4 Steps Metasploit Meterpreter Search on Bactrack 5

Type : Tutorial

Level : Beginner, Medium, Advanced

Information leakage is one of the largest threats that corporations face and much of it can be prevented by educating users to properly secure their data. Users being users though, will frequently save data to their local workstations instead of on the corporate servers where there is greater control.(from: offensive-security.com)

Information leakage is the main topic in this latest year, starting from leaking secret document by Anonymous hacker, and then LulzSec leaking username and password, etc, even sometimes when you browsing to forum or some website, there are some user posting private image (usually xxx image) because maybe they successfully compromised another computer in their network and they try to leak the information to public, some people do that for money oriented(they sell it) or revenge.

Requirement :

1. Metasploit Framework

2. or you can download backtrack 5, there’s Metasploit Framework include inside this distro.

Step-By-Step:

1. First of all you should exploit my system and set up meterpreter as your payload. You can view my tutorials here and try to change the payload to meterpreter.

e.g : set payload windows/meterpreter/reverse_tcp.

2. Metasploit meterpreter has a search function that will, by default, scour all drives of the compromised computer looking for files of your choosing.

3. We can see from the help option, to find file with specific extension we use the -f parameter. To find JPEG file we can run with this command

e.g : search -f *.jpg

* is used for wildcard and match any case

Searching an entire computer can take a great deal of time and there is a chance that an observant user might notice their hard drive thrashing constantly.

4. We can use the -d option combined with -f option so it will notice a huge speed increase in the time it takes to complete.

e.g : search -d C:\\Documents\ and\ Settings\\me\\My\ Documents\\My\ Pictures\\ -f *.jpg

Hope you found it useful 🙂

Share this article if you found it was useful: