Hello everyone. In this video. We're going to be taking a
look at persistence with Metasploit. Now, when
we talk about exploitation more specifically post exploitation, one
of the most important things you can do, as a penetration tester is
setup assistance, so that you can maintain access on
your target. Now. Let me just give you a simple example. Let's
say we exploit the the Eternal
blue vulnerability and we get access to a Target on
a network. And again, we want
to have continuous access to this.
Doggett for the next two weeks, but we don't set
up assistance. Instead. We keep using the Eternal blue module
with Metasploit to gain access. When
we come back two weeks later we
can again, we we can take a simple example. Let's
say the the, the, that particular Windows
machine or Windows computer has been patched
or has been updated. And that particular machine
is not vulnerable to the Eternal blue exploit anymore.
Well, how do we get access then? Well,
this
Is where persistence comes into play. Persistence is the process of
setting up in a persistent access on the
system so that you can you constantly have access and you do not
need to keep on exploiting the vulnerability to gain access.
Now this comes into play especially when talking
about Setia when talking about meterpreter sessions. And
again to do this we're going to be using the persistence module
with Metasploit. Now the scenario or the
environment we're going to be using for this particular video is
our dog. It is going to be the Windows 7 virtual machine.
And I already have a meterpreter session running here.
And the way I was able to achieve this is through
the Eternal blue vulnerability as we've done before. So if
I say sis info, I just want to again just
show you that we are running Windows 7. So there we are. So the
first thing we want to do is we want to background the session, right? So
background and now that that is in the background,
we can list these the sessions and you can see the ID session
3. And we have that running the background. That's
excellent. So, the module we are going to be using, is a
exploitation module that requires an active session
on the Target that you want to set up the persistence on.
So we're going to search for persistence, right?
So going to say persistence and
we search for that and the one we're looking for is
going to be the this one
right over here. We are looking for VSS persistence or
we can also use the the
persistence service, right? So these are
these are all you
Can use any of these, but the one that I recommend the
most is going to be the exploit Windows
local persistence. And this is this
uses the windows persistent registry startup payload
installer. So what this does is it sets up the
it sets up the payload within
the registry so that every time the system reboots, we
will still get a session and all we need to do is
set up a an exploit multi Handler or a listener, and
we'll get a connection and we love continuous.
Access on the system without having to exploit any
particular vulnerability. So we'll use this one right
over here. We'll just copy this
right now. So we say copy and we're
going to say use I'm going to paste that in there
and we'll give that a few seconds by default.
It's telling us that no payload has been configured defaulting
to Windows meterpreter refers TCP. So
that is referring to the particular payload that
we want to set up in.
God's to persistence. In this case. This is perfectly fine
because our Target is running Windows and we do
want a meterpreter session and reverse DCPS fine. So
if I say show options and let's
take a look at the options here that we can provide, this
is going to be very very important. So the
options that we're going to take a look at are going
to be the following. So number one, we set the
delay time. So the delay in seconds for the persistent payload
to keep reconnecting back. So again a
after every 10 seconds, the payload is going to keep trying. It's
going to keep connecting back to us. And
again if we set up a listener, we should be able to get a session. We
then provide the exe name which should
be as clandestine as possible. So you should name it. Preferably
after one of these services on windows so
that it's easily masked and and no
one can really detect it. And then of course we
can provide the session which we know
is session 3, and that's pretty much it regarding.
Those options are now in regards to the payload. We
can all. Start setting up various options like the
listening the IP that
you want the connection or the persistent module or
payload to connect back to and the port. Now
if we take a look at the advanced option, so
show Advanced, right? What
we are going to be looking at changing is
because we can specify our own payload here. So,
We can set that but we can also go
about setting this or setting the payload by
setting payload as follow. So you can say set
payload and then we can say windows, which
is already set for us on meterpreter, reverse TCP. So
we can since we already have that
set up, we can say show options, right? And
weekends to change the airport because if
we take a look at our sessions here.
We can see that the session that we already have running is
listening on Port 4444. So we cannot
have two sessions listening on the same port. So we'll
set airport and we'll set that to something like
1 2, 3 4 and we hit enter, right? And
if we list this out now, just
sorry I don't do list. That only has a show options, one more
time just to make sure that that is set correctly. We now need to
set. The exe names are going to say set exe name
and we'll set that aside.
Something like SV C host, right?
And we hit enter and that will be the name of
the exe and what we'll do. Now, we
can also set up the startup type for
the persistent payload. We can set up a user or system. I'll
just leave it as user and we'll just hit run, right?
Yeah, we need to set the session. Sorry. So
session, set, session 3 and we
are going to hit run, right? And there
we are.
So, what's going to happen is, you can see it's going to run the persistent
module against the target with session 3. So
note the current user search system and startup equals
user. This may not login often, so
we can also set it up as system. So the persistent VBS
script, is written under the temp directory.
And again, it's going to install it into
the registry as you can see. And it's
going to install the autorun so that it runs on Startup
right over here and it's going to clean up the
mess.
Ra Darcy file. All right. So now that we've
set up assistance. What we can do is we can use the exploit multi
Handler. So we'll say, what I'll do.
Is I'll open up a new Metasploit console session. Of course, I
can use the same one. I think we should actually do that. They'll be
much easier. So I'll just say I use exploit and
we'll say multi Handler, right?
And will say set payload. We need to set
the payload to Windows meterpreter.
Reverse TCP show
options and we're going to set the
L host to our IP. So 10.0.0.0 .5
and we set the port to what we
had set for the persistent module. So
settle Port 2 1, 2 3 4 and we
had to run, right? So we're going to it's going to set up the listener
on our IP on Port 1, 2,
3 4, and because we already have the persistent
payload.
Up, what we need to do now is we can just
restart the Windows 7 VM. So I'm just going to go into Windows 7
here and we're going to say restart. So, again,
just pay attention to what's that. What happens? Now, that the
windows VM is being restarted and I'll
just keep the box right over here. So you
can see it starting up Windows, and it
should give us a meterpreter session. Now whenever the system restarts
and after, or if we
do not, if we are not listening for it, actively the
the payload will keep on trying to reconnect after every
10 seconds. So, again, I'll just open up Kelly
right over here. So you can see, it's still telling
us that the meterpreter session died, which is fine. What
we can do is just hit run again, because remember it's going
to try and connect after every 10 seconds. So
again, we'll just let that, we'll just let that listen. And
after every 10 seconds, we should get a connection back
and we should be able to get a meterpreter session. So
again, we'll just let this wait.
All right. So as you can see after
a few seconds, we get a meterpreter session.
And again if we take a look at the windows a
VM, it's just restarted now and we
get a meterpreter session on after every 10 seconds is
going to keep reconnecting. So again, for some reason,
it's closed. So we'll just try
and list for trying to perform some commands. Here.
You can see, it's still working. But if I exit right?
And I just run the Handler one more time.
You can see that after every 10 seconds. It will reconnect
back. And we'll, we have setup assistance on
the Target. And there we are. You can see after
every 10 seconds. We get a new session. If we are not, if
we don't have one already. And again, if I just put
this in the background you can see that we
have the session right over here. And of course, after
running the, the persistence on module
on our on our earlier session, that session
is going to be closed, primarily because we have restored.
Did the the system. So again, now that we
have persistence a persistent access, we can say sessions
six and I just go back
into that and you can see that's working. Now, the cool thing
with this is why exit out of Metasploit entirely. I
can start up - wait one more time and I'll just show you that I
do not have to run any particular exploit. All I
need to do is set up the the exploit multi Handler and
I should be able to get a connection back regardless
of whether the the system has been restarted.
Or anything like that. So that's
one of the advantages of setting up assistance. So
I'll say use exploit will
say, exploit multi hander and a multi Handler. Like
so set the payload to Windows.
Meterpreter. Sorry.
We say reverse TCP, right? And
sorry that looks like an issue their
Windows meterpreter. Yet. There's a spelling mistake.
So meterpreter and
one more time. Let me just correct that there we
are. All ready to show options and we set
the L host.
And I can set this to ethernet 0 or my IP
address. And then I say set L Port 2,
1, 2, 3, 4. And we hit run, right? And we'll
we set up the listener now. And again, after a
certain period of time or after after
the amount, the duration that we had set, we get amateur
procedure meterpreter session and there we are. So we
don't have to even run any or even exploit any vulnerabilities
and there you go. So that's pretty much going to be it
for this video and I'll be seeing you in the next video.
Video.