Mubix USES Meterpreter
Mubix says the team deployed a Meterpreter session during the test.
Explicit Confidence 97% · Mubix EP 22 Details
“we dump a Meterpreter session on there”
Tool
tool:meterpreter
Also: meterpreter reverse-shell
Metasploit component or session used to remotely control a compromised computer and inspect or interact with it.
Metasploit component or session used to remotely control a compromised computer and inspect or interact with it.
“we dump a Meterpreter session on there”
“A Meterpreter session is sort of a super tool that lets you remotely control a computer.”
Metasploit session component used for remote access to a compromised workstation.
“The screen will say Meterpreter Session One [00:55:00] Open.”
Payload or remote-access component used in the described phishing exercise to provide access to a victim machine.
“it was a meterpreter reverse-shell that gave us access into their machine.”
“now we’d probably have to do a little more fancier footwork with meterpreter.”
Metasploit payload providing extensive post-exploitation capabilities, including process inspection, file transfer, privilege escalation, hash collection, screenshots, keylogging, and remote desktop access.
“At some point, Metasploit got a new feature called Meterpreter.”
“Meterpreter is a payload.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | reverse shell | Explicit | 69 |
| outgoing | DEVELOPED_BY | Matthew Miller | Explicit | 114 |
| outgoing | USES | Remote desktop access over VNC | Explicit | 114 |
| incoming | USES | Mubix | Explicit | 22 |
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | Metasploit | Explicit | 114 |
Mubix USES Meterpreter
Mubix says the team deployed a Meterpreter session during the test.
Explicit Confidence 97% · Mubix EP 22 Details
“we dump a Meterpreter session on there”
Tinker Secor USES Meterpreter
Tinker's payload opened multiple Meterpreter sessions on the finance computer.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“Then I see Meterpreter Session Two, Session Three, Session – it popped eight shells.”
Meterpreter USES reverse shell
The supposed PC cleaner was actually a Meterpreter reverse shell that provided remote access to the employee's machine.
Explicit Confidence 99% · Christopher Hadnagy EP 69 Details
“it was a meterpreter reverse-shell that gave us access into their machine”
Meterpreter DEVELOPED_BY Matthew Miller
HD identifies Matthew Miller, known as Skape, as the architect behind Meterpreter.
Explicit Confidence 99% · HD Moore EP 114 Details
“Meterpreter was the brainchild of Matthew Miller, Skape”
Metasploit USES Meterpreter
Meterpreter is presented as a payload integrated into Metasploit.
Explicit Confidence 99% · Jack Rhysider EP 114 Details
“At some point, Metasploit got a new feature called Meterpreter.”
Meterpreter USES Remote desktop access over VNC
Meterpreter could load a VNC desktop-sharing service in memory and provide immediate remote graphical access.
Explicit Confidence 99% · HD Moore EP 114 Details
“we had a way to load the VNC desktop-sharing service in memory as part of the payload itself”