Instructor: So what we're going to do
is we're going to use our backdoor,
the normal HTTP reverse Meterpreter backdoor
that we created in the first video
when we created an undetectable backdoor.
We're gonna use that and inject that as a service
so that it runs every time
the target person runs their computer
and tries to connect back to us
every certain amount of time.
So to do this, first of all,
I'm just going to Control + C this
and then I'm going to background the current session.
So we've seen that before.
You can do background and I can still interact
with that session on number one
and I'm going to use a module.
So this is like the multihandler module
that comes with Metasploit
and it's called exploit/windows/local/persistence.
Then I'm gonna show its options
to see what we need to configure.
So you can see here,
we have similar options to what we've seen
with the Metasploit service.
Sot the first thing is the amount of seconds
that the target will try to connect back to us.
So the interval and I'm gonna keep that to 10 seconds
so every 10 seconds, the target computer
will try to connect back to me.
Now the EXE_NAME is the name
that'll show up under the processes
where the connection's coming back from.
So I'm gonna set that to browser
to make it less detectable.
So we're gonna set the EXE_NAME
to browser.exe
and then the path where the payload
or the backdoor will be installed,
I'll leave that the same.
I'll leave the REG_NAME, the registry entry the same.
Now this is very important.
You need to specify which session
to run this exploit on.
And as you can see now,
we were using session number one,
that's our Meterpreter session
and if I do sessions -l,
it'll list all the available sessions
and we can see that it's id number one.
So what we need to do is we need to set our session here
to number one.
So I'm gonna do set
SESSION to one.
Okay and the startup, we'll gonna leave it
for the user person,
for the user privileges.
Now, let's show the options.
So browser, and the session number one.
That's all good.
Now, we need to do one thing
which is the most important thing
is to specify the payload that will be injected
as a service.
So to do that,
we're going to do a show advanced
and we haven't seen this before
so every module has advanced options
that we didn't have a look on before.
So show advanced will show you advanced options
that you can set up for this particular module.
So when I run this,
you'll see, I'll get so much more options
and the one that we're interested in is this one
so it's called EXE: Custom
which means that we're going to use a customer EXE
to run and inject into the target computer
as a service.
So I'm gonna set my EXE:: Custom
to /var/www/html/backdoor.exe.
As you remember, I had that running on backdoor,
I had that stored in /var/www/html/backdoor.exe
so I'm gonna hit Enter
and I'm just gonna do show advanced again
to make sure that it was set up properly
'cause sometimes I misspell things
and it's /var/www/html/backdoor.exe.
So that's perfect.
Everything is good to go.
I'm gonna exploit this.
And that will upload /var/www/html/backdoor.exe
on the target computer using the session that we specified,
session number one.
As you can see now, it's been uploaded
and installed and one important thing
that you need to keep in mind is this resource file
'cause you can use this to clean up
and delete the backdoor once you're done
so if you don't want the backdoor anymore
on the target computer,
you can use this file to delete that backdoor
so I'm gonna store that in a Leafpad here
so that I can run it and delete my backdoor if I wanted
to delete it anytime in the future.
If I do sessions -l,
I still have my session here
and I can interact with it.
So what I'm going to do
is I'm actually gonna kill that session.
I'm gonna kill all my sessions.
And now if I list, I have no connections
with the target computer as you can see
and I'm going to go to use my exploit/multi/handler,
so I can listen for incoming connections
and everything is configured correctly already on this.
So I have my write port and my write IP.
Now, if I exploit this,
right now, I'll get a connection straightaway
because my backdoor has been injected
into the target computer on port 8080
on reverse HTTP but I'm not gonna do that now,
I'm actually gonna restart the target computer
just to show you that I'll always have connection now
with this computer.
So I'm just gonna do a normal restart.
So this computer will basically try to connect back
to me every 10 seconds.
No matter how many times they restart it,
they shut it down, every time this computer is running,
it'll try to connect back to me
in every 10 seconds.
So all I have to do is run my Meterpreter handler
and wait for connections.
Now, this connection's running as you can see.
It doesn't have to be at the startup
when I'm listening
and I'm just gonna do exploit to listen.
And it will take a maximum of 10 seconds
to get a connection back
and as you can see, I got a connection
to the target computer,
I go do sysinfo and run all the commands
that we learned so far
and have full access on that computer.