This report is to explain some key commands within Meterpreter that allow you to have some sort of situational awareness. That is, how to gain more insight into system information, the user you currently are and what processes are running among other things.

1. haydz | Security | April 26, 2015
Meterpreter and situational
awareness
AKA WHAT COMMANDS CAN I USE WITH METERPRETER

2. PAGE 1
Contents
Introduction...................................................................................................................................................2
Assumptions:..........................................................................................................................................2
Basics: What is Meterpreter .........................................................................................................................2
What does that mean? ..............................................................................................................................2
In Summary................................................................................................................................................3
Upon receiving a Meterpreter session:........................................................................................................3
We must therefore find the session that we wish to interact with: .................................................... 4
To access the Metepreter session”.......................................................................................................... 4
Situational awareness................................................................................................................................... 4
Some easy to use Meterpreter commands:............................................................................................ 4
Getuid..................................................................................................................................................... 4
sysinfo.................................................................................................................................................... 4
Cat...........................................................................................................................................................5
Pwd..........................................................................................................................................................5
But Meterpter is not a terminal access?..................................................................................................5
Back to situational awareness ..................................................................................................................... 6
We are currently running as the svchost.exe process in a temp directory......................................... 6
In summary ............................................................................................................................................... 6
Tokens, what is this about tokens ...............................................................................................................7
How do I find out what token I have?.....................................................................................................7
Getuid......................................................................................................................................................7
Incognito.................................................................................................................................................7
Incognito.................................................................................................................................................7
Use incognito.............................................................................................................................................7
List_token –u......................................................................................................................................... 8
Attempt to IMPERSONATE WITH incognito....................................................................................... 8
Impersonate_token ............................................................................................................................... 8
Conclusion .................................................................................................................................................... 9

3. PAGE 2
Introduction
This report is to explain some key commands within Meterpreter that allow you to have some sort
of situational awareness. That is, how to gain more insight into system information, the user you
currently are and what processes are running among other things.
Effectively this is a rehash of information already out there, it helps me learn it if I write about it
and hopefully it helps others to learn as well.
Assumptions:
I am taking the assumption that the reader has some prior knowledge/experience with the
Metasploit Framework in launching payloads and creating listeners, as well as basic information
security terminology.
Basics: What is Meterpreter
If you are into pentesting/hacking you may have heard of Meterpreter or have used it. But what
exactly is it.
Meterpreter in its most basic form is a shell/command line access tool. It may be in the form of a
reverse or bind shell, but with many amazing options. It is simple to use and hard to master.
The definition from Offensive Security:
WHAT DOES THAT MEAN?
A Payload:
 In computer security it refers to the part of an exploit/malware that performs the
malicious action. The data that is sent via the exploit. It performs the attacker’s
intentions, such as gaining system information or looking around directories.

4. PAGE 3
DLL injection:
 Running code within the address space of another process. Meterpreter runs inside
other processes such as svchost.exe or calc.exe
Staged:
 The initial Meterpreter session is created, but different modules/stages can be
added to allow different functionality as needed.
IN SUMMARY
So from that we can gather that Meterpreter is something we deliver via exploiting a vulnerability
and gain commands to execute via running inside a process that is already running on the victims
computer. Additionally, we can then add more functionality if needed.
Upon receiving a Meterpreter session:
Upon receiving a Meterpreter session, depending on how you have set up your Metasploit listen, it
may automatically jump into the Meterpreter session or it may not.
If it has not loaded the session automatically you will need to interactively open the sessions
It may look like the following:
The session has been created but is running as a background job.

5. PAGE 4
WE MUST THEREFORE FIND THE SESSION THAT WE WISH TO INTERACT WITH:
As we can see in the above when we type sessions, the Metasploit handler will list the sessions for
us. In this case session 1 has our win32 Meterpreter sessions.
TO ACCESS THE METEPRETER SESSION”
We simply type sessions –i and the session number
The –i flag is to interactive with the session number you provide.
Situational awareness
So we now have a session on our victim’s machine. Where to from here? Well before we try any
privilege escalation, let’s see who we are, where we are and all sorts of goodness.
Mudge is well known red teamer and has a great blog post regarding situational awareness post
here.
The idea of situation awareness is to understand what access you have, that is what you can and
cannot do. Can you add a user in order to access a box via rdesktop? Can you run executables in
order to dump passwords?
SOME EASY TO USE METERPRETER COMMANDS:
Getuid
 Will show the user you are active as
sysinfo
 Will print out system information, similar to an ipconfig command but with extra
information, including the Computer name

6. PAGE 5
Cat
 Will read a file
Pwd
 Will print the current directory you are working
Examples of using the commands:
BUT METERPTER IS NOT A TERMINAL ACCESS?
Well, it is but it isn’t. You can drop down into a typical shell to gain normal command line access.
Meterpreter lives within another process allowing you to drop the shell/command line access and
bring it up when needed, it allows more functionality.
To drop into a shell/command line access:

7. PAGE 6
Back to situational awareness
Meterpreter runs as a process, so what process am I? Here comes the getpid command
PID 1748, wow that’s helpful?? In order to understand the process we are running as we need to list
the processes that the current machine/session is running
We then need to run the PS command to list all processes running and find our Process ID.
WE ARE CURRENTLY RUNNING AS THE SVCHOST.EXE PROCESS IN A TEMP
DIRECTORY.
Based on the fact we are running in a temp directory we could assume most appropriately that we have very
little privileges, as it turn out on this machine we are running as an IWAM account. This account is a default
account with very little privilege created from an installation of IIS 5.1 or prior.
IN SUMMARY
We understand that we are most likely a low level user running out of a temp directory.
We understand the system information, the operating system and computer name.

8. PAGE 7
Tokens, what is this about tokens
In windows the simple idea is that each process and thread has a token associated with it. This is
just stating which user the process is associated with and if necessary which subset of the user’s
rights the process has. Therefore knowing which token you have allows you better insight into
understand your access.
For example a user token allows you to do things that a normal use has rights to, this may be to run
allowed programs but not download and install programs (if in an enterprise environment). A
system token allows one to have system access and allows complete control over the victim’s
machine.
As this report is about privilege escalation we are assuming you do not have a system token.
HOW DO I FIND OUT WHAT TOKEN I HAVE?
The two ways I know, are to use getuid and incognito.
Getuid
 Will simply list the username
Incognito
 Is extra functionality that allows an attacker to impersonate a user token, it
includes finding your current token.
Incognito
The aim is to impersonate a valid token on the system in order to gain more privileged access. The
aim is to impersonate a valid token on the system in order to gain more privileged access.
In order to use the functionality that incognito brings, we must load the module:
USE INCOGNITO
This will load the incognito module for us

9. PAGE 8
In order to attempt to steal tokens, we need to see if we have access to any tokens.
List_token –u
This will list all tokens by unique user name
From this, we are able to see IUSR_<uname> tokens. Which after googling is just a similar account
with similar limited privileges.
The Microsoft documentation regarding IIS accounts is here. Which tells us that:
“Internet Guest Account (IUSR_<computername>)
The Internet Guest account is used for anonymous access to management points.”
So we can see the tokens of a guest account which would appear not helpful at this time.
ATTEMPT TO IMPERSONATE WITH INCOGNITO
Impersonate_token
This command will attempt to impersonate the specified token, allowing us to hopefully execute
commands from then on with then access the token gives.
Meterpreter informs us that we were successful in impersonating the token. However if we use the
getuid command we can see that we are still using the ID of the same account. For an unknown
reason the success was reported incorrectly.

10. PAGE 9
I write up via Metasploit unleashed shows successfully impersonating a System token.
Conclusion
These are some fun techniques I have played with while being stuck as an IIS guest account.
The idea is to understand where you are and what you can do and then hopefully move laterally or
vertically to get to system access.