‫So now is it time to persist on the Windows eight system?
‫As we've seen before, the persistence method of mature preter suggests to us to use post windows Manage
‫Persistence ICSI module.
‫Now we can use the module directly with the run command, as seen in the example in this regard, we
‫have to set the options in the command line.
‫So I prefer using the module with use command to be able to interrogate the options in detail.
‫So I'll use the background command to drop back to my F console interface.
‫And I use the use command to use the module.
‫Now, let's look at the options.
‫Our path is the option where we set the executable file, which will be used as the back door.
‫My pretty back door was under the output folder of the fat red.
‫So we need a session and we have one.
‫Let's list the sessions to see a tiny number.
‫The ID number of our session is one.
‫Start-Up option asks when to trigger the back door.
‫It can be triggered when the user system or service is started.
‫And as you see in the session, details, our session runs with this system privileges, so we'd better
‫use system for the start up option.
‫Now, let's look at the options once again, just to double check that we have them properly back doors,
‫OK?
‫Session is one aria sexy name is the name of our back door in the victim system.
‫I left it as default, but you can change it any way you want and start up is system great.
‫We are ready to run the module.
‫OK, let's see what happened.
‫So it says the back doors been written as default RDX under the temp folder.
‫So now I go to the victim to verify it, open the Windows Explorer.
‫Go to the temp folder under the Windows folder.
‫Default audio file is right here as expected.
‫OK, so now is it time to examine whether we are able to persist on the victim's system or not?
‫So I'll use sessions I command to interact with him, Interpreter says, info to check the connection
‫and the system.
‫Now, let's reboot the victims system using interpreters reboot command.
‫Now look at the Windows eight VM.
‫Yep, that's restart.
‫So now we're going to lose the interpreter session, and second.
‫But remember, from the first method, the back door will try to connect back to us.
‫So we need a listener also known as a handler, to listen to the connect back requests.
‫So I'll draw back to the MSF console interface using the back door command to create a handler.
‫So use exploit multi handler.
‫Payload has to be the same as a payload used in the back door, and remember, that is windows interpreter
‫reverse TCP.
‫OK, let's look at the options.
‫Set L host is Carly.
‫Delport was four three, two one in our back door.
‫Remember, the Old Port has to be the same as you used in back door.
‫So I start the handler using the exploit command.
‫OK.
‫So go back to Windows eight.
‫Yup, it's restarted and we're ready to log in now.
‫I log in to this system.
‫And back to Carly.
‫So we're supposed to have a session in second.
‫So wait for it.
‫Yes, the maturity session opened well for sessions are open.
‫So double check, triple check, quadruple check.
‫Ben, now we've got the answer.
‫We have a persistent back door on the Windows eight victim.