All right, in this first demo,
we're going to start the Pupy server and look at how to navigate through
the tool and how to use some of the basic options.
To accomplish this,
I'm going to show you how to start the Pupy server on your hacking workstation,
generate a client file and run it on a target,
and explore the interface and available actions to take against the target.
Let's head over to our hacking workstation and get started.
I installed Pupy on a 64‑bit Kali Linux image obtained from the Offensive
Security website using the instructions on Pupy's GitHub page.
I did not use the Docker installation instructions for this course,
but the instructions are available, if that's your preference.
If you have not done so already,
one other command you'll need to run is the pip install ‑r requirements.txt
from the directory where the requirements.txt file is located.
The two targets I'll be using in this course are a Window 7 image
from Microsoft and the Metasploitable 2 image.
Links to these images are in the exercise files.
To get started, we need to open a terminal and navigate to our Pupy directory.
From here,
you'll run the pupysh file located in the bin folder in your Pupy workspace,
which for me is along this path.
And that's all we need to get it started.
Our server is online and listening on port 443.
Before we explore additional options,
let's get a client session established from one of our targets.
For this example,
I'm starting with a reverse shell into a Windows 7 target over port 4444.
If you want a quick way to get these shells up and focus on Pupy,
I recommend using msfvenom to generate an EXE
payload and run it from your target.
Now we have to generate a Pupy client to run from our shell and establish a
session with the Pupy server. To create a basic client that establishes a
connection using the default SSL transport,
we will use the gen tool.
We will follow it with a ‑f to specify the format,
which in our case will be client.
We'll follow that with a ‑O to specify the Windows operating system
and then a ‑A to specify a 64‑bit architecture.
Next, we have to specify a launcher, which will be connect for this example.
This tells the client to connect back to our Pupy server.
So we need to specify that IP address using the ‑‑host command
followed by the IP address of our Pupy server,
which in my case is 192.168.1.35.
We'll follow this with a colon and the port number, which
since its SSL is 443, and then we have to specify the
transport using the ‑t option.
And as I said, we use ssl for the transport.
Then we can generate the client.
Once that completes, we see our file location,
which we can copy to another location and rename and then send to our
target for execution. To transfer the file over to the target, I place
the file in the HTML directory of my hacking machine, started Apache, and
created and ran a simple PowerShell script on the target through the
shell to download the file.
Once we confirm that it's on our target,
we can run this shell and then go back to the
terminal window with our Pupy server,
and we see that a session has opened with our Windows 7 target.
Once we have our session opened,
we can use Pupy to take other actions against our target. Before
we take any actions, let's take a closer look at the session
between our target and the Pupy server.
We can use Wireshark and see that our traffic between the
target and our Pupy server is encrypted using SSL and
appears as legitimate web traffic.
Pupy has more transport options that we'll configure in the next demo.
For now,
let's go back to our server and look at some of the actions we
can take on our target. We can view all available commands and
modules using the help ‑M command.
The commands are listed first and are all the options we
can use to manage the Pupy server.
Some examples are run to specify whether to run against one or
multiple clients, sessions to list active sessions and interact
with them, connect to connect to a bind payload if we use that
instead of the reverse payload,
listen to manage our listeners, and a few
self‑explanatory commands like restart,
help, and exit. Continuing on to the available modules,
we can see that Pupy breaks the modules down into categories
based on their function. The first category being admin
modules that list files, copy files,
start remote desktop sessions, and can enable or disable RDP,
among other options.
The admin functions also have commands that can be used for
privilege escalation attacks, like beroot, which will try to
discover different methods to accomplish this.
The next category has modules that can retrieve
credentials using a variety of techniques,
including memory retrieval,
dumping from Windows systems, and retrieving stored passwords.
After credentials,
we have exploit categories that allow you to run further
exploits on the target to gain escalated privileges or
maintain access to the system.
The gather category includes multiple tools to get information from the target,
including a keylogger, mouselogger, webcam tool, and screenshot tool,
which we'll explore in a later demo. Under the manage category,
there are functions for downloading files and also
remotely editing files on the target system.
The last three categories of modules include additional tools for
privilege escalation, like getsystem, to attempt to get system
privileges, and bypassusac, to attempt to avoid the user access
control tool in Microsoft operating systems.
There are also a few network commands that we can use to run
a port scan or TCP dump on the target.
And finally, a few commands under a troll category to pop up a message box or,
if your target's a phone, make it vibrate or even say something.
The last part of the help menu is a list of aliases you can use from the
interface and their corresponding commands or modules.
Before we go to the summary,
let's run one troll command on our target and cause a
message box to pop up on our screen.
To do that, we'll type the message box command, msgbox, followed by our message.
And when we go over to our target,
we see the message box on the screen. In an actual
penetration test, this would give you away and be
something you would want to avoid doing.
But since we're just practicing in the lab,
go ahead and have fun. Before moving on, let's do a quick
recap of what we learned in this demo.
We went over the lab environment I'm using in this
and other demos for this course.
We then started up the Pupy server on our hacking workstation.
Next,
we generated a client file and ran it from a target that we had
previously exploited to establish a session with the server.
We also looked at the traffic between the client and
server using Wireshark and confirmed that it's using SSL
encryption over port 443. Finally,
we explored and discussed the functions within Pupy that
we can use once we have a session.
In the next demo, we'll dig a little deeper into the transport and
encryption options in Pupy to mask traffic and start clients on
multiple target machines. We'll then manage multiple targets from a
single Pupy server interface.