‫OK.
‫Let's persist, our Metasploit Framework session in the first example will see how to persist a maturity
‫session.
‫OK, I'm in Cali.
‫So first, I checked the IP address, it's two, two two.
‫Now, this is the first victim of Windows XP system, so check its IP address as well.
‫It's two zero seven.
‫So now back to Cali, let's have an interpreter session on the victims system.
‫First start the MSF console since we've already seen all this before.
‫I'll try and keep it as far as I can.
‫But remember, the more practice you get, the more you're able to learn.
‫From the previous lectures, we know that the system has MS 08 067 vulnerability, so well, the search
‫for now.
‫And here's the exploit, so let's use it.
‫I said the reverse TCP interpreter payload.
‫So the options.
‫Set the options remote host.
‫Listen, host.
‫Leave the ports with the default values and run the export.
‫OK, so now we have an interpreter session now, so this info to check the connection and the target.
‫Everything seems OK.
‫Interpreter has a persistence method.
‫So let's look at the help menu of the method first using the H parameter.
‫Now, the beginning of the help page, it says the method is deprecated, and it suggests to us to use
‫persistence.
‫ICSI post module so will use that module as well.
‫But first, I want to show you how to persist and interpreter session using the persistence interpreter
‫method because the persistency ICSI post module requires a malicious executable, whereas persistence
‫method creates the malware itself.
‫So let's create a valid persistence method.
‫First, we need to have a handler to be able to reply to the connection request that will be requested
‫by the victims systems.
‫Well, at this point, I guess I better explain what the handler is in the back door.
‫Use a payload with the reverse connection to let the victim connect to your system when the back door
‫binary is executed.
‫If you use a payload with a reverse connection, also known as a connect back you, the attacker have
‫to set up a handler.
‫We can also use a word listener first on your box.
‫The victim or target machine acts as a client connecting to that listener.
‫And then finally, you receive this session.
‫So in the persistence module, we can start a listener automatically using a parameter.
‫The L parameter is to define the location in the victim's system to put the backdoor binary file.
‫It's the temp folder by default, which is OK by me.
‫So you set the payload that will be used to connect to the victim.
‫It's interpreter's reverse TCP by default, which is the same with the payload we used while creating
‫a maturity session so we can leave it as is or let's just set it in this example.
‫X sets a start, age and automatically when the target system is booted.
‫I is to set the interval of the tries in seconds between the connection attempts.
‫I don't actually know the default, so let's set it, for example, 10 seconds.
‫Now, these are the most important parameters of the method.
‫Is to set the listen for I'll set it to five five five five and R is to set the listen host, which
‫is running the Metasploit and ready to listen for the connection requests.
‫And that's Michael 2-2-2.
‫Now we are ready to run the persistence method.
‫So hit enter.
‫And that's finished.
‫So let's look at the messages to see what happened.
‫So this method looks like it put the back door under the Windows Temp folder of the victims system,
‫and let's go to the victim's system and look at the temp folder, open in Windows Explorer and go to
‫the folder Windows Temp.
‫And here is the back door, it's a visual basic script file.
‫Now, I turn back to Cali to continue to look at the messages.
‫Now, the method has started the handler, which is required to listen for the request of the victims.
‫And lastly, it's installed a key into the registry, which will be used to auto run the back door when
‫the system boots.
‫So now go into the victims system and look at the registry to check if the auto run key is installed.
‫Now from the Start menu, click run type Reg Edit and hit Enter.
‫So now we're in the registry editor.
‫I'll follow the path written into the message.
‫Each HKEYLOCALMACHINE Software.
‫Microsoft Windows.
‫Current version.
‫Run.
‫And here it is, here's the initial key and its value direct to the installed back door fire.
‫And finally, the last message says that the method has created another interpreter session.
‫So I'll go back to the MSF console interface using the background function, list the sessions and jump
‫into the session that's created by the persistence method.
‫So let's just say that as the user of the victim machine, I decided to restart the computer.
‫Without the persistent step, we would lose them, interpret recession forever, and we would have to
‫exploit the system all over again.
‫But now we have run the persistence.
‫Let's see what happens when the victim system reboots, the victims system is shutting down.
‫Now, let's look at our maturity session.
‫Send a command system info, for instance, and as expected, it doesn't respond.
‫And yeah, there it is.
‫It says the session did control C back to the MSF console.
‫Now look at the active sessions using sessions L came in session.
‫One seems active, but it's not.
‫So try to interact with the session using Sessions AI Command run a command such as this info.
‫Now look at that.
‫You see that the session is already dead.
‫So use controls to drop back to MSFT console interface.
‫So we have no session at the moment.
‫So go to the victim machine and log in.
‫Well, do you know how to press, control, delete in a virtual machine?
‫In most cases, one of these buttons has a special meaning in the virtual environment, so you cannot
‫simply press the buttons instead.
‫You can find a menu item to send, control or delete to the VM.
‫In VMware Fusion, in the main menu, go to Virtual Machine and select Control Elite.
‫So back to Cali, as you see a new interpreter session is opened as soon as the victim is logged into
‫the system.
‫So now sessions el and here is the new maturity session Youth Sessions II to interact with the session,
‫send a command to check the connection.
‫And look at that, we now have a back door on the victim machine.
‫So let's try to log off and log on again to just to test the persistence.
‫So log off the victim.
‫And the maternity session dies.
‫Log in again.
‫Yet another session is created.
‫And if the system is in use and is attached to the network, we have a maturity session on it.
‫So I'd like to remind you once again that persistence might be out of the scope and your penetration
‫test.
‫Read the conditions of the agreement carefully and do not attempt to persist on any system unless you're
‫allowed to.
‫Very important to remember that.