Meterpreter - Revision history

BKongo at 17:53, 31 December 2024

2024-12-31T17:53:57Z

← Older revision		Revision as of 17:53, 31 December 2024
Line 1:		Line 1:
	== Summary ==		== Summary ==
	Meterpreter, short for Meta-Interpreter, is a ~~dynamically extendable attack~~ payload ~~included in~~ the Metasploit penetration testing ~~Framework~~. ~~The payload was developed~~ by Matt Miller ~~under the hacker moniker of~~ Skape ~~and is used in the post-exploitation phase after gaining access to the targeted system.~~ Meterpreter provides ~~a powerful~~ interactive command line interface (CLI) and ~~avoids the risk of being exposed~~. ~~Running it does not alert intrusion detection systems, like starting a standard~~ shell ~~process will~~, ~~because it is strictly executed from working memory.~~ Meterpreter does not ~~need a~~ separate ~~process~~ to ~~execute because~~ it ~~is injected~~ into ~~a currently running~~ process. ~~This also means it is executed from memory only, which makes it even harder~~ to ~~detect for Anti-Virus software. Meterpreter provides a variety of~~ commands, ~~additional modules~~ and scripts ~~available to aid in further exploitation~~. ~~Because it is integrated into~~ the Metasploit Framework ~~it can use its~~ post-exploitation modules ~~as well~~.		Meterpreter, short for Meta-Interpreter, is a versatile and stealthy payload integrated into the Metasploit Framework, designed for use during the post-exploitation phase of penetration testing. Developed by Matt Miller (a.k.a. Skape), Meterpreter provides an interactive command-line interface (CLI) that avoids detection by Intrusion Detection Systems (IDS) and antivirus software by operating exclusively in memory.

			Unlike traditional shell processes, Meterpreter does not write to disk or require separate processes to run. Instead, it injects itself into an active process on the target system, enhancing its stealth capabilities. Its encrypted communications and runtime extensibility allow attackers to execute commands, load extensions, and run scripts without rebuilding sessions. As part of the Metasploit Framework, Meterpreter seamlessly integrates with numerous post-exploitation modules, enabling powerful and flexible exploitation workflows.

	== Meterpreter Basics ==		== Meterpreter Basics ==
Line 28:		Line 30:

	== Meterpreter Features ==		== Meterpreter Features ==
	~~The~~ Meterpreter CLI ~~is similar to~~ standard shells (sh, zsh~~, etc.)~~ and ~~provides~~ system, file ~~system~~ and networking commands ~~identical to them~~ (cd, cat, rm, pwd, etc.)~~. Meterpreter also provides additional basic commands~~, ~~some of which can be seen in the table below, additional commands provided by the default extensions and more commands can be added by loading other extensions~~.		Meterpreter's CLI resembles standard shells like sh or zsh and supports common system, file, and networking commands (cd, cat, rm, pwd, etc.), making it intuitive for penetration testers.

	=== Basic Commands ===		=== Basic Commands ===
Line 92:		Line 94:
	==Meterpreter-Skripting with Ruby==		==Meterpreter-Skripting with Ruby==

	~~The Metasploit Framework version~~ 3.0 ~~represents~~ a ~~significant advancement compared to the typical~~ 2.x ~~series. It is~~ a complete ~~overhaul of the previous versions, now entirely written~~ in Ruby. ~~The~~ earlier ~~versions were primarily written in~~ Perl ~~and included components from~~ Python, C, and Assembly~~. Ruby is an~~ interpreted, object-oriented language ~~that combines~~ the ~~best elements of Perl~~ and ~~Smalltalk~~. ~~Version 3.0 of the framework provides~~ automation ~~capabilities in~~ every ~~phase~~ of the discovery ~~and~~ exploitation ~~process~~. ~~Almost every component of the framework can be extended~~, ~~linked~~, and ~~automated~~, ~~enabling~~ effective penetration testing and ~~close integration~~ with third-party ~~products~~.		Version 3.0 of the Metasploit Framework marked a major leap forward from its 2.x predecessors, introducing a complete rewrite in Ruby. This transition replaced the earlier mix of Perl, Python, C, and Assembly with a unified, interpreted, object-oriented language. Ruby’s simplicity, extensibility, and object-oriented features made it an ideal choice for enhancing the framework's flexibility and performance.

			This overhaul enabled automation at every stage of the penetration testing process, from discovery to exploitation. Version 3.0 allows for seamless extension, integration, and automation of nearly all components, making it more effective for penetration testing and highly compatible with third-party tools. This adaptability solidified Metasploit's role as a cornerstone in modern cybersecurity workflows.

	===The Ruby programming language by Yukihiro Matsumoto===		===The Ruby programming language by Yukihiro Matsumoto===

GBerdynaj at 22:20, 8 January 2024

2024-01-08T22:20:00Z

@@ Line 89: / Line 89: @@
 Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. The Meterpreter session can be put into the background to run these modules.
 [[File:Meterpreter List Scripts.png|thumb|none|750px|Meterpreter Scripts]]
 == Sources ==
 * D. Kennedy, J. O’Gorman, D. Kearns, and M. Aharoni. Metasploit: The Penetration Tester’s Guide. No Starch Press Series. No Starch Press, 2011.
 * M. Miller. Meterpreter specifications. http://www.hick.org/code/skape/papers/meterpreter.pdf, 2004. Accessed: 2022-09-14.
 * Metasploit Unleashed free ethical hacking course. https://www.offensive-security.com/metasploit-unleashed/. Accessed: 2022-11-05.
-* Michael Messner. Hacking mit Metasploit. dpunkt.verlag, 3rd edition, 2017.
+* Benjamin Pharr. Getting to know ruby. J. Comput. Sci. Coll., 21(5):181–182, may 2006.
 [[Category:Documentation]]

BVogler: figure fixed

2023-01-03T14:57:18Z

figure fixed

← Older revision		Revision as of 14:57, 3 January 2023
Line 88:		Line 88:
	=== Scripts & Modules ===		=== Scripts & Modules ===
	Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. The Meterpreter session can be put into the background to run these modules.		Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. The Meterpreter session can be put into the background to run these modules.
	[[File:Meterpreter Scripts.png\|thumb\|none\|750px\|Meterpreter Scripts]]		[[File:Meterpreter List Scripts.png\|thumb\|none\|750px\|Meterpreter Scripts]]

	== Sources ==		== Sources ==

BVogler: fixed formatting

2023-01-03T14:49:40Z

fixed formatting

← Older revision		Revision as of 14:49, 3 January 2023
Line 40:		Line 40:
	\| Moves the current Meterpreter session to the background giving the user access to the Metasploit command line.		\| Moves the current Meterpreter session to the background giving the user access to the Metasploit command line.
	\|-		\|-
	\| sessions -i 'ID'		\| sessions -i ''ID''
	\| Reactivates the specified session. Using the command without a switch displays all active sessions.		\| Reactivates the specified session. Using the command without a switch displays all active sessions.
	\|-		\|-
Line 78:		Line 78:

	=== Extensions ===		=== Extensions ===
	Meterpreter extensions are loaded by using the '''load'''-command. ~~Some~~ Extensions are loaded by default ~~like the~~ '''priv'''-extension ~~which~~ is used for privilege escalation ~~and the~~ '''stdapi'''-extension ~~which~~ supplies ~~basic~~ Meterpreter commands like '''getuid''~~'. Frequently~~ used extensions include:		Meterpreter extensions are loaded by using the '''load'''-command. Two Extensions are loaded by default:
	* '''kiwi''' ~~(formerly mimikatz)~~: This extension is used to obtain user credentials and authentication tokens~~. These~~ are retrieved ~~directly~~ from ~~target systems~~ memory. ~~Passwords can even~~ be displayed ~~directly~~ in cleartext.		* '''priv''': This extension is used for privilege escalation
	* ''' python ''': This ~~extensions~~ allows the execution of python scripts on the target machine.		* '''stdapi''': This extension supplies core Meterpreter commands like ''getuid''
	* ''' powershell ''': This ~~extensions~~ allows the execution of powershell scripts on the target machine.		Other frequently used extensions include:
			* '''kiwi''': This extension is used to obtain user credentials and authentication tokens which are retrieved from system memory. This makes it possible for passwords to be displayed in cleartext. In the past the extension was named '''mimikatz'''.
			* ''' python ''': This extension allows the execution of python scripts on the target machine.
			* ''' powershell ''': This extension allows the execution of powershell scripts on the target machine.

	=== Scripts & Modules ===		=== Scripts & Modules ===
	Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. A Meterpreter session can be put into the background to run these modules.		Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. The Meterpreter session can be put into the background to run these modules.
	[[File:Meterpreter Scripts.png\|thumb\|none\|750px\|Meterpreter Scripts]]		[[File:Meterpreter Scripts.png\|thumb\|none\|750px\|Meterpreter Scripts]]

BVogler: further modification of the article, fixed typos

2023-01-03T14:01:34Z

further modification of the article, fixed typos

← Older revision		Revision as of 14:01, 3 January 2023
Line 1:		Line 1:
	== Summary ==		== Summary ==
	Meterpreter, ~~which is~~ short for Meta-Interpreter, is an attack payload included in the Metasploit Framework. It was developed by Matt Miller under the hacker moniker of Skape~~. It~~ is used in the post-exploitation phase after ~~an exploit was already used to gain~~ access to a system. It provides a ~~more~~ powerful interactive command line interface (CLI) ~~than a regular shell~~ and ~~also~~ avoids the risk of being exposed ~~since~~ starting a ~~regular~~ shell process ~~could alert the system to intrusion~~. Meterpreter does not need a separate process to execute ~~since~~ it is injected into a process ~~already running on the target system~~. This also means it is executed from memory only, which makes it even harder to detect for Anti-Virus software. Meterpreter ~~has~~ a ~~wide~~ variety of commands, additional modules and scripts available ~~for~~ further ~~exploiting a system~~. ~~Since~~ it is integrated into the Metasploit Framework it can use its post-exploitation modules as well.		Meterpreter, short for Meta-Interpreter, is a dynamically extendable attack payload included in the Metasploit penetration testing Framework. The payload was developed by Matt Miller under the hacker moniker of Skape and is used in the post-exploitation phase after gaining access to the targeted system. Meterpreter provides a powerful interactive command line interface (CLI) and avoids the risk of being exposed. Running it does not alert intrusion detection systems, like starting a standard shell process will, because it is strictly executed from working memory. Meterpreter does not need a separate process to execute because it is injected into a currently running process. This also means it is executed from memory only, which makes it even harder to detect for Anti-Virus software. Meterpreter provides a variety of commands, additional modules and scripts available to aid in further exploitation. Because it is integrated into the Metasploit Framework it can use its post-exploitation modules as well.

	== Meterpreter Basics ==		== Meterpreter Basics ==
	~~=== How does Meterpreter work? ===~~		Meterpreter is supposed to give the attacker access to a command interpreter on the target machine that offers powerful post-exploitation tools and is also hard to detect with forensic tools. For this Meterpreter was designed with the three goals of being stealthy, powerful and extensible.
	~~# Target system is compromised using an exploit.~~
	~~# Compromised system executes the initial Meterpreter payload also called stager (bind_tcp, reverse_tcp, ...)~~
	~~# The stager loads the needed DLLs, the Meterpreter core initializes and established a TLS connection to the attacking system.~~
	~~# Meterpreter sends a GET request which Metasploit receives and configures the client.~~
	~~# Meterpreter loads the default extensions (stdapi and priv) over the TLS connection by using the TLV (Type-Length-Value) protocol.~~

	~~=== Meterpreter Design Goals ===~~
	Meterpreter is supposed to give the attacker access to a command interpreter on the target machine that offers powerful post-exploitation tools and is also hard to detect with forensic tools. ~~To achieve~~ this ~~goal~~ three ~~requirements had to be met~~.

			=== Meterpreter Design Goals ===
	==== Stealthy ====		==== Stealthy ====
	~~The payload had to be stealthy and hard to detect.~~
	* Meterpreter is designed to operate in working memory and never write to the physical disk.		* Meterpreter is designed to operate in working memory and never write to the physical disk.
	* Meterpreter operates inside running processes and can be migrated to other processes.		* Meterpreter operates inside running processes and can be migrated to other processes.
Line 20:		Line 12:

	==== Powerful ====		==== Powerful ====
	~~The user rights on the target system can be elevated using privilege escalation.~~
	* Meterpreter utilizes a channelized communication system.		* Meterpreter utilizes a channelized communication system.
	* The TLV (Type-Length-Value) protocol has few limitations.		* The TLV (Type-Length-Value) protocol has few limitations.

	==== Extensible ====		==== Extensible ====
	~~Meterpreter had to be extensible to adapt to different requirements.~~
	* Meterpreter can be augmented at runtime. Extensions, modules and scripts can be loaded over the network connection.		* Meterpreter can be augmented at runtime. Extensions, modules and scripts can be loaded over the network connection.
	* The Meterpreter session does not have to be rebuilt every time new features are added.		* The Meterpreter session does not have to be rebuilt every time new features are added.

			=== How does Meterpreter work? ===
			Prerequisite: The target system is already exploited and remote access is established.
			# Meterpreter payload, also called the initial stager, is sent to the target system.
			# Compromised system executes the initial stager, usually bind_tcp, reverse_tcp, etc.
			# The stager loads the needed libraries, the Meterpreter core initializes and established a TLS connection to the attacking system.
			# Meterpreter sends a GET request which Metasploit receives and then configures the client.
			# Meterpreter loads the default extensions ('''stdapi''', '''priv'''). The extensions are loaded over the TLS connection using a TLV (Type-Length-Value) protocol.

	== Meterpreter Features ==		== Meterpreter Features ==
	The Meterpreter CLI ~~offers~~ standard ~~commands that are also used in~~ shells ~~like '''~~sh~~'''~~ and ~~'''zsh'''~~. ~~Additional~~ commands ~~are loaded~~ by default and can be added by loading extensions.		The Meterpreter CLI is similar to standard shells (sh, zsh, etc.) and provides system, file system and networking commands identical to them (cd, cat, rm, pwd, etc.). Meterpreter also provides additional basic commands, some of which can be seen in the table below, additional commands provided by the default extensions and more commands can be added by loading other extensions.

	=== Basic Commands ===		=== Basic Commands ===
	~~Commonly~~ used Meterpreter commands can be found in the table below.		A selection of commonly used Meterpreter commands can be found in the table below.
	{\| class="wikitable"		{\| class="wikitable"
	\|-		\|-
Line 40:		Line 38:
	\|-		\|-
	\| background		\| background
	\| Moves the current Meterpreter session to the background ~~letting~~ the user ~~use~~ the Metasploit command line.		\| Moves the current Meterpreter session to the background giving the user access to the Metasploit command line.
	\|-		\|-
	\| sessions -i ID		\| sessions -i 'ID'
	\| Reactivates the specified session. Using the command without a switch ~~shows~~ all active sessions.		\| Reactivates the specified session. Using the command without a switch displays all active sessions.
	\|-		\|-
	\| clearev		\| clearev
	\| Deletes all ~~Application~~, ~~System~~ and ~~Security~~ logs on the victim machine. Only works for Windows systems.		\| Deletes all application, system and security logs on the victim machine. Only works for Windows systems.
	\|-		\|-
	\| execute		\| execute
	\| Executes a command on the remote machine specified by the -f switch. The executed command can be supplied with arguments by using -a		\| Executes a command on the remote machine specified by the '-f' switch. The executed command can be supplied with arguments by using '-a'.
	\|-		\|-
	\| getsystem		\| getsystem
Line 74:		Line 72:
	\| search		\| search
	\| Searches the system for a file specified by the -f switch. The provided filename may contain wildcards.		\| Searches the system for a file specified by the -f switch. The provided filename may contain wildcards.
			\|-
			\| sysinfo
			\| Prints the target machines name, operating system (including build and service pack if applicable), the architecture of the operating system, the system language, the domain name and the number of currently logged in users.
	\|}		\|}

Line 83:		Line 84:

	=== Scripts & Modules ===		=== Scripts & Modules ===
	Meterpreter includes pre-made scripts ~~that can be used~~ for various purposes ~~and~~ are run by using the '''run'''-command. It includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. ~~Some~~ of the ~~script~~ seen in the figure below are considered deprecated. ~~Some of those, like the persistence script were~~ integrated ~~directly~~ into the Metasploit Framework. A Meterpreter session can be put into the background to run these ~~post-exploitation~~ modules ~~supplied by Metasploit~~.		Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. A Meterpreter session can be put into the background to run these modules.
	[[File:Meterpreter Scripts.png\|thumb\|none\|~~500px~~\|Meterpreter Scripts]]		[[File:Meterpreter Scripts.png\|thumb\|none\|750px\|Meterpreter Scripts]]

	== Sources ==		== Sources ==

BVogler: re-design of article, added missing category tag

2022-11-18T13:31:39Z

re-design of article, added missing category tag

Show changes

SDoiber at 20:46, 16 January 2022

2022-01-16T20:46:53Z

← Older revision		Revision as of 20:46, 16 January 2022
Line 171:		Line 171:
	url={https://www.offensive-security.com/metasploit-unleashed/},		url={https://www.offensive-security.com/metasploit-unleashed/},
	journal={Offensive Security}		journal={Offensive Security}
	}		}

SDoiber at 20:46, 16 January 2022

2022-01-16T20:46:34Z

← Older revision		Revision as of 20:46, 16 January 2022
Line 122:		Line 122:
	doi={10.1109/SoutheastCon45413.2021.9401881}}		doi={10.1109/SoutheastCon45413.2021.9401881}}

	@misc{mathias_2021,		@misc{mathias_2021,
	title={Metasploit / Meterpreter - Zugriff auf Android: Mattionline},		title={Metasploit / Meterpreter - Zugriff auf Android: Mattionline},
	url={https://mattionline.de/metasploit-meterpreter-android-smartphone/},		url={https://mattionline.de/metasploit-meterpreter-android-smartphone/},
Line 130:		Line 130:
	month={Mar}}		month={Mar}}

	@misc{edwardgately_2021,		@misc{edwardgately_2021,
	title={Facebook Ou tage Worst in More than 10 Years, Could Be Cyberattack},		title={Facebook Ou tage Worst in More than 10 Years, Could Be Cyberattack},
	url={https://www.channelfutures.com/security/facebook-service-outage-worst-in-more-than-10-years-could-be-cyberattack},		url={https://www.channelfutures.com/security/facebook-service-outage-worst-in-more-than-10-years-could-be-cyberattack},
Line 167:		Line 167:
	}		}

	@misc{offensivesecurity,		@misc{offensivesecurity,
	title={Metasploit Unleashed},		title={Metasploit Unleashed},
	url={https://www.offensive-security.com/metasploit-unleashed/},		url={https://www.offensive-security.com/metasploit-unleashed/},
	journal={Offensive Security}		journal={Offensive Security}
	}		}

SDoiber at 20:46, 16 January 2022

2022-01-16T20:46:12Z

@@ Line 75: / Line 75: @@
 [[File:MeterpreterConectivity.png]]
 === Encryption ===
@@ Line 89: / Line 90: @@
 * The Client transmits the request with the method 'core$\_$loadbib' which includes a TLV$\_$TYPE$\_$LIBRARY$\_$PATH TLV with the location of the remote server where the library is located.
 * The Server transmits the response 'core$\_$loadbib' back to the client. If the library was loaded successfully, the TLV$\_$TYPE$\_$RESULT parameter will be set to zero. In the other case, the response contains the exception and its data.

SDoiber at 18:25, 16 January 2022

2022-01-16T18:25:34Z

← Older revision		Revision as of 18:25, 16 January 2022
Line 70:		Line 70:

	Off of those 7 meta-types, a list of predefined TVLs have been developed which provide core functionality to Meterpreter.		Off of those 7 meta-types, a list of predefined TVLs have been developed which provide core functionality to Meterpreter.

			=== Connectivity ===
			The connection between server and client is initiated by the server (i.e. the target machine), after the Metasploit framework used an exploit to gain access to the system, which then sends a banner message to the client to signal the established connection.

			[[File:MeterpreterConectivity.png]]

			=== Encryption ===
			At this point it is possible to enable encryption of the communication by issuing the command
			$ initcrypt

			on the client machine. This command needs to be supplied with a cypher which the client then sends as a plaintext packet to the server via the method 'core$\_$crypto$\_$negotiate'. This includes a unique request identifier since a response is expected. This packet also needs to contain the TLV$\_$TYPE$\_$CYPHER$\_$NAME and optionally the \newline TLV$\_$TYPE$\_$CYPHER$\_$PARAMETERS.
			If everything works as expected the server responds with the 'core$\_$crypto$\_$negotiate' method back including the optional parameters if provided.\cite{meterpreter_documentation}

			=== Libraries ===
			Loading a new library is very similar in complexity and method to enabling encryption. Depending on the parameters of the
			$ loadbib
			command, the employed mechanism varies. In a situation where the library is loaded from a path on the remote machine, and no uploading is taking place, the packet flow looks like this:
			* The Client transmits the request with the method 'core$\_$loadbib' which includes a TLV$\_$TYPE$\_$LIBRARY$\_$PATH TLV with the location of the remote server where the library is located.
			* The Server transmits the response 'core$\_$loadbib' back to the client. If the library was loaded successfully, the TLV$\_$TYPE$\_$RESULT parameter will be set to zero. In the other case, the response contains the exception and its data.