Metasploit Penetration Testing Cookbook - Third Edition

How it works...

To list the available functions for the shell32.dll  DLL definition, type the following on the Meterpreter session:

meterpreter > irb[*] Starting IRB shell[*] The "client" variable holds the meterpreter client >> session.railgun.shell32.functions=> {"IsUserAnAdmin"=>#

<Rex::Post::Meterpreter::Extensions::Stdapi::Railgun::LibraryFunction:0x00560acbbe91d8 @return_type="BOOL", @params=[], @remote_name="IsUserAnAdmin", @calling_conv="stdcall">}>>

As you can see, now we have the IsUserAnAdmin function available.

So, let's call the IsUserAnAdmin function from shell32.dll and analyze the output:

>> client.railgun.shell32.IsUserAnAdmin=> {"GetLastError"=>0, "ErrorMessage"=>"The operation completed successfully.", "return"=>true}