So let's start the hands‑on parts of this module.
Let's take a look on how to create the backdoor
services and backdoor scheduled tasks,
so then your victim computer will automatically
connect back to you all the time.
The objective of creating a backdoor service or a scheduled
task is to make your victim computer automatically connect
back to your Meterpreter server.
By doing that, even if the survey restarts,
you automatically will get a callback from the victim
machine to your Meterpreter server.
And the idea here is creating a Meterpreter payload, or in other words,
a Meterpreter initial stager, and then we create a service or a scheduled
task that executes the Meterpreter payload that we created.
In this way,
the server will be constantly executing the payload
and connecting back to your server.
The thing to keep in mind is that it is really important to be stealthy here.
The main recommendation for you is to evaluate what is already installed on
this server, and then create something that is not suspicious.
For example, if you see that this server has a Microsoft SQL database,
you can create a scheduled task called Microsoft SQL
database cleaner, or something like that.
Try to be smart and create something that will not
look suspicious for demonstrators.
Also,
another thing to keep in mind is that the Meterpreter
payload might be detected by the anti‑virus.
So before transferring your initial stager to the machine,
you might want to use some code obfuscation techniques, and
test to see if you are detected or not.
Alright, now that we know the theory, it is time to go for the hands‑on part.
Let's go to our lab environment and see how to create backdoors. Again, in here,
we will cover how to create malicious services and malicious scheduled tasks.
Hey there! Welcome back to our lab environment.
As you can see,
I have here a Meterpreter session as an admin user. I created a
session using the Meterpreter executable payload.
But it doesn't matter how you got the session, as long as it's an admin session.
So let's get started.
Let's see how to create our first persistence.
And the idea here is that I will create a scheduled task that will run
every minute, and execute my Meterpreter reverse shell.
So first, I need a reverse shell executable to use in my scheduled tasks.
And in here, I will use the MSFVenom to create that.
There is nothing new in here.
It is basically the same command that we used before.
The only difference is that I'm using a different port,
and that's because we cannot have two sessions using the same
port. In here, I'm using the port 2121.
Perfect.
Now that we have our executable reverse shell,
we can go ahead and create this scheduled task.
For that,
I'll use a really cool Meterpreter module called scheduleme. To
run this module, I just type run, and then scheduleme, and I
will run this without any parameters.
So then, we can take a look at the help page.
Perfect.
Take a look.
There's a lot of options, and I will let you explore them on your own.
In here, I will focus on important parameters first.
So, let's use this module. I will type run scheduleme, and then ‑m to
specify the interval in minutes between the executions,
which in my case,
I want to run every 1 minute, and then I will use the option
‑e to specify the location of the executable file that I want
to add to the scheduled task.
And the cool thing is that I can put here a path for a file in my own computer.
The script will automatically upload executable file and
set everything up for me. And that's it.
That's all we need to create a scheduled task.
So let's run this.
Oh wait, take a look.
We got an error here saying that we don't have the right permissions.
And the thing is, even though we have administrator account,
we need the system privilege to add this scheduled task.
The system account has even more privileges than a
regular administrator account.
But don't worry.
Since we have the admin account, that's pretty easy to get.
Do you remember that getsystem command that we tried to
use in the escalation privileges? So, yes,
this command will be really useful here now. We can use this to
migrate from an admin user to the system user.
Take a look. Easy like that.
We migrated from an administrator account to the system account.
Now, let's try to run the same scheduleme command again. Done. There you go.
It worked.
And take a look. The Meterpreter created a scheduled task called
syscheck9, and it even gave us this command here, in case we want to
remove this scheduled task in the future.
But okay, since we have this scheduled task created, we are good to go.
Now, if for any reason you lose this Meterpreter shell,
you don't have to worry anymore.
This scheduled task will be creating a reverse shell to you every minute.
So to capture the reverse shell,
all we have to do now is to start to exploit multi‑handler, with the same
Windows x64 payload that we were using, and then set up the LPORT to the port
that we used to create the Meterpreter executable,
which was 2121.
All we have to do now is run this and wait for our
shell to come. Done. There we go.
We got our shell, and this shell is running as a system, which is awesome.
And the best part is, now, anytime we need the shell to that machine,
all we have to do is open an exploit listener.
Even if your victim computer restarts,
it will try to connect back to you all the time.
Pretty cool, right?
Now, let's say you've finished your pen test, and you
want to delete this scheduled task.
You can just open an operational system shell, and then use
that command the Meterpreter gave you. And easy like that,
the scheduled task is now deleted.
And also, take a look, the process that I was running is also killed.
So we lost the session that we were working. Now, I want to show you one
more technique to get persistence in the computer.
Instead of creating a scheduled task,
we can create a Windows service that will always connect to our computer.
So let's see how that's done.
Since I lost my Meterpreter shell because it deleted the scheduled task,
I will have to create a new one here,
and I will speed up this process, since you already know how to do that.
Perfect. Here we are, a Meterpreter shell with admin privileges.
Now to create a Windows service in the victim computer,
I will use a really cool feature called persistence. Just
to check the help page of this module, I will use run
persistence ‑h. Cool. Take a look.
There are not too many options,
so I will let you explore them on your own. And here, we
will focus on the important one for us.
So, let's create a service by typing run persistence,
then ‑P, to define the payload that we want to use,
which in my case, is the Windows x64 reverse shell,
then ‑S,
which is to specify that I want to create a service with system
privileges, then ‑i to specify the interval in seconds between the
connection attempts, which in my case,
I will use 30 seconds, and then the parameters to
define the properties of my server.
First,
I'll use ‑p to define the part that I want to use, and ‑r
to define the IP of my attacker machine.
And remember, in your case, this might be different.
So that's it.
This command looks really long,
but basically what it's doing is creating a reverse shell executable file, and
then creating a Windows service with this executable file.
So all we have to do is run this. Awesome! Take a look.
Although here we gave it some errors,
it was after creating the service, so I think we are fine.
The service is created. And to test this,
let's quit the session here, and then set up a listener on the port 2222,
which is the one that I used in the persistence module.
Now, let's run this and wait until we get a callback.
It shouldn't take more than 30 seconds.
Awesome! There you go.
Our session is now created, which is perfect.