CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!
Path: blob/master/documentation/modules/payload/windows/meterpreter/reverse_tcp.md
Views: 1904
windows/meterpreter/reverse_tcp is one of the most powerful features the Metasploit Framework has to offer, and there are so many things you can do with it.
It allows you to remotely control the file system, sniff, keylog, hashdump, perform network pivoting, control the webcam and microphone, etc. It has the best support for post modules, and you can load extensions, such as mimikatz and python interpreter, etc.
windows/meterpreter/reverse_tcp is also the default payload for all Windows exploit targets.
Vulnerable Application
This Meterpreter payload is suitable for the following environments:
Windows x64
Windows x86
Verification Steps
windows/meterpreter/reverse_tcp is typically used in two different ways.
First, it is typically used as a payload for an exploit. Here's how to do that:
In msfconsole, select an exploit module
Configure the options for that exploit.
Do:
set payload windows/meterpreter/reverse_tcpSet the
LHOSToption, which is the IP that the payload should connect to.Do:
exploit. If the exploit is successful, it should execute that payload.
Another way to use windows/meterpreter/reverse_tcp is to generate it as an executable. Normally, you would want to do it with msfvenom. If you are old school, you have probably also heard of msfpayload and msfencode. msfvenom is a replacement of those.
The following is a basic example of using msfvenom to generate windows/meterpreter/reverse_tcp as an executable:
Important Basic Commands
pwd command
The pwd command allows you to see the current directory you're in on the remote target. Example:
cd command
The cd command allows you to change directories. Example:
cat command
The cat command allows you to see the content of a file:
upload command
The upload command allows you to upload a file to the remote target. For example:
The -r option for the command also allows you to upload recursively.
download command
The download command allows you download a file from the remote target to your machine. For example:
The -r option for the command also allows you to download recursively.
search command
The search command allows you to find files on the remote file system. For example, this demonstrates how to find all text files in the current directory:
Note that without the -d option, the command will attempt to search in all drives.
The -r option for the commands allows you to search recursively.
ifconfig command
The ifconfig command displays the network interfaces on the remote machine:
The command ipconfig is an alias for ifconfig.
getuid command
The getuid command shows you the current user that the payload is running as:
execute command
The execute command allows you to execute a command or file on the remote machine.
The following example will spawn a calculator:
To pass an argument, use the -a flag:
There are some options you can see to add more stealth. For example, you can use the -H flag to create the process hidden from view. You can also use the -m flag to execute from memory.
ps command
The ps command lists the running processes on the remote machine.
shell command
The shell command allows you to interact with the remote machine's command prompt. Example:
To switch back to Meterpreter, do [CTRL]+[Z] to background the channel.
sysinfo command
The sysinfo command shows you basic information about the remote machine. Example:
keyscan_start
The keyscan_start command starts the keylogging feature on the remote machine.
keyscan_dump
The keyscan_dump command is a keylogger feature. You must use the keyscan_start command before using this. Example:
If you wish to stop sniffing, use the keyscan_stop command.
keyscan_stop
The keyscan_stop command stops the keylogger.
screenshot
The screenshot command takes a screenshot of the target machine.
webcam_list
The webcam_list commands shows you a list of webcams that you can control. You'll probably want to use this first before using any other webcam commands.
webcam_snap
The webcam_snap commands uses the selected webcam to take a picture.
webcam_stream
The webcam_stream command basically uses the webcam_snap command repeatedly to create the streaming effect. There is no sound.
record_mic
The record_mic command captures audio on the remote machine.
getsystem
The getsystem command attempts to elevate your privilege on the remote machine with one of these techniques:
Named pipe impersonation (in memory)
Named pipe impersonation (dropper)
Token duplication (in memory)
Example:
hashdump
The hashdump commands allows you to dump the Windows hashes if there are the right privileges. For example:
Scenarios
Setting up for Testing
For testing purposes, if you don't want to manually generate a payload and start a multi handler repeatedly, you can use the auto_win32_multihandler.rc resource script in Metasploit to automate that process. Here's how you would use it:
First, run the resource script:
Next, go to your ~/.msf4/local directory, you should see meterpreter_reverse_tcp.exe in there. Upload that payload to your test box and execute it. You should receive a connection.
Using a Post Module
One of the best things about Meterpreter is you have access to a variety of post exploitation modules, specifically for the multi and Windows categories. Post modules provide you with more capabilities to collect data from the remote machine automatically. For example, you can steal passwords from popular applications and enumerate or modify system settings.
To use a post module from the Meterpreter prompt, simply use the run command:
It is also possible to run a post module via multiple Meterpreter sessions. To learn how, load the specific post module you wish to run, and enter info -d to see the basic usage in the documentation.
Using the extapi Extension
The main purpose of the extapi extension is to perform advanced enumeration of the target machine. For example, you can enumerate things like registered services, open windows, clipboard, ADSI, WMI queries, etc.
To begin, at the Meterpreter prompt, do:
One great feature of the extension is clipboard management. The Windows clipboard is interesting because it can store anything that is sensitive, such as files, user names, and passwords, but it is not well protected.
For example, a password manager is a popular tool to store encrypted passwords. It allows the user to create complex passwords without the need to memorize any of them. All the user needs to do is open the password manager, retrieve the password for a particular account by copying it, and then paste it on a login page.
There is a security problem to the above process. When the user copies the password, it is stored in the operating system's clipboard. As an attacker, you can take advantage of this by starting the clipboard monitor from Meterpreter/extapi, and then collect whatever the user copies.
To read whatever is currently stored in the target's clipboard, you can use the clipboard_get_data command:
The limitation of this command is that since you're only grabbing whatever is in the clipboard at the time, there is only one item to collect. However, when you start a monitor, you can collect whatever goes in there. To start, issue the following command:
While it is monitoring, you can ask Meterpreter to dump whatever's been captured.
The clipboard_monitor_stop command will also dump the captured data, and then exit.
Combined with Meterpreter's keylogger, you have a very effective setup to capture the user's inputs.
Using the Python Extension
The Python extension allows you to use the remote machine's Python interpreter.
To load the extension, at the Meterpreter prompt, do:
The most basic example of using the interpreter is the python_execute command:
Another way to execute Python code is from a local file by using the python_import command.
To do this, first prepare for a Python script. This example should create a message.txt on the remote machine's desktop:
And to run that with the command:
To learn more about the Python extension, please read this wiki.
Network Pivoting
There are three mains ways that you can use for moving around inside a network:
The route command in the msf prompt
The route command in the Meterpreter prompt
The portfwd command
Routing through msfconsole
The route command from the msf prompt allows you connect to hosts on a different network through the compromised machine. You should be able to determine that by looking at the compromised machine's ipconfig:
The example above shows that we have a Meterpreter connection to 192.168.1.201. Let's call this box A, and it is connected to the 192.100.0.0/24 VPN network. As an attacker, we aren't connected to this network directly, but we can explore that network through box A.
At the msf prompt, do:
The 1 at the end of the route indicates the session ID, the payload that is used as a gateway to talk to other machines.
So right now, we have a connection established to the VPN, and we should be able to connect to another machine from that network:
Another neat trick using route is that you can also bypass the compromised host's firewall this way. For example, if the host has HTTP open, but SMB is blocked by the firewall, you can try to compromise it via HTTP first. You'll need to use the route command to talk to SMB and then try to exploit SMB.
Routing through Meterpreter
The route command in Meterpreter allows you change the routing table that is on the target machine. The way it needs to be configured is similar to the route command in msfconsole.
Routing through the portfwd command
The portfwd command allows you to talk to a remote service like it's local. For example, if you are able to compromise a host via SMB, but are not able to connect to the remote desktop service, then you can do:
And that should allow you to connect to remote desktop this way on the attacker's box:
Meterpreter Paranoid Mode
The paranoid mode forces the handler to be strict about which Meterpreter should be connecting to it, hence the name "paranoid mode".
To learn more about this feature, please click here.
Meterpreter Reliable Network Communication
Exiting Metasploit using exit -y no longer terminates the payload session like it used to. Instead, it will continue to run behind the scenes, attempting to connect back to Metasploit when an appropriate handler is available. If you wish to exit the session, make sure to sessions -K first.
To learn more about this feature, please click here.
Meterpreter Sleep Control
The sleep mode allows the payload on the target machine to be quiet for awhile, mainly in order to avoid suspicious active communication. It also provides better efficiency.
It is very simple to use. At the Meterpreter prompt, simply do:
And that will allow Meterpreter to sleep 20 seconds, and will reconnect as long as the payload handler remains active (such as being a background job).
To learn more about this feature, please click here.
Meterpreter Stageless Mode
A stageless Meterpreter allows a more economical way to deliver the payload, for cases where a normal one would actually cost too much time and bandwidth in a penetration test. To learn more about this, click on this to read more.
To use the stageless payload, use windows/meterpreter_reverse_tcp instead.
Meterpreter Timeout Control
The timeout control basically defines the life span of Meterpreter. To configure it, use the set_timeouts command:
To see the current timeout configuration, you can use the get_timeouts command:
To learn more about timeout control, please go here.
Meterpreter Transport Control
Transport Control allows you manage transports on the fly while the payload session is still running. Meterpreter can automatically cycle through the transports when communication fails, or you can do it manually.
To learn more about this, please read this documentation.
Using the Post Exploitation API in IRB
To enter IRB, do the following at the Meterpreter prompt:
The client object
The client object in Meterpreter's IRB allows you control or retrieve information about the host. For example, this demonstrates how to obtain the current privilege we're running the payload as:
To explore the client object, there are a few tricks. For example, you can use the #inspect method to inspect it:
You can use the #methods method to see what methods you can use:
To find the source of the method, you can use the #source_location method. For example, say I want to find the source code for the #getuid method:
The first element of the array is the location of the file. The second element is the line number of the method.
Using Railgun
Railgun allows you to use the remote machine's Windows API in Ruby. For example, to create a MessageBox on the target machine, do:
To learn more about using Railgun, please read this wiki.