Alright, welcome back to our Kali Linux environment.
Now, let's deploy a persistence implant into our victim machine.
Remember, we have here, my attacker machine, and here, my victim machine.
So let's get started by receiving a shell from our victim.
Again, you can use any exploitation method you want,
but in here, I will use a simple listener on my attacker machine,
go to my victim computer,
and then use the netcat on my victim to connect back to my attacker.
Done.
Now I have a fully interactive pwncat shell here.
First,
let's take a look in our persistence techniques that we can execute with pwncat.
If you use the comment, search implant, and then .*,
then we can see all the potential persistence implants that pwncat supports.
Personally, I like to use the first one, which is the authorized keys.
The other two methods are not that reliable,
sometimes they work and sometimes they don't.
The idea of the authorized key implant is that it will
put on your victim computer an SSH key.
So we can later access the victim via SSH,
and this is usually more stealthy than creating new backdoor user,
since almost no one checks for the SSH keys files in the computer.
So to deploy this implant, first, we need to create an SSH key pair to use,
and it's really simple to do that.
I will just use the command ssh‑keygen ‑t and then rsa.
Basically,
what I'm doing here is creating an RSA type of key using the keygen tool.
Once I press Enter, it'll ask me the name of the key pair.
I will use anything, like mykey.
Also, if I wanted, I could add a password for this key,
but in my case, I will just leave it blank.
And that's it. The key now is created.
And now if you take a look at the contents of this folder,
we will note two new files here, the mykey and mykey.pub.
Also, we should take a note of the path of this folder,
since we'll be using this key soon.
Perfect.
Now that we have the SSH keys that we want to use, let's deploy our implant.
For that, it's pretty simple.
I'll use the command run implant.authorized key.
And after that,
I'll tell pwncat the location of my key by using the
key = and the path of the key.
Perfect.
Now let's run this.
Amazing.
Take a look.
Pwncat is telling us that the implant was successfully deployed.
If you want to confirm, we can even use the command run implant list.
And here, we can see that we have one implant deployed in this server.
Now, let's go to the victim machine and see what pwncat did there.
To switch between the pwncat terminal and the victim terminal,
I will just press Ctrl+D.
Perfect.
In this user folder, if we list the contents of this directory,
we'll see that pwncat created a .ssh directory,
and this is where pwncat put our public key,
so we can connect back later.
However, in some cases like mine here, the SSH folder is over permissive,
so we might have trouble connecting later,
but to fix that, it's really simple.
We just have to use ch mod 700, and then the name of the folder, which is .ssh.
Perfect.
Now that permissions are fixed,
we can return to the pwncat shell by using Ctrl+D.
And we can even disconnect from the session if we want.
Since we created the persistence, we can access the server at any time now.
We don't even need to re‑exploit the vulnerability that we used.
We can just use the pwncat to connect back to our backdoor SSH key.
And for that, it's really easy.
I will use pwncat, then ‑i to specify the location of my SSH key,
and then the user and the IP of the server that I'm connecting to.
We'll also press Enter.
Pwncat will connect to our victim machine using the SSH key that we generated.
And here we go.
Pretty cool, right?
We can even see here that I have one session created,
and I can use Ctrl+D to interact with the victim machine.