At this point, we've already run our exploit and we have Notepad running on the Windows 10 system.
And you can see that as PID 2420 in this particular instance. Now, one of the things that we can do,
and I want to show this before we start getting too deep in the weeds as this course unfolds,
is that sometimes we make a connection to our targeted system using our reverse shell,
using the exploit like dummy, which is fantastic. But one of the things that this exploit will
allow us to do is be able to pivot on the file system and hook our session onto something else.
Now, you may be wondering, what? Well, so for instance, right, let's say we connect with dummy
and that's found out because the file doesn't match, you know, or there's a digital signature
on the file that may not be in existence because dummy doesn't have one. And one of the security
folks sees it and they terminate the process and therefore our connection is gone. See, we want to
hide under something that's a little bit more common. That's why we have Notepad opened up
right now. Now, this particular exploit and the current configuration of Windows 10 will not let
us elevate to admin rights. And I can show you that here real quick. We can actually go into
Meterpreter and we just simply do that by going into the session that we're wanting to access. In
this particular instance, I'm on session five and we can say, get a UID and you can see that I am
still Desktop Eric and that's okay. Sorry, the lab reset on me due to inactivity. But we're taking
a look here at session ID six and I'm going to go back over to the Windows 10 here real quick. You
see the Notepad that we have running that we sent, which is PID 2420 in this instance. I'm going to
go up and you can see that dummy is running at PID 3352 in this particular instance. Now, if I go
back over here and go into the actual Meterpreter again, and this time I'm just going to say
sessions six, since I had to reset you, I'll get my L and U this time, go in there and I'm going
to use the command to migrate. And what this is going to do is allow us to be able to migrate from
one process to another. Now, right now we're hooked on to dummy and even though this exploit's not
given us full admin rights, it does allow us to be able to migrate to it. So remember, my process
is 2420. Let's go ahead and go into migrate 2420 while I close that in the background.
You can see right there, and I'm going to zoom in for you and show you what it was,
migrating from 3352, which was that dummy to 2420 and it migrated completely or successfully.
And that's really good because if we go back over, we see that we have Notepad opened up
and we can also see now that dummy has disappeared. And this basically makes it to where now we're a
little bit more stealthy in our process of being able to post-exploit the actual targeted system.
So if a security administrator comes on the system and they're doing some browsing around,
the only way they would truly be able to tell for 100% certain is if, one of two ways, is if they
do a net stat and they're looking at all the traffic going back and forth from this one
particular system, or you're just making a lot of noise on the network and this particular system
and you get yourself caught because you're not wanting to be patient.
And that's happened to me more than I'd like to admit.