Harvesting files from target systems

Using file sweeping capabilities in Metasploit is effortless. The post/windows/gather/enum_files post-exploitation module helps to automate file collection services. Let's see how we can use it:

Figure 10.21 – Sweeping files from the target using the enum_files module

We can see that we used the enum_files post-exploitation module. We used FILE_GLOBS as *.docx. However, we can also use it for multiple file formats such as *.docm OR *.pdf, which means that the search will occur on these two types of file formats. Next, we just set the session ID to 7, which is simply our session identifier. We can see that as soon as we ran the module, it collected all of the files found during the search and downloaded them automatically.

There are a ton of frameworks built on top of Metasploit that can aid AV evasion, and one such framework is Venom. In the next section, we will discuss how we can use Venom to reduce AV...