The main reason we want to know this is for when we transfer that image, on a MS SQL server or Exchange server this may be several Gigabytes in size, especially since most modern servers come with 4GB as their minimum memory size.
Upload mdd.exe to the path of the %TEMP% variable of the process under witch the Meterpreter session in running.
The name will be a random generated number for obfuscation.
It will dump the memory with a name of a random generated number also for obfuscation and for avoiding collision of files when multiple exploits and instances of the script are ran on the target machine.
It will delete the mdd.exe on the target host.
Delete the memory image on the target host.
The default timeout for the execution and for the download of the file is of 5 minutes (300 seconds) this can be altered with the –t option and a value in seconds is given.
Once the image is downloaded it can be analyzed locally using Volatility Framework, more info about this can be found in the Pauldotcom wiki show notes for episode 142. I hope that you find this script useful and thanks to Mubix for having the mischievous idea that lead to the writing of this script.
gettelnet- This script will enable telnet service on the target machine if it is running Windows 2003 or higher, in the case of Windows Vista and Windows 2008 that do not have the service installed by default the script will install the service and configure it to start automatically, in addition a username and password can be provided so that a local account with administrative privelages can be created and placed in the apropiate groups.
remotewinenun - This script will run wmic command enumerating diferent settings from a target computer using the credential of the process under withc meterpreter is running under, a username and password can also be provided.