In this demonstration,
we're going to look at the power of Meterpreter persistence.
So you see here we've got our Meterpreter shells already set up.
So we have our initial one, which, of course,
was our back door that we've been doing all along.
And then we have our second shell, which is the tokenmagic privilege escalation.
So now that we're in a privileged shell,
like anything else, we need system‑level access for this,
now we're ready to set up persistence.
Well, the nice thing is within Metasploit and within Meterpreter,
we have a module for persistence.
So if we do a search here for persistence,
we see we got lots of modules for persistence.
So the one we want to use is number 17 here,
exploit/windows/local/persistence_service.
We're going to go for the actual service.
So when we go use 17, that sets it up, windows/meterpreter/reverse_tcp,
so we're okay with that.
So now what we want to do is we want to look,
and always clear to get up to the top, remember our info.
So we read the info,
this module generates and uploads an executable to a remote host.
Yeah, sounds good.
And then it creates a new service, so that means once it creates the service,
any time this system's rebooted, it's going to connect back.
And you see the one option we have there that's required
is the session to run the module on.
Well, we're going to run the session on,
in our case,
we'll run it on 4 because we want to have the system level privilege.
So we go SESSION 4, show options.
Verify we've got it set.
We do.
Looks pretty good there.
It's got all the different stuff.
Now to do something a little bit different.
That four fours is never a good idea.
We've said that before.
So what we'll do is that's the LPORT,
so that's the local port on my attacker box that's
going to connect to me for the shell.
So I'm going to change that to 123.
I like using 123 because that's the Network Time Protocol.
Now we have our parameters set.
We'll clear the screen to get up to the top again,
and we're ready to set up our multihandler.
Once we set that, we set up the different things, and now we get the payload.
So now, we want to set up, because we're in persistence here, exploit.
And there's the key.
What it does is you've got Meterpreter session 5 opened there,
and then it writes it, as you see there with the persistence,
is a resource script.
So what that is, when you have a resource script,
and it's set up,
that means that resource script gives you the capability to look at
the entire sequence of commands that you use,
so you have to retype them.
So it's kind of nice.
And what you see here,
there is the Meterpreter service that's written to that WINDOWS\TEMP folder.
And that's a common place to write our code to to bypass because a
lot of times people don't look in the temp folder,
they should, but they don't always.
So now we'll go and background the session.
Clear the screen to get up to the top,
and now we're going to do our exploit multihandler.
So I'm going to use exploit/multi/handler.
Configured payload, we're good there.
Now we've got to set our LHOST.
And since we changed our port, we're going to have to also set our LPORT.
So we set our LPORT of 123, and then we exploit it.
Now it sits there, and now it's on port 123.
As a reminder, that's the Network Time Protocol.
The reason we like to do the Network Time Protocol is because time
synchronization takes place all around the network.
Now it should be the UDP protocol,
but some people make a mistake and still use the TCP protocol.
So we've actually set up TCP 123 here.
So we go over here to our exploit machine, and we're going to select Restart.
We'll just click here, and we restart.
Now while it's restarting, we come back over to Kali.
Now, you see that Meterpreter session 3 closed.
The reason it closed is because we restarted the machine.
So once we restarted the machine,
it removed any of the exploits that were already there,
and that's why we maintain persistence.
Because with persistence,
we want to have the capability to have it connect back to us,
and that's what persistence gives us.
So now we just wait for it to reboot and then establish persistence.
So you see what happened here.
As it restarts, it connects back to the multihandler.
So now we have established persistence, and now we have another shell.
So now what happens is until they go, they being the administrators,
and they discover this actual file that we've planted on their system,
we will have a permanent persistent back door.
And just to show you, once again, we do the sysinfo,
and we see we're on Windows 10, the domain,
the Meterpreter version is x86 because we didn't set up the 64‑bit,
and that's the process.
And now we've established persistence.
So anytime that machine reboots or anything,
it doesn't matter, it will connect back and give us a shell.
So that's the beauty of the attacks.
So now if I do Ctrl+Z and we go here, and we do sessions ‑l,
we now have three sessions.
We have the 4, we have the 5, and we have the 6,
and all three sessions are NT AUTHORITY\SYSTEM.
So we have all three sessions as privileged escalation.
It's pretty much this box is owned,
and there's not a whole lot left to do here unless you're given something else.
There's 4 died, 5 died, right?
But we still have 6.
So 4 and 5 were still in memory as the system was rebooting,
and now they're gone.
But when we do our sessions, I'll clear the screen to get at the top,
we do our sessions, we still have 6.
And 6 is our persistent system.
So now as long as we have 6 and we go sessions ‑i 6, we interact with 6.
And now, we can always try our Git system, but we're already system, right?
So we've already got the sky's the limit here because we do a hashdump.
This won't work because we need our 64‑bit shell again, but we covered that.
We run exploit suggester, we run tokenmagic,
and then we have our 64‑bit shell again.
Now if we would've made the persistent listener with a 64‑bit Meterpreter,
then we'd have this capability, but we covered the process,
and that's the main thing is to cover the process.
Now you can explore and do different types of things,
but now we've established using the persistence_services,
which is the module within Metasploit.
Now we've established the persistence.
And with that, we've accomplished what we set out to do in this demonstration,
and we'll conclude the demonstration here.