Post-exploitation, command-and-control and SOCKS proxying with Metasploit

Using the open-source Metasploit Framework for post-exploitation activities including endpoint enumeration, privilege escalation, and network pivoting/proxying.

What post-exploitation is, and how the Meterpreter’s powerful features can aid penetration testers and ethical hackers in the post-exploitation phases of a penetration test.

How to use the powerful Meterpreter payload to establish command-and-control and convert a compromised Windows target into a “dumb pipe/router”.

In this lab, students will apply the concepts called “Post-Exploitation, Command-and-Control, and SOCKS proxying with Metasploit” and perform the following tasks- We will create Windows malware using msfvenom- Host the malware using Metasploit’s “web_delivery” module and pythons “http.server” module.- Execute the malware on our Windows target to establish a reverse shell- Upgrade our basic reverse shell to the versatile Meterpreter payload- Use process migration to move to a more stable process that isn’t likely to be closed by the victim.- Use the Meterpreter to load additional functionality- Investigate privilege escalation opportunities- Harvest credentials via dumping the local Security Account Manager (SAM) to retrieve password representations (hashes)- Capture keystrokes to collect passwords- Take screenshots- Upload and download files- Modify malware metadata to fool investigators- Enabling wdigest- Load the Mimikatz “kiwi” meterpreter extension and capture credentials- Clear event logs