Metasploit: Meterpreter

Metasploit is a popular tool used in penetration testing, and Meterpreter is a payload that lets you control a target system after gaining access. In this write-up, we will go through the basics of Meterpreter and learn some simple commands to use it.

This guide is beginner-friendly and focuses on helping you understand how Meterpreter works in a clear and easy way.

First, we run the sysinfo command in Meterpreter to get system details:

From the output, we can see that the Computer Name: ACME-TEST

To find extra information, we can run the getuid to identify the current user and the privilege.

Using the same sysinfo command, we also find the domain. From the result below, the domain is FLASh.

For the next step, we must first set the meterpreter session to the background. Then use the

use post/windows/gather/enum_shares module to find the shared folder.

To find shared folders, we use a post-exploitation module:

use post/windows/gather/enum_shares

set SESSION 1

run

This lists all available shares on the system. From the results, we see:

The share likely created by the user is speedster .

First, we must get a meterpreter session. The question suggests using the exploit/windows/smb/psexec module and given credential. This module uses the SMB service to authenticate and run commands on the target.

Before running the exploit, we check what options need to be set using the show options command.

We configure the module with the target details:

Now we execute the module using the exploit command.

If successful, Metasploit will:

You should see something like Meterpreter session 1 opened

Now we can extract user password hashes using hashdump command.

This will display all user accounts and their NTLM hashes. From the result we can see the jchambers NTLM hash.

For this question, the password was cracked using John the Ripper with the rockyou.txt wordlist. We can use this command to crack the password: john —format=<password_format> —wordlist=<password_path> <hash> After the cracking process completed, the recovered password shown is Trustno1 .

To solve this question, we can utilize the meterpreter’s search function search -f <filename> . The -f stands for filename, meaning you’re searching for a specific file name. Based on the search result, the file was found at C:\Program Files (x86)\Windows Multimedia Platform\secrets.txt .

Next, we navigate to the directory and read the secrets.txt file using cat command.

The password is inside the sectrets.txt is KDSvbsw3849! .

This question uses the same method as the previous question. We can use the search function to find the file.

The search result shows that the file is in the C:\inetpub\wwwroot directory.

We navigate to the directory and use the cat command to read the realsecret.txt file.

The secret message is “The Flash is the fastest man alive”.