Hey there.
Welcome to the course, Persistence with Impacket.
In here,
you'll learn how to create a foothold on your target environment
so you can access it at any time you want.
So, imagine that.
Imagine that you're working as a red team specialist and
trying to compromise an environment.
We have in here some servers on the right side,
and they use their laptops that connect to those servers.
After some time, you're able to compromise one user laptop,
and from there you compromise some of the internal servers.
Pretty cool, right?
Now,
let's say that people in our target detected some of your actions
and they patched the vulnerability you exploited.
So, if you didn't create any type of persistence,
this would mean that you'd lose access to the whole environment.
But, if you learn about Impacket, right after exploiting the servers,
you'd create some persistence on the servers so you could access the
servers at any time you want, even if the target patches the servers. There
are several ways of creating persistence, and although you could do
everything manually, there are a few tools out there that can help you to
automate the creation of persistence.
My favorite one is Impacket. Impacket is a really known Python library that
allows you to interact with network packets and low‑level protocols. In
reality, Impacket can do much more than persistence. It can help you through
the whole red team engagement, but in here we'll focus on the features that
can help us to build persistence.
This too is maintained by the SecureAuth Corporation, but it has more than 115
contributors. By the amount of people in the team, you can imagine that this
tool is a really important tool in red teaming.
What I love about Impacket is that it's an open source tool, meaning that
you can download and use the tool as much as you want.
You can even create your own custom scripts based on it.
As I mentioned, Impacket is a Python library that allows you to interact with
network packets and several Microsoft protocols. For example,
you can create custom SMB packets with this tool, but in my opinion, the
beauty of this framework is the several out‑of‑the‑box scripts for
privilege escalation and persistence. As you'll see in the demos, they
already created for us several tools that you can simply execute from the
command line, and there are dozens of tools there, like the WMI Persist,
Wmiexec, Active Directory Recon tools, Minikatz in Python, SecretsDump,
and so on.
If you're familiar with the kill chain methodology,
we can use the Impacket from after the exploitation phase all the way to
the action phase, meaning that after exploiting a machine, we can use the
Impacket library to pretty much all the other steps, including escalating
privileges and creating persistence.
Also, if you're familiar with the MITRE ATT&CK framework,
we can map this course to two phases, the persistence and execution.
The main technique that we'll be focusing on in this course is the
T1546, called event triggered execution. In more specific, we'll be
executing this sub‑technique 003, which is Windows Management
Instrumentation event subscription.
And this sounds like a complicated name, but basically we'll create
a hidden task that executes every few seconds.
Also as a bonus,
I want to show you two more techniques that can be interesting, like the T1078
in which you collect several existing accounts in the server, so you can try
to use those accounts to log into your target.
And, we'll also discuss how to use Impacket to execute files via
WMI, or Windows Management Instrumentation.
As you can see, a lot of interesting stuff in here.
So, let's talk about the demo.
So for this demo, we will have two machines, one is the attacker
machine and one is the target machine. In here, we assume that you
have already compromised the server, which could be using a
vulnerability or a compromised account.
Once we have access to the server, we can then create persistence.
What we are doing here is creating a reverse shell payload and using
Impacket to transfer it to the target. Impacket will also create a
scheduled event that runs every few seconds, making sure the reverse
shell is being executed. Once we have the reverse shell payload
implanted into the server, even if you lose the original point of entry,
the server will still try to connect to your machine every few
seconds. In this way, all we have to do is open a listener and we
have a direct shell to the target.
Pretty cool, right? If you want to follow this demo on your own environment,
you need two things. First, you need an attacker machine. In here,
I'm using a Kali Linux version 2021.2 because it contains pretty much
everything we need for this demo. But in theory, you can use any
Linux or Windows version you want.
Also, you need a victim machine. In here, I'm using a Windows 2016 server,
but you could use any Windows machine you want. And that's it.
That's all we need for this demo.
So,
enough of theoryet's go to the lab environment and see how
this technique is done in real life.