Chapter 4. Post-Exploitation with Metasploit

This chapter will feature hard-core post-exploitation. Throughout this chapter, we will focus on approaches to post-exploitation, and will cover basic tasks, such as privilege escalation, getting passwords in clear text, finding juicy information, and much more.

During this chapter, we will cover and understand the following key aspects:

• Performing necessary post-exploitation
• Using advanced post-exploitation modules
• Privilege escalation
• Gaining persistent access to the targets

Let us now jump into the next section, where we will look at the basics of the post-exploitation features of Metasploit.

Extended post-exploitation with Metasploit

We have already covered a few of the post-exploitation modules in the previous chapters. However, here we will focus on the features that we did not cover. Throughout the last chapter, we focused on exploiting the systems, but now we will focus only on the systems that are already exploited. So, let us get started with the most basic commands used in post-exploitation in the next section.

Basic post-exploitation commands

The core meterpreter commands are those that are available on most of the exploited systems using a meterpreter payload, and provide the necessary core functionalities for post-exploitation. Let us get started with some of the most basic commands that will help you with post-exploitation.

The help menu

We can always refer to the help menu's list of all the various commands that are usable on the target by issuing help or ?, as shown in the following screenshot:

Background command

While carrying out post-exploitation, we may run into a...

Metasploit and privilege escalation

In this section, we will look at using Metasploit to obtain the highest level of privileges on the target system. Most of the applications we are targeting run on user-level privileges, which provide us with general access but not access to the complete system. However, to obtain system-level access, we need to escalate privileges using vulnerabilities in the target system after gaining access to the system. Let us see how we can achieve system-level access to various types of operating system in the next sections.

Escalating privileges on Windows Server 2008

During a penetration test, we often run into situations where we have limited access, and, when running commands such as hashdump, we might get the following error:

In such cases, if we try achieving system privileges with the getsystem command, we get the following errors:

So, what shall we do in these cases? The answer is to escalate privileges using post-exploitation to achieve the highest level of...

Gaining persistent access with Metasploit

Gaining persistent access to the target systems is important when you are a part of a law enforcement agency. However, in a conventional penetration test, persistence may not be very practical, unless the testable environment is huge and will take many days for the test to complete. But this doesn't mean that it is not worth knowing how to maintain access to the target. In the following section, we will cover persistence techniques, which one can use to maintain access to the target system. In addition, Metasploit has depreciated the persistence and metsvc modules in meterpreter, which were used to maintain access to the target. Let's cover the new techniques for achieving persistence.

Gaining persistent access on Windows-based systems

In this example, we have already gained meterpreter access to a system running Windows Server 2012 R2. Let's move the meterpreter to the background using the background command and use the latest persistence module,...

Summary

We covered plenty of things in this chapter. We kicked off by learning basic post-exploitation and moved on to advanced post-exploitation. We also covered migration, obtaining system privileges, timestomp, and obtaining hashes. We also saw how we could use Metasploit for privilege escalation and maintaining access for both Linux and Windows systems.

You had a variety of exercises to complete throughout this chapter. However, if you would like to try more, then try performing the following tasks:

• Try privilege escalation on a variety of systems, including Windows Server 2003, Windows XP, Windows 7, Windows 8.1, and Windows 10. Notice the differences and maintain a list of modules used for escalating privileges on these systems.
• Install two- to three-year-old copies of Red Hat, CentOS, and Ubuntu operating systems, figure out the kernel version, and try escalating privileges on those machines.
• Figure out ways to obtain persistence on OSX, BSD, and Solaris operating systems.

In Chapter 5...