Cortana Tutorial - Armitage

Interacting with a Meterpreter Session
Meterpreter is a powerful post-­‐exploitation agent that runs on a compromised host. It has
the most capabilities and the best support from Cortana. Windows Meterpreter is the most
feature-­‐complete of all Meterpreter implementations. Java Meterpreter is a close second.
Meterpreter implementations also exist for Linux and PHP.
Meterpreter sessions do not have the concept of a lock. The team server multiplexes
meterpreter commands for you. Multiple humans and scripts may interact with a
meterpreter session at the same time. This is an exciting technology as no "time on target"
is wasted when human and automated actors may work at the same time.
Both Meterpreter and shell sessions fire a session_open event. Meterpreter sessions also
fire a session_sync event when they're ready for interaction.
Meterpreter Commands
To issue a meterpreter command, use the &m_cmd function. This function works much like
its Meteasploit console equivalent, &cmd. The main difference is that you offer a session
number to the &m_cmd function.
m_cmd(1, "idletime");
Meterpreter commands fire an event when they complete. This idletime example will fire
meterpreter_idletime and meterpreter events. The meterpreter_command event form
allows you to declare listeners that are more specific to your situation.
on meterpreter_idletime {
# $1 = session identifier
# $2 = the command sent and its arguments
# $3 = the output.
println("User on session $1 was idle for: $3");
}
Remember though, that scripts do not have exclusive access to a Meterpreter session. To
protect the interests of other scripts and actors using the session, some commands may
timeout. Commands timeout after 10-­‐20 seconds. When this happens a
meterpreter_timeout event fires to the script that called &m_cmd.
Parsing Meterpreter Output
Through meterpreter you have access to a wealth of information about a compromised
host. One challenge though is parsing this information. Meterpreter results are returned as
one long string that you must parse. To aid this, Cortana offers several functions to parse
the output of Meterpreter commands and turn this output into Sleep data structures, which
are easier to work with.
These functions are &parse_hashdump, &parse_ls, &parse_ps, &parse_route, and
&parse_timestomp. The arguments you must pass to these functions vary.
19