Welcome to our lab environment.
I have in here two machines.
This one here is my attacker machine, which is a Kali Linux version 2021.
This other one here is my victim machine,
which is a Windows 2016 Server, and this sever is actually
a domain controller in my environment.
For this demo, we're assuming that you already got access to a
machine and you're trying to build persistence,
so you can come back anytime you want.
For this demo, I have the credentials to one of the admins.
So okay, let's start by the beginning.
First, let's go to our attacker machine and install the Impacket in there.
Let me quickly open the terminal and then create a
folder so we can work from it.
Perfect.
Now we need to download the content of the Impacket
GitHub into my attacker machine.
And the easiest way of doing that is copying the URL of the
repository and then using the command git clone to download
all the data from the repository.
Done. Now we have the Impacket files in my machine.
And the easiest way to install this tool is using the Python pip command.
So let me just make sure that I have the pip installed on here.
For that, I'll use apt‑get install python3‑pip.
And this might take a little while,
so I'll speed up this video to save us some time.
Perfect, done.
Now that we have everything we need, the installation process is really simple.
I'll go inside the Impacket folder that we downloaded,
and then I'll use the command python3 ‑m pip install and then dot, meaning
that I want to install the files from this folder in here.
Once I press Enter, the pip will review the requirements for Impacket,
and it will install any libraries that are necessary.
Perfect. Impacket is now installed, and you can even take a look at some of
the out‑of‑the‑box scripts that comes with this tool. For that, I'll go to
the folder examples and list what is in there. As you can see, I have a lot
of interesting scripts here, like mimikatz, smbserver, secretsdump, and much
more. To make sure everything is working, I will try to connect to my victim
server using the WMI protocol. For that, I'll use this wmiexec script here.
So let's type python3, then wmiexec.py. Then, after that, I'll type the
username that I want to use and the IP of my target machine.
Then, once I run this, it would ask the password for the
account that I'm using. And that's it.
Take a look. We have now a shell to the machine. As you can see, I'm logged as
Kenny, and I can even see the IP address of the machine.
Pretty cool, right?
That's a way to execute remote commands in a machine using the
terminal. But okay, we are here to create persistence. So let me close
the shell and clear my screen for the next demo.