Meterpreter is an advanced, dynamically extensible payload that uses in-memoryDLL injectionstagers and is extended over the network at runtime.
It communicates over the stager socket and provides a comprehensive client-side Ruby API.
How Meterpreter Works
The target executes the initial stager. This is usually one of bind, reverse, findtag, passivex, etc.
The stager loads the DLL prefixed with Reflective. The Reflective stub handles the loading/injection of the DLL.
The Metepreter core initializes, establishes a TLS/1.0 link over the socket and sends a GET. Metasploit receives this GET and configures the client.
Lastly, Meterpreter loads extensions. It will always load stdapi and will load priv if the module gives administrative rights. All of these extensions are loaded over TLS/1.0 using a TLV protocol.
Meterpreter Design Goals
Stealthy
Meterpreter resides entirely in memory and writes nothing to disk.
No new processes are created as Meterpreter injects itself into the compromised process and can migrate to other running processes easily.
By default, Meterpreter uses encrypted communications.
All of these provide limited forensic evidence and impact on the victim machine.
Powerful
Meterpreter utilizes a channelized communication system.
The TLV protocol has few limitations.
Extensible
New features can be added to Meterpreter without having to rebuild it.
Features can be augmented at runtime by loading extensions over the network.
The client uploads the DLL over the socket.
The server running on the victim loads the DLL in-memory and initializes it.
The new extension registers itself with the server.
The client on the attackers machine loads the local extension API and can now call the extensions functions.
The hashdump post module will dump the contents of the SAM database, where user and group account information stored.
meterpreter>runpost/windows/gather/hashdump[*] Obtaining the boot key...[*] Calculating the hboot key using SYSKEY 8528c78df7ff55040196a9b670f114b6...[*] Obtaining the user list and keys...[*] Decrypting user keys...[*] Dumping password hashes...Administrator:500:b512c1f3a8c0e7241aa818381e4e751b:1891f4775f676d4d10c09c1225a5c0a3:::dook:1004:81cbcef8a9af93bbaad3b435b51404ee:231cbdae13ed5abd30ac94ddeb3cf52d:::Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::HelpAssistant:1000:9cac9c4683494017a0f5cad22110dbdc:31dcf7f8f9a6b5f69b9fd01502e6261e:::SUPPORT_388945a0:1002:aad3b435b51404eeaad3b435b51404ee:36547c5a8a3de7d422a026e51097ccc9:::victim:1003:81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d:::meterpreter>
IdleTime
Running idletime will display the number of seconds that the user at the remote machine has been idle.
The ls command will list the files in the current remote directory.
Migrate
Using the migrate post module, you can migrate to another process on the victim.
meterpreter>runpost/windows/manage/migrate[*] Running module against V-MAC-XP[*] Current server process: svchost.exe (1076)[*] Migrating to explorer.exe...[*] Migrating into process ID 816[*] New server process: Explorer.EXE (816)meterpreter>
PS
The ps command displays a list of running processes on the target.
Run Meterpreter instructions located inside a text file.
By default, the commands will run in the current working directory (on target machine) and resource file in the local working directory (the attacking machine).
