Metasploit Penetration Testing Cookbook - Third Edition

How to do it...

Before we move on to calling DLLs, let's first see what the essential steps to follow are in order to get the best out of Railgun:

1. Identify the function(s) you wish to call.
2. Locate the function on https://msdn.microsoft.com/en-us/library/aa383749(v=vs.85).aspx.
3. Check the library (DLL) in which the function is located (for example, kernel32.dll). The selected library function can be called client.railgun.dll_name. function_name(arg1, arg2, ...).
4. The Windows MSDN library can be used to identify useful DLLs and functions to call on the target machine.
5. Let's use the client.sys.config.sysinfo API call to gather information on the target:

>> client.sys.config.sysinfo=> {"Computer"=>"VAGRANT-2008R2", "OS"=>"Windows 2008 R2 (Build ...