Hey there.
Welcome to the course, Persistence with pwncat.
In here,
you'll learn how to create a foothold on your target environment
so you can access it at any time you want.
So imagine that.
Imagine you're in a red team engagement.
You're working on a server,
and you finally find a way to exploit the server and get access to the machine.
Now, since you exploited the server,
there's a chance that the client might detect your actions and
might try to patch the vulnerability you exploited.
As you need access to the server for a long period of time,
what you need to do now is deploy some kind of implant or tool
that allows you to access the server at any time,
which is also called creating persistence on the victim.
Once you establish persistence,
even if the client fixes the vulnerability and you
lose your original point of access,
you can still access the server using your implant.
Pretty cool, right?
And if you do a good job,
this implant will be there for a long time before the victim notices it.
There are several ways of creating persistence,
and although we could do everything manually,
there are few tools out there that can help you to automate
the creation of persistence like the pwncat.
Pwncat is a tool developed by Caleb Stewart and John Hammond.
Personally, I'm a big fan of those guys.
Caleb has some really cool projects and tools,
and also, if you want to learn about security and exploitation,
John has an amazing YouTube channel with several tools on red team tools.
So if you don't know them yet, I definitely recommend you follow both of them.
Anyway,
pwncat is a post‑exploitation platform that streamlines common red team
operations while staging code from the attacker machine,
not the target one.
Basically,
this tool receives a connection from a victim computer and is
able to provide several out‑of‑the‑box features,
like persistence.
What I love about pwncat is that it's an open source tool,
meaning that you can download it from GitHub and
customize it as much as you want.
The way they implemented the code makes it really easy to
create new modules and add new features.
In a nutshell,
pwncat provides a stable communication between the attacker and victim machines.
And with that, we can perform several post‑exploitation activities.
For example, pwncat has out‑of‑the‑box modules for enumeration,
privilege escalation, and persistence.
As you can see, pwncat does much more than just persistence.
It's a complete framework for post exploitation.
If you're familiar with the Kill Chain methodology,
we can use pwncat from after the exploitation phase,
all the way to the action phase, meaning that after exploiting a machine,
we can use the pwncat framework to do pretty much all the other steps,
including escalating privileges enumerating internal information,
and creating persistence.
Also, if you're familiar with the MITRE ATT&CK framework,
we can map this course to two phases, persistence and discovery.
The main technique that I'll be covering here is
the T1078 called Valid Accounts.
And more specific, we'll be doing the sub technique 003,
which is more defining a local account.
Also, as a bonus, we'll be covering a discovery technique,
which is the T1087, or Account Discovery,
in which you would use pwncat to list out the local
accounts in your victim machine.
A lot of interesting stuff in this course, right?
So, let's talk about the demo.
In our demo, we'll cover one of the most common ways of establishing persistence,
which is using SSH authentication keys.
So,
imagine you already compromised the server and you have
some kind of access to the machine.
With pwncat, we'll deploy an SSH authentication key in a hidden location,
so even if the author of the server patches the original vulnerability,
we can use the SSH key to access the server remotely.
If you want to follow this demo on your own environment, you need two things.
First, you need an attacker machine.
In here, I'm using a Kali Linux version 2021.4,
because it comes with pretty much everything we need,
pre‑installed.
But in theory, you can use any Linux version you want.
Also, you need a victim machine.
In here, I'm using another Kali Linux machine,
but again, you can use any Linux distribution you want.
And that's it, that's all you need for this demo.
So enough of theory.
Let's go to our lab environment and see how this technique is done in real life.