All right, welcome back to our Kali Linux.
One of the most common ways of creating persistence is by
installing a hidden reverse shell that connects back to
our server every few seconds.
So first, we need a reverse shell payload.
In a real red team engagement,
you can create your own custom reverse shell to try
to bypass antivirus solutions.
And here, to make things easier,
I'll create a reverse shell payload using msfvenom,
which is part of the Metasploit framework.
With this tool, it is really simple to create a reverse shell.
I just have to type msfvenom, then ‑p to define the payload that I want to use,
then windows/meterpreter/reverse_tcp.
Then, after that, I have to define the LHOST flag,
which is the IP address of my attacker machine.
Also, I'll define the LPORT to define which port my server will be listening to.
And then,
I will use the flag ‑f to define the type of payload that I want to use.
And that's something to remember.
This persistence attack only accepts Visual Basic payloads,
so I have to use the VBS format here.
Okay, now I just have to output this to a file, which I will call shell.vbs.
Once I run this, msfvenom will create a Visual Basic reverse shell,
and we'll save that into the file.
Okay,
then we can even take a look inside of the file just to make sure
that we have a Visual Basic script in there.
Perfect.
Now we need to set up a listener for the shell,
so then, when the script is executed,
we are ready to get a reverse shell connection.
For that,
I will open a new terminal and run the Metasploit
console using the command msfconsole.
Perfect.
In here, I'll use the exploit/multi/handler to receive the reverse shell.
Then, let me set the payload as the windows/meterpreter/reverse_tcp shell.
If you're not too familiar with Metasploit,
I do recommend you pausing the video here and trying
to understand what are we doing.
The idea is creating a listener so when the payload is executed,
we have a reverse shell.
So okay, let me take a look at which options that I have set up in here.
Take a look.
It seems that the listening port is already set up,
so I just have to configure the IP of my machine.
Then, once I run this command, Metasploit will open a listener on port 4444.
And whenever the Visual Basic shell is executed,
we have access to the victim computer.
All right, it seems that we have everything ready now.
All we have to do is set up a WMI task on the victim computer that
runs the Visual Basic script once in a while.
And the good news here is that with Impacket, we can easily do that.
So I'll go to the Impacket examples folder. And then in here, I'll use the
wmipersist script. And the commander looked like this,
python3 wmipersist.py.
And then, now I have to put the domain the machine is registered to.
In my case, my victim machine is part of the globomantics.com domain.
After that,
I'll use a slash and put the username that I want to use to execute the action.
Remember, there's an admin user on the target machine.
After that, I'll use the at sign and put the IP address of my target machine.
Perfect.
Now,
I'll use the word install to specify that I want to install a new WMI task,
and I'll add the flag ‑name to define the name of my task.
After that,
I will use the flag ‑vbs to specify the Visual Basic script
that I want to execute in the victim computer.
Remember, in here,
I'll use the reverse shell payload that we created with msfvenom.
And the last flag is the ‑time to specify the interval between the runtimes,
and we specify this in milliseconds.
So I'll use 1000 here, meaning that the script we will run once every second.
In a real red team engagement, you should set up a longer interval,
maybe once every 5 minutes, so you don't create too much noise.
In my case, I'm using just 1 second so we don't have to be waiting for too long.
Okay, once I run this,
it will ask me for the password for the user account that I'm using.
So let me quickly type it.
Perfect.
This script will now create a new WMI task and will
sign the Visual Basic script to it.
One important thing to note is that if the target
server has any kind of antivirus, you might be detected.
Take a look.
In here, the Windows Defender detected my payload.
And that's why in the beginning of this demo I mentioned
that in a real red team engagement,
it is recommended that you create your own code or you find
a way to bypass the antivirus solution.
As in here, I'm using a Metasploit payload.
I knew that it would get detected,
but that's okay here. For this demo, I will just allow this file
in the antivirus so we can see how it works.
But again, in a real red team engagement,
make sure your payload is obfuscated so you're not detected.
Okay, now that the file is allowed, let's take a look at my attacker machine.
Let's go to the listener that we had created.
Perfect.
See here, we have a Meterpreter session to the machine.
I can run any command I want.
As you can see, the shell is running as a system, which is amazing.
I have full access to the machine.
And the best part is that now we have persistence.
Even if I close this connection,
I can just reopen my listener and wait for the new connection to come.
See, got another shell.
And this means that in a real red team engagement,
you can close your attacker machine.
And a few days later, if you want, you can just open a new listener,
and you have access to the victim computer.
Pretty cool, right?
Now, let's say you finish your project, and you need to clean up the server.
To remove the WMI task that we created is really simple.
I'll use the same wmipersist command as before.
But instead of using the command install,
I'll use remove,
and I'll use the ‑name flag to specify the name of
the task that I had created before.
Once I run this, the malicious script that was uploaded will be removed,
and the WMI trigger will also be removed.
Just make sure we can run the Metasploit listener again.
And as you can see, we have no new connections,
and this means that the WMI task was removed.