And this challenge we were asking if we can set up some post
exploitation or automated tasks inside of scripting for our connected sessions.
Now inside of our metasploit here I have the command pulled up for
sessions multi-console command and I'm running
eric-auto and I have that script inside the actual
folder on the desktop for you if you want to take a look at it. It's just two
commands ip ifconfig and netstat and when I run
this it's going to
run and then it's going to give us the ipconfig or ifconfig
along with concurrent connections. This is great information to know
when you're running post exploitation tasks
inside of metasploit against a target just like we got the system info earlier
along with understanding if it was or was not a virtual machine
inside of that hyper-v environment. This will tell you not only the scope
that you're on for that ip range with the subnet but
also concurrent connections to different devices that are out there
that may or may not be within the scope of our actual pen test.
Now if I come back over here you'll notice that I have a bunch of
gibberish on the screen. Well there's a reason for this
because everything that I just ran was also
captured inside of a log file and if you've taken any of my previous courses
you know I'm all about the logging. But while most of this looks normal as
I'm browsing through it because it's the same output that you saw
inside of the actual msf console you'll notice as I zoom in for us real
quick that there's some weird characters in
there and that's because those characters couldn't be translated over
to utf-8 standard and it puts up that little weird symbol
there in return. You'll notice that's also the command
line right there and it shows up more often than not because that's mostly
to do with the coloring inside of the terminal. But what I really
wanted to point out was the fact that what I'm doing right here is spooling
and whenever you go into an msf console and you type in the command spool
and then follow it up with whatever file name you want to add it in this
particular case I'm doing network-recon it will output
everything from there on out inside of msf console to that file that
you're spooling to. To simply get rid of it you just type
spool off and that's what we're going to do here
spool off and now spooling is now disabled.
So anything else that gets brought up inside that terminal window for msf
console no longer gets brought up inside of
that actual file. Now there's pros and cons to this. Pro is
that you're keeping a log file that you can always go back and check
that file and get previous data that you are coming up with.
Also commands below. One of the cons is is that like as you saw
in that actual file itself not that one inside the actual
text editor you can see that there's a bunch of those
boxes the gibberish boxes and you'll have to parse through that now
there is a way to parse through that and we'll we may cover that later but
right now spooling is just a very easy way for us to be able to keep track of
all of this information. Now normally you would run if you're
doing scripting and you're doing recon for msf console whenever a
like that windows 10 bwap system connects to us
we'll combine the first script that we've run inside of the skill
with the one that has all the network request information
that we use during the solution. Then not only do we get the network information
but we also get to compare uh pair it with the actual computer
system and naming convention and user. So that right there builds out the
actual target profile and tells us everything that we need to
along with let's say we have multiple systems out there
and we start seeing learner as our example user here
pop up on multiple systems so that'll tell us right away that that's a high
value target because learner has access or a need
to be able to get on multiple different systems out there whether it be
physically or remote remember this is just telling us who's
logged in at the time that we're actually scanning this system
could be a remote session could be local whatever the case may be
these are just some of the things you need to take into account
when we start doing our actual automation and remember automation
inside of metasploit is to make things easier for
common task if you're trying to automate something that's a little bit more
complex like a post exploitation module against a single target
might not be the best case use for it it's been my experience that
automation within betasploit is best served for being able to establish
multi-listers and have multi-information gathering along with
simplistic post-exploitation tasks to go inside of that script
just in case they're vulnerable to it or
it helps us spread different files and access to multiple types of systems
i hope this has been informative for you i'd like to thank you for viewing