darkoperator.comhttp://www.darkoperator.com Metasploit Documentations - http://metasploit.com/framework/suppor t/ http://metasploit.com/framework/suppor t/ My Script Collection - http://www.darkoperator.com/meterpret er/ http://www.darkoperator.com/meterpret er/ Meterpreter Section of Mastering Metasploit Class - https://metasploit.com/metasploit_bh200 9.pdf https://metasploit.com/metasploit_bh200 9.pdf My blog in http://www.darkoperator.comhttp://www.darkoperator.com

21. Special Thanks To – HD Moore – Pauldotcom Crew Paul Larry John Mick – HD Moore – Pauldotcom Crew Paul Larry John Mick

22. QUESTIONS?