In this demonstration,
we will use Starkiller to obtain a persistent agent using a WMI attack.
As we revisit the diagram, we will be focusing on the Helpdesk user.
Since we have already established a persistent agent on the Helpdesk machine,
we're going to solidify our persistent foothold by increasing the number
of attack vectors deployed on the startup machine.
To perform the WMI attack, we will do this within Starkiller.
Starkiller gives you the ability to perform all the
functions of PowerShell Empire, but using a graphical interface.
When you start Starkiller,
you will be presented with a screen as you see currently.
I've already set up a listener,
and I have renamed the agents that are reporting in so
that they are more easily identifiable.
In the previous demo, we looked at the Helpdesk PC,
and we have established an elevated agent.
We're going to use that same elevated agent to perform the WMI attack.
I'm going to click on the agent, which will allow me to interact with it.
Here I've got the ability to issue any type of command or execute the module.
If I click on View, it gives me the ability to view information such as the ID,
any type of integrity levels, and a bit more.
However,
the output here is not as populated as if you would run
the sysinfo command on the agent.
I'll switch back to the interaction page.
And under Execute Module, I have a drop‑down box,
which gives me the ability to browse all the various modules that are currently
loaded within PowerShell Empire that I can use on the box.
Now I can scroll through the list and search for persistence.
However,
I would like to make my life a little bit easier and
just simply type in persistence,
and this will give me all of the persistence modules that are available.
Now the one we're going to use is listed under the PowerShell,
persistence, elevated, and WMI.
Once I click on the module, I have some options that I can configure,
the first one being the listener that will be used to establish the connection.
I will select my current listener.
I can define a name for the WMI entry and any optional fields.
A good field to use is the AtStartup field.
When I set this field to the value of true,
essentially what happens is as soon as the machine starts up,
a connection will be established back to my attacking machine.
This is a good way to obtain persistence when a machine is rebooted.
The rest of the options I will leave as the defaults,
and I will go ahead and click on Submit.
As soon as I clicked on Submit,
Starkiller pipes the command back to PowerShell Empire,
which ultimately sends it across to the target machine.
After a couple of minutes,
you will get a response back that says the WMI persistence has
been established to the listener that we have defined with the
onstartup subscription trigger.
Now that we have the WMI subscription configured,
I'm going to go ahead and trigger the WMI event.
This will then trigger a connection back to my Kali machine,
and a new agent will be established.
We now have the new agent that has been established.
Let's take a look at this agent's properties.
You'll notice that this agent has been established under the system context.
This ultimately gives us the highest permissions on that box.