Instructor: In all of the scenarios
and videos we done so far,
we would lose our connection to the target computer
as soon as the target person restarts their computer
because we used a normal backdoor.
Once they restart their computer,
our backdoor will be terminated,
the process will be terminated,
and we'll lose the connection.
In today's lecture, we're going to talk about methods
that will allow us to maintain our access
to the target computer
so that we can come back at any time
and regain our full control over that computer.
There's a number of methods to do that.
The first one is using Veil-Evasion.
We can use, instead of the normal backdoor,
the HTTP backdoor that we created.
You can use a HTTP service or a TCP service.
I'll actually show you here.
If I just run Veil-Evasion,
and do a list,
you see that we have, at number seven right here
and at number five,
we have service backdoors.
You can use any of them.
If I do use five,
and we can see the info,
all you have to do is just setup your lhost.
Put the lhost and then generate the backdoor.
Once you generate it, you can use it
and combine it with other stuff
and send it to the target person like we did,
or you can upload it
using the upload command that we learned,
and then execute it.
And that will install the backdoor as a service
on the target computer.
Then all you need to do is use the multi/handler,
and any time their target computer starts
it'll try to connect back to you
because this is a reverse shell.
Now, I'm not gonna be explaining this method
because this method is very simple.
We've done something very similar to it before.
We created a backdoor using Veil-Evasion
and we uploaded stuff to the target computer.
All you have to do is create a backdoor,
upload it, execute it, and you're done.
Also, it doesn't always work,
so that's why I'm not gonna be explaining it.
The normal backdoors are much more reliable
that's why I used a normal backdoor
when I was combining it with stuff
and changing its icon and all that.
The other method is to use
a module that come in with Meterpreter,
which is called Persistence.
Let me show you how you use that.
If you wanted to use that, all you need to do is do run,
and the name of the module is persistence,
so we're gonna type that down.
Then I'm gonna put minus H to see the help menu
to show me all the options that I can setup.
You can use the A to start a
multi/handler (mumbles).
You don't really need to do that.
You don't really need to change the location
where the backdoor will be installed.
The minus P option will specify the payload.
Again, windows/meterpreter/reverse_tcp
is a really good payload,
so you don't really need to mess with that.
S is to get it to start using system privileges.
Now, as you've seen before, we don't have system privileges,
we have normal user privileges.
So, what you should be using is minus U.
Then you can use the minus i to setup
the amount of time
that the backdoor will try to connect back to you.
It'll try to connect every 10 seconds,
or 20 seconds, or 15 seconds,
whatever you specify.
p to specify the port,
and r to specify your computer, the IP of your computer.
To run this, all you have to do is just do run
persistence,
use minus U to start it under user privileges.
I'd use the interval, I probably put it to 20 seconds.
It'll try to connect back to me every 20 seconds.
Then I use the minus p, and I'll probably put 80
because, as I said, the port 80 doesn't look suspicious.
The target person will see
that our connection's trying to come out at port 80,
which is cool, it's not really suspicious.
Then I'd use minus r to specify my IP,
which is 10.20.14.203.
Very simple.
Persistence is the module that you're gonna be using,
U to run it under user privileges,
i, the amount of seconds
for each time it tries to connect to you,
p to specify the port that you'll be listening on,
and r to specify your IP.
Now, obviously, once you run this,
if you want it to receive a connection,
you have to start multi/handler
on port 80 or on the selected port
and use in the selected payload.
The problem with this methods is that
it's detectable by antivirus programs.
Therefore, I'm not gonna be explaining (audio cuts off).
I'm gonna be explaining
is a combination of both of these methods
which will not be detectable by antiviruses
and it's much more robust
than the first method using Veil-Evasion.