Quick pivoting lession

UPDATE 2/9/2016:

I was never able to finish this, and I lost the screen captures from when I was accessing a set of VM's I used for this tutorial. I have since found a better tutorial then my own here:

https://highon.coffee/blog/ssh-meterpreter-pivoting-techniques/

Sorry about that!

So I have been playing around in the OSCP labs, and as you may have heard, pivoting into different boxes becomes key as you "unlock" different parts of the network. As someone who doesn't pivot too often (I experiment with/test applications and setups, pivoting is a more Red Team tactic) this became quite confusing after a while, so I did a brain dump for myself. I decided to also share it with you.

Lets begin:

So you need some sort of access to the box, in the example I have provided, I have escalated to system privileges, however I was able to pivot using the meterpreter "portfwd" command on a box I had low level privileges to. However, what I am about to show you may not work, I already had all the screen captures when that idea popped into my head.

First obtain reverse meterpreter, I did so using via HP Power Manager running on port 80:

Next assign the payload using "set payload windows/meterpreter/reverse_tcp" - A breakdown of this:

Windows - we are exploiting a windows box
Meterpreter - we have deployed a reverse shell using meterpreter
Reverse TCP - listening for a "callback" shell

There are so many options between slashes, for instance if you were to type windows/ then hit [TAB], metasploit would list all options you have under windows/, meterpreter being one of them. For every "shash" you can do this.

So anyway, once you have executed the exploit, we can move onto pivoting:

Quick Hindsight Run-through (browser forensics)

Review of Obsidian Forensics' "Hindsight" -

I was looking for a tool that would quickly produce "translated" browser search results; I know there are many tools that will export browsing history, and you can even import the users profile into your current version of chrome (or one from Portableapps.com). I wanted something quick that would dump the information I needed into an easy to read table, enter Hindsight.

Hindsight is a tool used for browser forensics, specifically targeting Google Chrome. With Hindsight having access to the machine the browser is located on is not necessary, if you have copied/saved the "Default" folder from within the users Chrome Profile you can point Hindsight at it.

Chrome Profile Locations:

Windows:
%LOCALAPPDATA%\Google\Chrome\User Data\

Mac:
~/Library/Application Support/Google/Chrome/

Linux:
~/.config/google-chrome/

To run a basic query on Hindsight, you can just run hindsight.exe from the command prompt and it will go after the current users profile. To target a specific user, you will need to use the -i switch:

Example:
hindsight.exe -i "C:\Users\[User Profile]\AppData\Local\Google\Chrome\User Data\Default"

It should produce something like this:

Once completed, it will dump a spreadsheet by default into the directory you ran Hindsight from. You can change the output with the -o switch (Choices: SQLite and JSON).

The spreadsheet has multiple categories, including time spent on the specific website! Here is a screenshot I pulled from one of my test profiles:

Hindsight will also include all cookies found; but keep in mind that Chrome recently began encrypting cookies, and without the users windows logon password you will not be able to view portions of the cookie. See here:

Here are cookies that are not encrypted:

However there are tools that are being built to get around this, I have not tried this one yet but I am not sure it will work with the newer versions of Chrome, as the older ones used one specific encryption instead of a unique, machine based key:

http://stackoverflow.com/questions/21496209/cookie-issue-with-chrome-33-beta

Hindsight download:

https://github.com/obsidianforensics/hindsight