Instructor: Welcome back
and in this video I want to talk
about something called persistence.
And what is persistence?
Well, persistence is a module that allows us to stay
on the target machine even
after the target machine gets rebooted.
So it is essentially adding our payload
to the start folders where it'll automatically
get started as soon as the target system gets restarted.
It is a part of maintaining access.
So this is one of the things that we want to do as soon
as we get on the target machine.
So what I did right here is I established a
a interpreter session with the target machine.
I used this module to bypass UAC
and get system privileges on my Windows 10 virtual machine.
And the reason why I'm testing this
on a virtual machine is because
in this video I will have to restart this machine to see
whether the persistence is working
and how I transferred this shell.exe to the Windows 10.
Well, I use the cool way
of transferring it using the Apache 2 web server.
And to do that you can simply just type system CTL
and then start and then type Apache two.
This will ask you for your password.
Input it right here
and this will start the Apache 2 web server.
Now what you can do is you can open
up Internet Explorer on the target machine and type
in the IP address of your Cal Linux, which will lead you
to the web page of our Cal Linux machine.
Now you will not see this shell.exe right there.
It is there because I put the payload inside
of the web server directory.
And to do that inside your Cal Linux
after you create the payload, you can navigate
to the slash bar slash www
and slash html directory where you should have
two files called index and then dot something.
You can delete those files and you can copy your payload
to this HTML directory right here.
Then if you go to your Windows 10 machine, refresh the page
you will have your shell.exe available to download
on your Windows 10 machine.
Just make sure that you disable the Windows Defender
on your Windows 10 machine
because we are using a regular Meterpreter reverse TCP shell
and it gets detected by Windows Defender.
So after you do all of that and establish the connection
you can then gain system privileges
and we already know how to do that.
We simply just test bunch
of those modules that are used to bypass USC
and then we become the system level account.
Once you do all of that
it is time to run the persistence module.
So how can we do that?
Well, first of all
I will background this session and if we type sessions
you can see I have two sessions available.
The one is on the regular user account and one is
that I elevated, which is this system level account.
So what they want to do to run the persistence
is I can type this search persistence
inside of my Meterpreter framework.
This will output me with bunch of different modules
and the one that we are going to cover
in this video is going to be this one right here
exploit Windows Local and then Persistence Service.
If I copy the module name
go down here and type use paste the module, press Enter
it'll set my payload to Windows Reverse TCP
and if I type show info here
we can see that this module will generate
and upload and executable to our remote host.
Next, it'll make a persistent service.
It'll create a new service which will start the
payload whenever the service is running.
Admin or system privilege is required
for this module to run.
That is why we created a second session
with the system privileges.
So what we need to specify right here if I show options
is we need to set the session
and here we are going to set the session
with the system level account.
In my case, I believe it is session two, that is correct.
And right here we want to set our payload options.
Of course, if you want to
you can set these other options as well
such as retry time and retry time is simply just
the time that Shell will retry to connect to.
If the connection fails, five seconds is default.
Now we can set that to be, for example, 10 seconds.
It doesn't have to be five.
That would be too quick.
And after we do all of that, we can run this module
press run, and this will open the session three.
If I type get user id, we will be the system level account.
But what is special about the session is that it'll
automatically connect back to us even after the
target machine is rebooted.
So the target won't need to run this, shell.exe.
After the system is restarted, it'll automatically connect
back to us again because we run this persistence module.
Let me show you what they mean.
If in my interpreter session I run the reboot comment
press Enter, this will start restarting the Windows
10 machine.
All of the other sessions will die out because
the connection has been closed.
If I control see this exit out of this type sessions
we will have no active sessions anymore.
So what we can do right now is we can type use
exploit multi handler, set the correct payload
and inside of the show options, we want to set
the correct options that we used inside of our
persistence module.
And that is the Port 4444 and the IP address
of our Cal Linux machine.
So all I need to do right now is type run
and here we get the session open because this machine
hasn't yet shut down.
So we're just going to close this because this is not the
session that we wanted to, and I'm going to manually exit
out this machine and go and start it once again.
Now that the machine is getting started up
I will run our listener and if everything worked correctly
we should get a interpreter session opened as soon
as the machine puts up without a target having to
do anything but start their machine.
So let's see whether it'll work.
The machine is currently starting up
and let's give it a few seconds and here it is.
Our Meterpreter session five opened on its own and notice
that it didn't even log in to the user yet.
And the best part about this is that if I type get user id
I will already be system level account so I
don't have to go through the privileges escalation process
again, this interpreter session opened without
anyone clicking on anything
and that is the good part about persistence.
Now, even if the target shut down this PC once
again and started it in a week or two
our persistence will still work and our payload
will automatically connect back to our Cal Linux machine
if the IP address of the Cal Linux machine
hasn't changed of course, one more thing to keep
in mind is that sometimes persistence can be buggy
so it knows not to work sometimes
but in most cases it should work, and if it doesn't
there are other modules for persistence as well.
If a type background and search persistence
I used this module right here
but you can see there are other modules as well.
You can check them out if you want to.
Maybe they will work better.
Maybe they will suit your needs more
but whichever one you find to work, just use it
and you will maintain access on the target system.
Great. Now that we covered persistence
in the next video we're going to cover the usage
of post exploitation modules and a few more
useful commands that we can do after exploiting the target.
See you in the next video.