How to use standalone meterpreter exe with a USB key connected to an unlocked victim session

Question

When I need to make a POC about why it is dangerous to let the session unlocked, I used to put a mimikatz on an USB key and get the logon credentials in clear text. But sometimes the client has no debug privilege so mimikatz cannot run.

But, when I use meterpreter (for example through psexec with a domain user creds (not privileged)), I can really easily obtain SYSTEM privilege by using the lazy getsystem command. So, I guess there are well automated privilege escalation exploits that I can use from my USB key locally plugged to the victim session (unlocked).

I have seen that it is easy to generate meterpreter instance with msfvenom, but all the possibilities I see are about reverse shell (aka shell over network: reverse_http, reverse_tcp, etc.).
For my problem I just need a standalone local executable: just put it on my USB key and execute it locally.

This sound easy but I don't see any example of how to do that. I guess I could create a local reverse shell and execute it on the victim PC and then connect to it from my machine but create a local meterpreter should be easier.

Answer 1

But, when I use meterpreter (for example through psexec with a domain user creds (not privileged)), I can really easily obtain SYSTEM privilege by using the lazy getsystem command.

I don't think this is generally true. meterpreter is not generally able to escalate privileges. Furthermore, priv esc depends on poor configuration and/or vulnerable software/drivers whatever. In a well protected Windows system you won't easily escalate privileges to local system. As far as I know getsystem only adds privilege tokens to the process but you already need to be member of the administrators group at that point.

As stated in the previous reply, meterpreter is just a powerful reverse shell that helps you do stuff on the target computer (i.e. load modules to perform a privilege escalation). if you're looking for something that automatically performs a privilege escalation in order to run mimikatz I doubt you will find that.

If you want to demonstrate that it is dangerous to leave desktops unlocked I suggest you demo a meterpreter or simple reverse shell and then you simply download upload files from/to the target computer (even though unprivileged you can access everything from the user running the meterpreter session). If that is not convincing enough then you probably waste your time...

Answer 2

I think you may misunderstand how meterpreter works (and maybe reverse shells in general). The whole purpose of a reverse shell is to connect to an attacking machine to provide remote access to that system, the tools built into meterpreter -including the ones that allow priv esc and mimikatz modules would require the same permissions whether across the network or locally. In other words, if you can do it in meterpreter with remote access you should be able to do it locally without meterpreter.

Based on your previous path (using PSexec to spawn a meterpreter session with non-privileged domain creds), it sounds like domain users have local admin on that box. In that case, just build a script that performs a PSexec with -S to spawn a SYSTEM shell on the local box and run mimikatz in PowerShell reflectively. For that matter, if you're just looking to demonstrate the risk of leaving a computer unlocked, there are a bunch of tools in the PowerSploit arsenal that can do some interesting things.

If the box you are targeting doesn't have PowerShell, just have mimikatz.exe on the USB and run it from there in your command window (again, can be scripted).