Now,
let's discuss some other persistent techniques that are still really successful.
As I mentioned at the beginning of this module,
there's several other ways of creating backdoors.
Every year, cybersecurity researchers find new ways of creating persistence.
And every year, the defense tools get smarter.
As anything cybersecurity, what works today might not work tomorrow.
So,
it is your job to keep up to date with the latest persistent techniques
and use those techniques in your day‑to‑day pen testing.
However, there are a few techniques that almost already work.
We already discussed two of them, and I want to bring two more for you.
Probably the most basic way of creating persistence is
creating backdoor users in the target machines.
This is really known by system administrators,
so you have to be careful to not be detected.
My main suggestion for you is to analyze the current
environment and create a user that is not suspicious.
For example, if you see that the server has an Oracle Database installed,
you can then create an account called oracle.
In this way, the administrators would not suspect about it.
And even if they suspect,
they will be too afraid of deleting the account because
they think that something might break.
Another really interesting way of maintaining persistence
is infecting existing applications.
For example,
you can replace the Windows Notepad software by an
infected version of the software.
So then, every time the user opens the Notepad, it connects to your server.
So,
my recommendation in this case for you is to find existing
applications that are frequently used and then,
in fact, executable files with a Meterpreter payload.
Then again, every time that a specific file is executed,
you get a Meterpreter shell.
The thing to keep in mind here is that this technique is not fully stable.
For example, if the person updates their software,
the infected file will be replaced by a new one,
so you lose your backdoor.
Also,
because you have an infected file on the disk, it's more likely
that an anti‑virus solution might detect that.
So you have to find ways of disabling the anti‑virus or encoding
the payload in a way that cannot be detected.
So enough of talking.
Let's go to our next demo in which we'll create some additional backdoors
such as backdoor users and infecting legitimate software.
Welcome back to our lab environment.
In here, I already have a Meterpreter session with administrator privileges.
So,
what I want to do now is create a user in the victim computer so
I can log into the system at any time I want.
To create this user,
I could type all the comments manually in the operational system shell.
But instead, I will use Metasploit for that.
It'll be quicker and easier.
So, let's background this session,
and let's take a look at all the Windows post‑exploitation scripts.
And for that, I would just type use post/windows/manage/,
and then press tab twice.
In here,
I'll get a list of several interesting post exploitation modules. And
take a look, there's a lot of interesting stuff there,
but the one that I'm interested is this one here called add user,
so let's use it. Perfect! Let's take a quick look at the options
that we need to set up for this module.
It seems like quite a few things, so let's do this together. First,
since this machine I'm attacking is not part of a domain,
I will set the ADDTODOMAIN option to false. In this way, the
user will be created locally in the machine.
Also,
let me set here the password for the account that I will create, and
then let me set the Meterpreter session number,
which in my case, is 16.
But again, in your case,
it might be different. After that, outside the username of the account as
oracle since I want to pretend to be a legitimate service.
Perfect! Now let me just double check that we've got everything correct.
Nice.
It looks like we're good to go. And note here, they're
not setting up the variable group.
If my victim computer was part of a domain,
I could use this variable to automatically set the
user into the administrator group.
But as this will be a local user,
I'll have to manually add the user to the admin group later.
So, let's run this.
Oh, wait. Take a look. This script is complaining that my password doesn't
meet the password complexity of the victim computer,
and this one is a really common error.
So, let me quickly add the password variable to
something a little more complex. Done.
Let's rerun this. Perfect, it works now. To confirm that the user was
created, let me go to the Meterpreter shell and then open an
operational system shell. Perfect! And in here, let me list out the
local users using the command net users.
Then, take a look. Our oracle user is in there.
We can even get more information about these users by
typing net users and then oracle.
As you can see, this user is not part of the administrator group,
and what you want is a backdoor user with admin privileges.
So, let me quickly add this user to the group of administrators.
For that, I'll use the command net localgroup, and then
the name of the administrators group,
then the username I want to add, and then /add. Perfect! Let's just
run net users oracle again to make sure this worked.
Awesome.
Take a look.
Now, this user is part of the admin group,
and this means that even if our Meterpreter session dies and the
admins fully patch the server, you'll still be able to log into
the machine using this oracle user.
That's pretty cool, right?
Okay,
now let me show you one last technique for creating persistence in a system.
The idea here is replacing a legitimate software
with an infected executable file.
So then, every time the user opens a legitimate file, we'll get a reverse shell.
In other words,
we'll inject a Meterpreter payload into a legitimate executable file.
So, the first step is that we have to find a legitimate
software in the computer to infect.
The important thing to remember is that this should
be a software frequently used.
And also, since we're planning to inject a 64‑bit payload,
we have to find a software that is also 64‑bits.
And, I was looking at the sever earlier,
and I found a really common compression software called 7‑Zip.
And this is installing to the folder c, Program Files, and then 7‑Zip.
Before recording this demo, I analyzed the software,
and I found out that the main executable file is this one
here called 7zFM. This is the file that is executed when the
user opens the shortcut for 7‑Zip.
So, we have to inject some malicious code into this executable.
For that, let me first download this file to my attacker machine,
and then I will use the MSFvenom to inject a malicious payload into it.
And the MSFvenom command looks like this, msfvenom,
then ‑p, and the payload that we want to use.
And again, remember, if your legitimate software is 64‑bits,
then you have to use a 64‑bit payload. After that, we
set up the LHOST and LPORT variables.
And, we also use the flag ‑f to specify that we're dealing with an exe file.
And now, here's where the magic happens.
We use the option ‑x to specify the source
executable file that we want to inject.
And this is the file that we downloaded from the victim computer.
And the last option is ‑o to specify the output file.
And this file is the legitimate software with the malicious code injected
into it. My recommendation is to use the same file name,
but in a different directory.
So the output of your command doesn't interfere with your input
file. In here, I'm saving the file to my desktop,
and when I run this, MSFvenom will merge the legitimate software with a
Meterpreter reverse shell payload. Pretty easy, right? Now,
all we have to do is go back to the Meterpreter shell, ensure
that we're in the same 7‑Zip directory, and then upload the
malicious files using the upload command.
And this will replace the original 7‑Zip file with our malicious payloads.
And, easy like that, we have one more backdoor into the system. All we
have to do now is open an exploit/multi/handler listener, using the same
payload and the same LPORT that we use in the MSFvenom command. As we have
done this several times in the past, let me quickly do that. Done.
Now, we have to wait for the user to open 7‑Zip.
And when the user opens the 7‑Zip, look what happens.
See,
we've got a Meterpreter shell, and the shell runs with the same
permissions as the person that executed it, which is the admin. Really
interesting, right? Now you know at least four different ways of
implanting backdoors into your victim computer.
Amazing! This module was really interesting to understand how to create
backdoors in case we need to access our victims in the future.
But, before we go, let's take a moment to review what are we learning here?
First,
we discussed what are the main ways of establishing
persistence? We discussed which ones are more effective
and which ones are more stealthy.
Then, in our first demo,
you learned how to create backdoor services and backdoor
scheduled tasks. And this is my favorite way of
maintaining persistence on a target.
After that,
you learned how to create the backdoor user in a stealthy way and how to
infect the legitimate software to create persistence.
Pretty cool, right?
And again, if you're in a real‑life pen test project,
make sure you get a formal approval from your client
before creating any backdoors.
It is really important to have the scope well‑defined.
Perfect! If you enjoyed this module about persistence,
I'm sure you'll love the next one.
In there, we'll cover one really interesting part of an advanced pen test,
which is how to search and exfiltrate sensitive data.
In there,
you'll learn how to steal data from your victim without getting detected,
so I hope you're excited.
I'll see you there.