Now that we have our call center set up for the MSF console to listen to everybody, make
unsolicited phone calls to us within an organization, we can now set up how we want to be able to
manipulate that information that we're getting from the actual target systems.
In previous skills, we've talked about collecting information and even going beyond and doing
some just a scratching on the post exploitation, but I want to go through just a quick automation
method for us to be able to look at how using multiple sessions is actually good for us
to be able to go through and do a bit of data diving.
Now we're going to pop on over to our lab here real quick, and inside of here, you can
see that right out the gate, I have a new file for us here.
It's called collection.
It's inside of that scripts folder, and I'll put the code for this below the video as well
too.
It's very simple.
What we're doing is getting the system information, the UID of the system, and then we're running
a quick post exploitation task of finding out if we're working with a virtual machine
or not.
And there's a couple of reasons for this, and without getting too far into it for later
in the course, if you're working on a VM as one of your target systems, there's a couple
of different pieces of information that you can work with.
One is that there's a larger VM environment probably, or two, you can work on the impossible
VM escape that has not been officially documented yet.
But you also know that there's probably a shared subnet amongst those VM machines.
It gives you something that you can kind of work with as far as future scanning goes.
The last one that we have is screenshot.
Now this will only work in Windows, and I have not seen it work inside a POSIX based
system, but it does give us a quick snippet of information as far as like what the user's
actually looking at.
You've seen us use this before.
Now this file is just a collection, no file extension or anything like that.
And going back to our meter preter session, you can see here that we have our two connections
still ongoing up there, this time ID four and five.
And you can see that I have a command, which will be in the box below as well.
Sessions dash dash S, multi console command.
So we're telling MSF console that we're about to run multiple commands inside the actual
command console of MSF console.
And the dash R is going to point to where the actual script file is for the automation
script that we want to run.
In this case, collection.
And when we run this, now that I zoom out and pop back in, we can see that it's going
to run this collection script against every active session within our MSF console session.
Now, once this runs, you can see that we have right here the screenshot.
So we should be able to go back in here.
Yep.
So this file right here, I'm going to double click it and open it up.
And that is the screenshot for our Windows 10 system running dummy in the background.
And I can prove it even further because there's the actual VM right there.
Now I'm going to close this here real quick and you can see that inside of here, we'll
look at the Windows one real quick and I'm going to highlight the first line from it
right there.
And you could see that we get the basic command info back to us in response.
So it went through and we started running everything.
Basically, the first command was the get system info and we are running this against the Windows
one.
So we got desktop, yada yada, Windows 10, x64, workgroup, logged on users 2, and then
the meetup reader connection that we're using, x64, Windows.
And then the get UID, it tells us that server name is blah, blah, blah, slash learner, the
logged in user.
And then we're running the command of gather check VM.
That's that post exploitation command that we're introducing ourselves to.
And you notice here it says, yes, this is a Hyper-V virtual machine running on a physical
host, host VM.
Well, now we have a new target, right?
Unless it's outside the scope of our rules of engagement.
Keep that in mind too.
And then right below it, you say this is a Hyper-V virtual machine, yada yada, running
command screenshot.
And it tells you where it's actually putting the screenshot at.
And yes, we did get all that information from the Linux as well.
As a matter of fact, I'm going to put it right here and then zoom in for us real quick.
Oops, my bad.
You'll also notice that there is the fact that it wasn't able to get the screenshot.
That's that last line because it's not supported for Linux and meterpreter.
But we did get a bunch of other information about the system, like system info, get UID.
But you'll notice too, that if it appears to be a physical machine running screenshot
or appears to be a physical machine, I know running screenshot, I kind of just kept reading.
So why does this appear to be a physical machine?
Well, that's primarily because this is a Ubuntu and not native to something like Hyper-V.
So it's not always accurate.
It's just sometimes accurate.
There are other exploitations that we could run against this particular system in post
exploitation phase, where we can get more information pertaining to that until this
is actually accurate or not.
This is just a guesstimate at this point.
And that right there is the basics of automation inside of Metasploit.
Is there a lot more that we can do?
Yes, absolutely.
But I just wanted to give you the basics here because in the two areas that we showed automation,
I'm sure that we'll be able to figure out as we continue how to be able to plug into
play into those different automated commands and use some of the things that we've learned
throughout the rest of this course and previously to plug into those areas as well, too.