Before we go,
I want to share with you a few more resources in case you want
to learn about Impacket and persistence.
First, and most important,
check the official documentation from Impacket. In this course, we
covered just one of the features of the tool. But the reality is
that Impacket has several other features, like SMB servers and
relays, network packet manipulation,
Active Directory reconnaissance, and much more.
Also, if you want to improve your red teaming game, I do recommend
you two courses here from Pluralsight. First, the Privilege
Escalation with Rubeus in which you'll learn a few interesting
techniques to getting admin access.
Also, I recommend the Post Exploitation with Meterpreter, which, as the
name suggests, covers all the activities after getting initial access to a
server. And also, if you're wondering how you can protect your company
against the persistent attacks that we've been discussing here, I have a
few suggestions. First, it is a good idea to use an endpoint protection
tool that is able to monitor WMI events and triggers. Attackers love to use
WMI to create persistence and execute malicious code. So if you can monitor
it, you can prevent it. Also, you could adopt network behavior defense
tool, so then you can detect reverse shell beacons. The payload that we
used in the demo iterates packets in regular intervals.
So, network behavior tools can detect those beacons and alert you.
So that's it. That's the end of our Impacket course. I hope you
enjoyed what you learned, and now you have one more persistent
technique in your skill set.
So, thank you for watching, and I will see you in the next course.