Presented at Defcon 20

1. POST METASPLOITATION

2. egypt

6. WHY THIS TALK?
• Get more shells
• Get better shells
• Do more with them, faster

7. ASSUMPTIONS
• You’ve heard of Metasploit
• You’ve got a shell
• You have some goal that isn’t that shell

8. WHY METASPLOIT?

10. LARGE OPEN SOURCE COMMUNITY

11. > C

12. POST MODULE DESIGN
Should be minimal
• Complexity is hard to debug and maintain
• Do one thing and do it well
– Resource scripts can automate multiple modules

13. POST MODULE DESIGN
Should be readable
• Consistent structure
• Consistent option names
• Consistent output

14. POST MODULE DESIGN
Should be reliable
• Detect relevant variables
• Never crash session/host if you can avoid it
• Clean up

15. POST MODULE DEVELOPMENT
Like Aux modules in many ways
• Define a run() method
• Optional setup(), cleanup() methods
• Have Actions
• Can include Exploit / Auxiliary mixins
• Should report something

16. POST MODULE STRUCTURE

17. METASPLOIT POST API
• DSL*-like interface for automating shells
• Abstracts out common stuff
• Platform-agnostic methods for
– Reading/writing binary files
– Running shell commands
– Listing users
*Domain Specific Language

18. POST-EXPLOITATION SECRET SAUCE

19. Presence
Persistence
Pivoting
[1]: I totally stole this from Mubix

20. PRESENCE
• Examine your environment
– Users
– Machine
• One issue here is getting an unfamiliar shell
– Never played on Solaris, what do you do?

21. WHAT USERS ARE/HAVE LOGGED IN?

22. PRESENCE - THE MACHINE
• What does this box do?
• What processes are running?
– AV, Tripwire
– ssh-agent, pageant
– Editors
– Database servers
• What does it talk to?

23. WHAT DOES THIS MACHINE TALK TO?

24. PERSISTENCE
• Passwords!
• Backdoors
• Re-introducing vulnerabilities

25. TEMPORARY PERSISTENCE
• Reverse http(s) payloads
• Doesn't survive reboot but useful for keeping
shells when network is spotty

26. MORE PERMANENT OPTIONS
• Autoruns
– Drop an exe in the right place, maybe mod registry
– Simple, effective
• Task scheduler, cron, launchd
• Enable RDP
• Enable root login for ssh

27. PIVOTING
• Passwords!
• Privilege escalation
• Trust relationships
• Route, portfwd
• auxiliary/server/socks4a
• Explicit "comm" arg to Rex::Socket creation

28. POST-EXPLOITATION EXPLOITATION
• For when you absolutely, positively have to
have root
– (and don’t mind the occasional kernel panic)
• We can kinda blur the line between local and
remote here

29. $ -> #
• Just like with network exploitation, not always
an exploit
• Passwords (sudo)
• Trust relationships (suid executables)
• Misconfiguration (all sorts of shit)

30. DEMO: MULTI/LOCAL/SETUID_NMAP
"Nmap should never be installed with
special privileges (e.g. suid root) for
security reasons."

32. DEMO: LINUX/LOCAL/SOCK_SENDPAGE
AKA Wunderbar Emporium

34. EXPLOIT::LOCAL
• Inherit from Exploit
– Provides payloads and handlers
– Create executables, etc
• Include Post mixins
– Provides session interaction
– Write files, manipulate registry, etc

35. COMPILING/ASSEMBLING WITH METASM
• Can compile C for x86/x86_64
• Can assemble x86, x86_64, mips, arm, ppc and
more

36. TRUST RELATIONSHIPS
• Windows Authentication
– NTLM auth is relay-able
– Automatic domain auth

37. SMB RELAY
Attacker Target
Victim begins NTLM
authentication against the
attacker
Victim

38. SMB RELAY
Attacker Target
Attacker begins NTLM auth
against Target
Victim

39. SMB RELAY
Attacker Target
Target replies with 8-byte
challenge
Victim

40. SMB RELAY
Attacker Target
Attacker sends Target's
challenge to Victim
Victim

41. SMB RELAY
Attacker Target
Victim calculates challenge
response and replies with
final authentication packet
Victim

42. SMB RELAY
Attacker Target
Attacker logs into Target
with Victim's credentials
Victim

43. SMB RELAY
• Well-known attack
• Some mitigations break it, but largely still
useful and will be for a long time

44. SMB RELAY + LNK FILE
Drop LNK file (post/windows/escalate/droplnk)
Setup a relay (exploit/windows/smb/smb_relay)
Wait for an Admin to open
that directory Victim
Create LNK file
Target Compromised File Server

45. AUTOMATIC DOMAIN AUTH
• Windows stores creds in memory and does
NTLM auth using your current token
• When you do something in the GUI that
requires auth, it happens automatically using
those creds
• If your user has Local Admin on another box,
you can create/start services (usually)

46. SC_HANDLE WINAPI OpenSCManager(
__in_opt LPCTSTR lpMachineName,
__in_opt LPCTSTR lpDatabaseName,
__in DWORD dwDesiredAccess );

47. SC_HANDLE WINAPI CreateService(
__in SC_HANDLE hSCManager,
__in LPCTSTR lpServiceName,
__in_opt LPCTSTR lpDisplayName,
__in DWORD dwDesiredAccess,
__in DWORD dwServiceType,
__in DWORD dwStartType,
__in DWORD dwErrorControl,
__in_opt LPCTSTR lpBinaryPathName,
__in_opt LPCTSTR lpLoadOrderGroup,
__out_opt LPDWORD lpdwTagId,
__in_opt LPCTSTR lpDependencies,
__in_opt LPCTSTR lpServiceStartName,
__in_opt LPCTSTR lpPassword );

48. DEMO: OWNING DC USING DA TOKEN
Yay automatic authentication

50. CONCLUSIONS
• Metasploit is awesomesauce
• If it doesn't already do what you need, it's
easy to add new modules
• Stick around for Dave's talk!

51. QUESTIONS?
• Twitter: @egyp7
• IRC: #metasploit on FreeNode