‫So let's try to use them interpreters persistence method in a Windows eight victim.
‫As you know, we need to have an interpreter session on the victim first.
‫So I'm going to use this exact module to get the session on my Windows eight.
‫Search exec.
‫Use exploit Windows SMB, P exec said payload windows metro operator Reverse TCP.
‫Now show the options and now the options are host as Windows eight L host as Carly.
‫Username of my Windows eight was admin and password hash was on the desktop.
‫Here, so I'll copy it and paste as the assembly passed.
‫Now leave the ports by default values and run the exploit.
‫There.
‫Now we have an interpreter session on the Windows eight system.
‫So we're insists info to check the system and the connection.
‫And here are the results.
‫So now let's run the persistence method with h first to see the parameters.
‫And now we're ready to prepare the command.
‫A to start handler automatically.
‫Now, I don't set the payload this time because the default payload is exactly what I want x to autostart
‫when the system boots.
‫And 10 seconds between each try.
‫Pay for the port, no.
‫I'll use the port six, six, six six this time.
‫And finally are for the listen host, which is calling for me to to to hit enter, to run the method.
‫And it's finished.
‫So let's look at the messages to see what happened.
‫It says the persistent script has been written to the temp folder under the Windows Fault.
‫So let's look at the victim machine and see if that's correct.
‫We'll go to the temp folder in Windows Explorer.
‫Oops!
‫Windows Defender detected the file, so to cross-check, I go to the temp folder to see whether the
‫script file is in there or not.
‫No, the script is not here.
‫It's detected by Windows Defender and deleted, so we should find another way to open a persistent back
‫door.
‫There's always more than one way.