In this demonstration,
we will use the PowerBreach module within Empire to create a dead user attack.
This attack works by either creating the user account or
leveraging an existing user account.
The PowerBreach module then set up a task that looks for that specific user.
As long as that user exists, a reverse persistent shell will not be established.
However, as soon as the user is deleted,
a new persistent agent will then be established.
This is often seen in real world attacks where APT groups monitor
for specific high privileged user accounts,
and as soon as those accounts are deleted,
a persistent agent is then established back to the attackers.
As we revisit the diagram, in this attack,
we're going to make use of the IT administrators machine.
I have used the previous demos to establish an
elevated agent on the IT admins machine.
I'll get started by interacting with the administrators machine and the first
thing that I will do is query the existing user accounts.
I'm going to issue a shell command and I'm going to use the net user command
to see what user accounts currently exist on this machine.
One account that is of interest to me is the help desk user account.
The reason why it's interesting is because this
account could probably be a local admin.
Generally in organizations, they have a local administrator account,
which is using the same password across all the endpoints and this is a
real bad practice because this is an easy lateral movement path, but
this course is not about lateral movement.
Let's make use of that help desk user account and
use it for the PowerBreach deck.
I'm going to go ahead now and use the module persistence/powerbreach,
and under PowerBreach, we have the deaduser module.
Let's look at the options for this,
and you can see that we've got options such as the agent name,
the listener, the username, and of course,
if this was a domain account, you can specify the domain name.
Now there is a number of timeout options that you can modify,
such as the timeout,
and this equates to the time in seconds for the backdoor to run.
If you leave it at 0, it will, of course, run forever.
And then we've got the sleep timer.
Now I've already set the sleep timer to 5 seconds for the interest of the demo.
So I'm going to execute this module now and now the
module has completed successfully.
What I will now do is delete that help desk user account.
And as soon as I delete the account, once the sleep timer triggers,
we should get a new persistent agent established.
So I'll use the net user command sequence to delete the help desk user, and
before I could even confirm that the account has been deleted,
we now have a new persistent agent.
Let's confirm that the account really is deleted and now the
help desk user account no longer exists.
We'll switch back to our agents list and you can see now that the new
persistent agent has been established from the same administrator
machine and it is a high integrity agent.