I wanted to break this up into two because the first part was our MetaPredator and now I want
to show you Shell, PowerShell and some other cool stuff to do. Now before you actually start getting
into using PowerShell inside of MetaPredator, you want to actually load it in there. So you're
going to be using Load PowerShell and I believe I've already done it in this one. PowerShell,
yep, but it says it's already been loaded. So when you do this, the next command you're going
to be using is PowerShell, and you can tab over and see, but it's going to be PowerShell shell
underscore shell. And then at this point, if I can spell things correctly because I put
two underscores there, you can see as I zoom in for you that you see a PS there.
Basically you've opened up a remote PowerShell session between you and the target of that
Windows system. Inside of this PowerShell, you can run different subscripts. So if you're really
good at scripting inside of PowerShell and you want to run a quick script to send data back and
forth, by all means go through and do this. Those PowerShell scripts are usually learned by Sean
here on CBT Nuggets, and he's really good at putting them together and you'll start to get
the foundations of being able to do those scripts and start important things like network protocols.
What I want to take a look at though, is I hit control C. Oh, no, I don't want to close that
channel. I'll go back to Meterpreter real quick. What I want to see is the actual shell. So when
you type in shell, it's going to send you to the actual command prompt on the actual system itself.
And you get the traditional, as I zoom in here for you, C drive users on their desktop, you are in
their command prompt on their actual system. So if you are more familiar with getting user
information this way, this is another option for you because you can simply type who am I
and get all the information about who you are and what system you're on.
Now you do have to be a little bit careful. And by that, I mean, let me show you that I
have the Windows 10. I'm going to pull these side by side for a second.
The Windows 10 that we're attacking is the Windows 10 BWAP system. And you can see that I
have it opened up on the left. Now, if I go back to the right and get back into my Meterpreter
in the command prompt, I'm going to type WinVERT. I should theoretically be able to see what
versioning of Windows I have, because this is how it used to work in command prompt on the
actual Windows system. Will it work? Well, as I did that, you see that the Windows versioning
window opened up on the actual Windows 10 system. This might be a tip off that somebody is in the
system mucking around doing things they ain't supposed to. So please be careful and cautious
about some of the programs and commands that you are running because things like this might happen
and you might get caught. Now, since we're already inside of the actual command prompt,
if you're more familiar with things like command prompt and those Windows command line functions,
you can use this to be able to go and get more information about who you are and who you're
logged in as with provisions. So earlier we did the get UID, we did the who am I, now we want to
know what group we're in. We could easily say net user learner, since we know that we are a learner,
and we can get all the information here pertaining to the actual user that we're logged in as.
Such as when the last password was changed, is the account active, does it expire,
and there's all sorts of information that you could put inside of here as well too.
But more specifically, we want to take a look at right here, local group memberships,
administrators, global group memberships, none. Well, that global group memberships would be more
of a domain thing. We'll come back to that in a second. But the big thing is that we're an
administrator on this system. It would tell us what groups that we're in, like user or things
like that. But since we're an administrator here, we could just start wrecking house and looking for
everything that we needed. Now ideally, if you were on a domain, you can't hit up inside of this one,
you would just type net user learner slash, and then I'm going to type domain here,
but that's just the idea of where we're at. So if you're on a domain, and we will be later
on in this course, you will type the slash of the domain name that you're actually in,
and you could run an IP config to get the FQDN for this as well, because IP config will work
in this setting to give you that traditional IP config layout for that Windows system.
If you do want a little bit more info than that, you could always type in who am I again,
this time with a slash priv, and it will give you a more detailed readout of those
provisions that we looked at earlier with a description for them to give you an idea of
what they actually mean. And just in case you're not able to Google the things all at once or
have time for that little bit further detail, let's say you want to know what other groups
you're in. Because if I remember correctly, the net user command for the groups only gives you
the highest one that you're in, and that's running off of memory here. So I just like to type
who am I slash group, and that will tell you if I could spell things correctly here, sorry, plural
groups. If you type that, you will get a readout of all the different groups that are on the system.
More specifically, let me scroll up a little bit so everybody can see what's going on.
And that way you can get a clearer view. You can see here that you have all the group information
for the actual system itself. And I was a little bit off on this because this list, all of them,
and not just that one dedicated user that you're looking at, but this is actually better information
for us to know because now we have a listing of all groups on the system. Now, if you're on a
domain environment and there are domain user groups on that system that are integrated from
the domain itself, they will be listed in here as well too, along with their SSID that's associated
with that domain. And as you can see here, just if you wanted a little bit of SID learning,
the S-1-5 is stuff for the actual system itself. And the domain would have something other than
S-1-5 starting off with. S-1-5, I believe is for local systems. Again, there are courses on here
for that, but we're just taking a look at the actual listing of the group names themselves
and what's actually been brought in or native to the actual system that we're on.