The Complete Meterpreter Guide | Privilege Escalation & Clearing Tracks Video Lecture | Get to know Ethical Hacking (English) - Software Development

he's like hey guys Jacques Floyd here
back again with another video and in
this video I'm gonna be showing you how
to fully utilize an interpreter or a
meterpreter session for post
exploitation privilege escalation and
finally clearing up your tracks all
right so I've mentioned previously in
the community section of the channel the
reason why at the year 7 video is not
yet out and the reason for the lack of
uploads over the last Papa over the past
two days and that is because I was
actually feeling a bit sick and I'm
feeling much better now but if my voice
is a bit low during the video I
apologize and yeah that's what I wanted
to pass on that being said let's get
started now I'm going to assume that you
already have an interpreter session most
you know it depends on what exploitive
perform but for me I'm just gonna be
using the most recent one which was the
double pulse exploit and for those of
you asking why I made the video so late
I didn't make I didn't even plan on
making the video someone suggested to me
to make the video as I said I follow
them
I usually put all the videos in an Excel
spreadsheet and I follow them as and
when they were posted so if you have
posted a video suggestion it will come
or I will usually put it in an excel
sheet and it will come independent or in
in relation to to to when you posted it
in terms of date alright so I'm
currently going through all of them and
I'm making videos as you can see of all
of the topics you guys requested that
being said let's actually get started so
in the previous video I really didn't do
justice when we exploit exploiting the
eternal blue double pulsar ideally
didn't do any justice as to what you
should do after you've gained access to
the system that's because that video
focused more on the exploitation side
that being said I have the windows 7
virtual machine currently running and as
you can see we have a matter per session
so we're not going to be focusing on how
to get how to exploit it because we've
already looked at that but as you can
see I have a few files that have just
created on the desktop here that I'll
use to illustrate how one can download
files from from the target operating
system onto your operating system how to
Clio tracks how to perform privilege
escalation how to launch different exe
programs how to edit files all that good
stuff right so let's start off first
with with the basics as you would know
you have the meterpreter session let's
start off with the help command alright
so the help command is extremely useful
as I've said many many times before
alright and you can already see that
it's going to give you a list of all the
commands that you can use and they are
sorted out in terms of Co commands you
then have your file system commands
networking commands system commands user
interface commands very important webcam
commands also really important you then
have elevate commands which will as you
can see it's get system and that will
elevate your privileges to that of the
local system meaning you'll get
administrator access I was about to say
root access but in with Windows it's
slightly different alright you can then
get the password database commands very
important you can perform a hash dump
that will dump the contents of the some
database which you can then use to
decrypt and get the password for the
user or the or any user on the computer
alright you then have the timestamp
commands a timestamp comments which are
really not important but we'll be
looking at some of the the core and the
most important ones in my opinion as to
what people will be linked so you can
see and we start off with the ko
commands you have your background
processes of the current session you can
kill a background material script
this essentially commands that deal with
how the meta pretest session is handled
so you can see you have the channel
closed you can exit get timeouts you can
get info and if you locate in for
displays information about the post
module so this is more focused with the
meta Prater session when it comes down
to the target operating system you can
see here you have the cat command which
will read the contents of files so
similar to what you have on linux you
have your change directory received
retrieve the checksum copy all that good
stuff
you then have upload download and i'll
show you how to use that in a few
seconds you have to move the to delete
you can print lea working directory
create a directory all that good stuff
they'll come in handy in a few seconds
alright you then have networking
commands where you can perform the
I have configure an IP config that if
you have a shell I'll show you how to
launch a shell here you can display the
host ARP cache let me just move on a bit
quickly we have then the clear the clear
are the clear event log this is very
important for wiping your truck screen
I'll show you that in a few seconds
alright so let's get started now I've
gone through this and you can go through
it yourself all the commands are listed
out here and it's quite simple now one
of the most important ones that you
might be asking is again we are talking
about privilege escalation all right and
I think it would be better if I just
show you how that works I think that
though that would help a whole lot more
alright so let's get started now with
the first one in the most important one
changing directory as you can see I
spoke a bit about that one right now and
you can also list the current working
directory and you can see mine is in the
system32 folder so if I just go back and
pack again you can see now I'm in the I
mean essentially the C Drive and if I
can't my view my working directory to
users and to Alexis or let me actually
list and show you the users that I
currently have there as you can see
Alexis some are giving you an example of
what you are a hacker or the person
whose exploit to the system might be
doing so you've gained access and now
you're trying to see if you can download
the entire you're trying to see if you
can download files that that target
might be might have or files that are
potentially important all right so if I
list files here let me go into my
desktop alright and if I list the files
now you can see we have I've just
created these two text documents or txt
files you have the contacts and
passwords so again someone asked me how
would you go about downloading because
in the previous video it kind of failed
on me and that's because I actually I I
went back a directory and you know I was
talking about privilege escalation but
really if you're in the working
directory your current working directory
file but perform the print working
directory you can see we are in see
users Alexis desktop so that means I can
essentially just download the files
without specifying the location all
right so you might be asking well where
will it save it on your local opera
system it will save it where you
launched Metasploit and where you
launched the emitter press the meta
precision so if you launch it in your
desktop it's gonna save the files on
your desktop if you launched it in your
home or root directory which is what
I've done and what most of you will do
it's gonna save it there and I'll show
you that in a few seconds all right so
let's say I want to download I type in
download and I just type in let's see
passwords passwords dot txt and hit
enter and as you can see passes dot xt
is done all right so you might be asking
can you show us proof that this actually
exists if I go into my home directory
here you can see I have the paso dot txt
and there we are just put a few just
random information they are test 1 2 3
put passwords here and you might be
asking as well how do I know that's the
real file I'll show you here there we
are test put passwords here and usually
what happens is with this with this
exploit you can see we've got the
Windows Explorer I stopped working this
is to do with the double pulse exploit
if you try and inject we if you try and
inject the exploit in into the Windows
Explorer which is what I recommend then
usually on the client computer or the
target operating system they'll be faced
with this issue but it doesn't matter
whether they restart it you will still
have access using the meta prata alright
so let's get back here and let's go back
into my terminal and that's how to
download a file
alright so whoops sorry now let's look
at at the other command so we've talked
about downloading files we'll be looking
at clearing tracks at the very end of
the video all right that being said
let's look at some of the most important
ones we have talked about changing
directory you can also use the cat
command which I'm pretty sure you're
familiar with row cat let's see cat
passwords dot txt and I just hit enter
and as you can see it's just gonna
display the information that is in that
in in that file ok you can then perform
one of the also a very important command
and that is to actually view what user
you're currently using and you might be
asking well how is that important well
it's really very it's very cool actually
so this is I would say a hybrid Windows
/ user / linux command and that is get
user ID
oops get use ID use a user ID and I type
that in as you can see you have the
computer name and the user name the
computer name is very important as you
can see server using him that's what
this computer is going to be called on
your local network if it's on the local
network if not this can give you a good
idea that you have hacked into an
organization and you want to know what
exact computer have hacked into there
you are you have the name there the
system server name server username the
network ID I'm pretty sure you know what
that is if you have been using Windows
for a long time all right now looking at
the other con the other commands if you
wanted to know the local IP off of that
computer again this would come in handy
if you're in organization type of
situation all right so if I type in I
have IP config as you can see here it's
gonna start displaying the current
connection which is right the interface
11 and you can go ahead and look at the
IP address that it that has been
assigned to it and the hardware Mac
which in this case is the VMware Mac
that VMware provides to us alright so
that's how to get network information
you can also use other commands let's
see what else we haven't talked about
the upload command yes what if you
wanted to upload a file if you wanted to
upload a file onto account into your
current working directory that you
currently have so for example we can say
let's see we are currently in the root
directory so what if I was to just
create also a simple text document so
let's say what I'm gonna do is I'm just
going to create a simple text document
here or in lift that and just say
information and we'll just call this
flag flag one upload alright just to
make sure that they've got the correct
file and I'll I'll save this as let's
see root and I'll just call this info
dot txt so we want to upload this file
and this can also come in handy if you
are trying to upload a virus or a trojan
so for example you could be trying to
upload an exploit or a remote access
tool so you have backdoor access then or
a reverse PHP sure but that really
doesn't come in handy
what I'd recommend is a remote access
tool alright so what up so we've
actually created that file and as you
can see it's in photo tag State so how
do we go about uploading that file well
what we would do is we would say upload
upload and we would specify the file
info dot txt and then now we need to
specify the destination in its I was
actually got confused that's what I was
getting confused in the previous video
is you need to specify so for example we
could say well actually let's see if we
can just upload it directly now
that means it's uploaded it to our
current working directory so let's see
if it exists if I list the files in
there yes you can see we have the info
txt if you wanted to specify the
location what you would do is you would
use the C command and then you know you
would specify for example Windows you
then specify like the system32 this is
where I would go about hiding a ver
remote access tool even if you've used
Valley vision and you evaded the
anti-virus software you get the idea
right so that's how to upload files
really very simple and if I just you
know the in photo txt here if I just cut
that information you can see we have
flag one there we are really really
simple now in terms of the webcam
commands now I cannot demonstrate this
because I'm not really a webcam fan and
the reason I even got webcam was for
YouTube but I don't have it connected
right now so what you can do is the most
important command to test first of all
whether the computer actually has a
webcam connected it is performed the
webcam webcam command webcam list
I think it's list yes that will display
the yeah there we are and that will show
you whether the computer has any webcams
installed this is very very important
especially if you have a laptop if your
target is a laptop all right
you then have the webcam you might be
asking how do you capture how do you
capture any images well this comes in
two in two types of setting into two
types of configurations the webcam snap
command right so this webcam snap if I
just type a webcam snap it's gonna tell
me target is not a webcam but if you
want to view the help or all the
commands you can also issue with this
command or the parameters
you can specify the webcam help I whoops
sorry my bad
webcam snap help and yeah okay so if it
does have a webcam it will display the
help menu which will show you it will
allow you to specify the resolution or
the the quality of the image that you
want to take you want to snap now the
other awesome thing is that you can get
the let me just finish off with with
things like audio and video first and
then we can look at privilege escalation
I'm not actually don't remember how this
is actually quite embarrassing I don't
remember how to how to use the
microphone but I am guessing that that
will not come in handy right now because
if you're using a laptop the microphone
commands I'm really not that important
that being said I'll actually look into
it haven't touched on a microphone in a
long time
let's look at privilege escalation
alright and this is something that's
also very very important now when I talk
about privilege escalation I'm just
talking about giving yourself a better
access so as you can see get user ID if
I type that in you can see I'm logged in
as Alexis now if I want privilege
escalation I want to be the the
administrator I won't administrate
administrate administrator access sorry
about that that and that allows me to
essentially just do whatever I want
that comes in two types of situations so
the first thing I could do or I can do
is I can use the execute command and I
can execute the command prompt alright
which will give me that type of access
but the best way of doing it is to
perform is to put is to use the shell
command but before we do that I want to
actually use the hash dump command
because I want to show you how to dump
the contents of the Sam database alright
this is where essentially the boot case
is stored and you can essentially get
the H boot key and then you will decrypt
a user keys and it will give you the
password hashes which you can then crack
right so how do you do this really very
simple you just type in hash dump and
operations password gets yes off my bad
sorry what the hell am i doing usually
have to specify the location similar to
what you have on Linux so it's run post
windows gather yes it's in gather and
obviously hash dump hopefully that gives
us the hashes the password hashes there
we are obtaining boot key and
meterpreter obtain access all right so
we have 2x escalate privileges obviously
so we can just actually launch the shell
here and now we have shell access here
as you can see and then you can go ahead
and perform the hash table but you knew
you'd need a meterpreter instance and as
you can see if you launch the shell then
you then have a command a command prompt
so now I as you can see I need to press
dir if the CDs or Windows commands now
native Windows commands and there you
are that's how to gain access not the
computer and then from then onwards if
you wanted to use the Windows commands
you can go ahead and use that so I think
I've pretty much covered all the
important ones we've talked about upload
download listing all the files using the
shell searching webcam romance what else
have we talked about let's see we have
talked about the shell just now we
talked about IP config changing
directory uploading files and then
specifying the directory and yeah that's
pretty much all the important commands
that you can use me with meterpreter to
obviously oh we forgot one before got
one so I just want to talk about
something really important here all
right now if for example we wanted to
clear our tracks we would go about this
by using the clear the clear track
utility that comes with Windows and you
might be asking what what the hell is
this if you've never heard about we will
I'll explain it to you in a few seconds
so if I just type in here in the Windows
command clear Evie and I type in as you
can see it's not going to give us access
that's because we don't we are currently
not using the meterpreter and you might
be a bit confused there well essentially
what we would have to do now is we would
have to exit the exploit and now we are
in the emitter Pro to have gone back a
step ok so now we would use the clear
clear Evie alright and essentially now
this will allow you to clear your logs
and if I just
and it's gonna show you here wiping
wiping 648 records from application and
now you'd have to obtain a root access
here or administrate access and then you
can you can then go ahead and clear the
other logs which is the the system it
event locks and once you've done that
then you can just participate exit and
you're done with the exploit you have
clearly of clear do drugs you have
uploaded a rack whatever you want it to
you've downloaded files all that you've
wanted to do and you've cleared your
tracks at the end and you've pretty much
should you should have performed
whatever you want it to do post
exploitation privilege escalation you
uploaded the files downloaded whatever
you want and then you've cleared your
tracks and you're done and that's the
trademark of a successful hacking or
exploitation and I think I've covered a
lot about exploitation and now I want to
cover more about maintaining access you
know stuff like that I will be looking
that at that when we talk about you know
things like these D CTF challenges and
we'll be talking about hack the books
I'm actually creating a series on that
well be going through all of them
actually went through a lot of them and
I remembered it's actually quite easy to
be honest these starter ones I'm not
gonna show off here that being said the
web application penetration testing
series is also going to be continuing as
I said I'm feeling much better and also
uploads will be regular on a daily basis
and I'll be focusing on your video ideas
the series that we currently have
running and the ss7 video which is which
is due and it's going to be coming as
soon as I get my legal the legal
requirements to satisfy them and I'm
pretty sure not a lot of you actually
knew that and I didn't know that that
actually needed a permission to
demonstrate such an attack on a mass on
a mass on a system that is used you know
for for mass service I explained that
later but that being said hope you
enjoyed this video you found value in
this if you did please leave a like down
below if you have any questions also
just and let me know in the comments
section or on my social networks or you
can hit me up on my website and I'll be
I'll be sure or happy to answer your
question that being said guys have a
fantastic day and I'll be seeing you in
the next video peace
[Music]