Cortana Tutorial - Armitage

on exec_dir {
# $3 now contains a big string representing all of the files on the system
if ("*secrets*" iswm $3) {
println("Session $1 may have secrets");
}
}
This function works on Windows and Linux systems. The process is spawned from the
current working directory in Meterpreter. Issue a cd command with &m_cd to change the
start directory of your process if you need to.
Tip: When there is a function to carry out a Meterpreter action, you should use
it. These functions often work-­‐around Meterpreter quirkiness in the
background to spare you a great deal of pain. For example, &m_cd examines the
path you provide and queues several cd commands to get meterpreter to the
right directory.
Example: Process Hunt and Destroy
This example regularly grabs a process list from all active Windows meterpreter sessions.
It looks for any processes that match a fixed wildcard. Any processes that match this string
are automatically killed.
The fixed wildcard in this example is *sol*. If a user opens Windows solitaire, this script
will automatically kill it.
global('$suppress');
$suppress = "*sol*";
This script sends a ps command to all open Windows meterpreter sessions every 15
seconds. This script uses the -isready predicate to make sure the meterpreter session is
ready for interaction.
on heartbeat_15s {
local('$sid');
foreach $sid (session_ids()) {
if (-iswinmeterpreter $sid && -isready $sid) {
m_cmd($sid, "ps");
}
}
}
When a meterpreter session responds with ps output, the meterpreter_ps event is fired.
This script takes advantage of the &parse_ps function to quickly parse the meterpreter
output into a Sleep data structure.
on meterpreter_ps {
local('@processes $process $name $pid $host');
@processes = parse_ps($3);
The &parse_ps function returns an array containing a dictionary for each process. Each
dictionary contains the keys name and pid that indicate the process name and identifier.
21