#beginner

Introduction to meterpreter

Meterpreter is a metasploit attack payload that provides an interactive shell from which an attacker can explore the target machine and execute code.

Meterpreter is deployed using in-memory DLL injection. As a result, it resides entirely in memory and writes nothing to disk. No new processes are created as it injects itself into the compromised process, from which it can migrate to other running processes. As a result, the forensic footprint of an attack is very limited.

Meterpreter basic commands [Part-1]

background

The background command will send the current meterpreter session to the background. To interact with the session again execute sessions -i <session-id>

download

The download command downloads a file from the remote machine.

edit

The edit command opens a file located on the target host using 'vim'.

getuid

Running getuid will display the user that the meterpreter server is running as on the host.

Queries & suggestions @Revnexbot

#beginner

Meterpreter basic commands [Part-2]

hashdump

The hashdump post module will dump the contents of the SAM database.

idletime

Running idletime will display the number of seconds that the user at the remote machine has been idle.

ipconfig

The ipconfig command displays the network interfaces and addresses on the remote machine.

migrate

Using the migrate post module, you can migrate to another process on the victim machine.

ps

The ps command displays a list of running processes on the target.

cd and pwd

The cd and pwd commands are used to change and display current working directly on the target host

webcam_list

The webcam_list command when run from the Meterpreter shell, will display currently available web cams on the target host.

webcam_snap

The webcam_snap command grabs a picture from a connected web cam on the target system, and saves it to disc.

clearev

The clearev command will clear the Application, System, and Security logs on a Windows system.

Queries & suggestions @Revnexbot

🟢 LIVE

[Machine-1: Blue]

IP: 10.10.142.9

Blue is now online. You can perform attacks & have fun. Read #rules before you start. Exploitation method of this machine is here for reference. Queries & suggestions @Revnexbot

Time: 4:00 pm - 5:00 pm

#beginners

Introduction to Reverse engineering

Reverse engineering, also called back engineering, is the process by which a man-made object is deconstructed to reveal its designs, architecture, code or to extract knowledge from the object; similar to scientific research, the only difference being that scientific research is about a natural phenomenon.

Machine codes

Computers execute machine code, which is encoded as bytes, to carry out tasks on a computer. Since different computers have different processors, the machine code executed on these computers is specific to the processor.

Queries & suggestions @Revnexbot

#beginners

Assembly and radare2

Machine code is usually represented by a more readable form of the code called assembly code. This machine code is usually produced by a compiler, which takes the source code of a file, and after going through some intermediate stages, produces machine code that can be executed by a computer.

The best way to actually start explaining assembly is by diving in. We’ll be using radare2 to do this - Radare2 (also known as r2) is a complete framework for reverse-engineering and analyzing binaries; composed of a set of small utilities that can be used together or independently from the command line.

Installation

sudo apt-get install -y radare2

Queries & suggestions @Revnexbot

#advanced

Binary file for practicing hands on reverse engineering.

Step 1. We run this file to see what it does.

Step 2. We use radare2 to reverse engineer the file to understand how it is programmed without actually knowing it's source code

#advanced

Reversing with radare2

[Step-1] Running the binary

Download run from here & execute

Command: ./run

After executing the above program, it shows that there are 3 variables (a, b, c) where c is the sum of a and b.

[Step-2] Open file in debug mode

Command: r2 -d ./run

This will open the binary in debugging mode.

[Step-3] Analyzing run

Once the binary is open, one of the first things to do is ask radare2 to analyze the program, and this can be done by typing in: aa

It analyses all symbols and entry points in the executable.

[Step-4] List all functions

Once the analysis is complete, you would want to know where to start analysing from - most programs have an entry point defined as main. To find list of all the functions run: afl

Command: afl | grep main

Here we're using grep to filter results containing main

Queries & suggestions @Revnexbot

#advanced

[Step-5] Print disassembly function

As seen from the output of Step-4, there actually is a function at main. Let’s examine the assembly code at main by running the command:

pdf @main

Where pdf means print disassembly function & doing so gives us the view shown above

The column to left of screenshot shown in green is actually the memory addresses & they may be different on your computer.

Now to understand rest of the output of pdf @main, we need to know some basic assembly instructions & we'll be doing the same in next few steps

Queries & suggestions @Revnexbot

#intermediate

Introduction to Assembly Language & Registers

An assembly language is a low level programming language designed for a specific type of processor. The core of assembly language involves using registers to do the following:

[1] Transfer data between memory and register, and vice versa

[2] Perform arithmetic operations on registers and data

[3] Transfer control to other parts of the program

The registers store data elements for processing without having to access the memory.

64 bit • %rax | %rbx | %rcx | %rdx | %rsi | %rdi | %rsp | %rbp

32 bit • %eax | %ebx | %ecx | %edx | %esi | %edi | %esp | %ebp

The first six registers are known as general purpose registers while %rsp and %rbp are special purpose and their meaning will be explained later on.

Queries & suggestions @Revnexbot

#intermediate

Opcodes & Assembly Instructions

Each assembly language statement is split into an opcode and an operand. The opcode is the instruction that is executed by the CPU and the operand is the data or memory location used to execute that instruction.

To move data using registers, the following instruction is used:

movq source, destination

This involves:

Transferring constants(which are prefixed using the $ operator) e.g. movq $3 rax would move the constant 3 to the register

Transferring values from a register e.g. movq %rax %rbx which involves moving value from rax to rbx

Transferring values from memory which is shown by putting registers inside brackets e.g. movq %rax (%rbx) which means move value stored in %rax to memory location represented by %rbx.

The last letter of the mov instruction represents the size of the data:

Data Type (size in bytes) Suffix

Byte (1) b • Word (2) w • Double Word (4) l • Quad Word (8) q • Single Precision (4) s • Double Precision (8) l

Queries @Revnexbot

#intermediate

Some Important Instructions in Assembly Language

[1] leaq source, destination

this instruction sets destination to the address denoted by the expression in source

[2] addq source, destination

destination = destination + source

[3] subq source, destination

destination = destination - source

[4] imulq source, destination

destination = destination * source

[5] salq source, destination

destination = destination << source where << is the left bit shifting operator

[6] sarq source, destination

destination = destination >> source where >> is the right bit shifting operator

[7] xorq source, destination

destination = destination XOR source

[8] andq source, destination

destination = destination & source

[9] orq source, destination

destination = destination | source

Queries & suggestions @Revnexbot

#advanced

Step-5 Walkthrough & explanation

Now that we know some basic assembly, let’s jump back to step-5 and walkthrough the code to see what the instructions mean when combined.

The line starting with sym.main indicates that we’re looking at the main function. The next 3 lines (box-1) are used to represent the variables stored in the function. The column (a) indicates that they are integers, column (b) specifies the name that radare2 uses to reference them and column (c) shows the actual memory location.

The next 3 instructions (box-2) are used to allocate space on the stack. This ensures that there’s enough room for variables to be allocated.

Queries & suggestions @Revnexbot

#advanced

Introduction to Breakpoints

A more efficient and practical way to analyse the program is to do so while it runs. And the best way to do this is using breakpoints.

A breakpoint specifies where the program should stop executing. This is useful as it allows us to look at the state of the program at that particular point.

[Step-6] Setting breakpoints

Now let’s set a breakpoint using the command

db address

In this case, we want to set breakpoint at mov dword [local_ch], 4 and the memory address corresponding to this instruction is 0x00400b55

db 0x00400b55

Now that we’ve set a breakpoint, let’s run the program using

dc

Running dc will execute the program until we hit the breakpoint.

Queries & suggestions @Revnexbot

10X Genie Timeline Home 10 License

License: here

Send screenshots @Revnexbot

#advanced

Instruction pointers & the little b

Command - pdf

Once we hit the breakpoint, we can use this command instead of pdf @main to directly print out the main function.

The rip (see box-1) which is the current instruction shows where execution has stopped. The little b marked as box-2 represents the breakpoint.

We know that the mov instruction is used to transfer values. The statement (box-3) is transferring the value 4 into the variable (local_ch). Note that currently the instruction pointer (rip) is just above the memory address we specified i.e. the code box-3 haven't executed and the value of the variable should be empty

Queries & suggestions @Revnexbot

#advanced

[Step-7] Printing contents of a variable

To view the contents of the variable (local_ch), we use the following instruction

px @memory-address

In this case, the corresponding memory address for local_ch will be rbp-0xc (from the first few lines of @pdf main)

This instruction prints the values of memory in hex

px @rbp-0xc

This shows that the variable currently doesn’t have anything stored in it - it’s just 0000 (row 1 - column 0).

Queries & suggestions @Revnexbot

#advanced

[Step-8] ds - step to next instruction

Let’s execute this instruction (i.e. mov dword [local_ch], 4) and go to the next one using the following command (which only goes to the next instruction)

ds

If we view the memory location after running this command, we get the above (screenshot) output

We can see that the first 2 bytes (row 1 - column 0) have the value 4.

Queries & suggestions @Revnexbot