All right, in this demo,
we're going to be looking at configuring different transport options
and establishing multiple client sessions using Pupy.
To do that, we're going to configure transport encryption options
to mask our traffic and start clients on multiple targets to
establish sessions with our Pupy server.
These features will allow you to establish multiple simultaneous sessions
and manage multiple targets from a single interface.
These techniques will also allow you to use different options to mask your
traffic and make it appear legitimate to network monitoring services. If
you're ready to continue exploring Pupy's features,
let's head over to our hacking machine and get started.
The method we will use to establish multiple transport sessions is to set up
additional listeners and create clients that use other transport methods. To
view the available listeners and default setting, we can type the config
list command and scroll to listeners.
Here you can see the available listeners within Pupy. To add one of these, we
will use the listen ‑a command followed by the listener type we want to add.
For this example, we'll try out the rsa listener.
Now that we set that up and see the confirmation that Pupy is listening on port
9091, we need to create a new client for our next target.
For my next target,
I'm going to run Pupy on the Metasploitable VM in this lab. I
exploited the vsftpd vulnerability using Metasploit to gain a
command shell with root access.
Now we just need a Pupy client. So we use the gen tool again,
and this time we'll specify a Linux operating system using
‑O and an x86 architecture using ‑A.
We use the connect method again and specify our Pupy
server IP using the ‑‑host option,
which in my case is 192.168.1.35. And then we'll
use a colon to specify the port, which this time will be 9091.
The last option we need is to specify rsa as the transport using the ‑t option.
Once we confirm our new client is created,
we just need to move it to our new target using our shell
and run it. Once again, I'm going to transfer it over HTTP.
Now we just need to transfer it,
which is as easy as running a wget to move it to the Metasploitable client.
Then we just need to make it executable, and then we run it.
And then when we come back at our Pupy server,
we see another session opened, this time with root permissions on our
Metasploitable client using RSA as transport over port 9091. So now when we
run the sessions command, we can see both of our sessions,
the user ID that we've logged onto each with, and a little bit
of information about each of our targets.
Let's look at these sessions in Wireshark to see if they're
both encrypted and how they're communicating.
So I'll take a look at the Metasploitable target first and follow this stream.
And when I follow this TCP stream going between our client and our Pupy server
over port 9091, we can see the traffic is indeed encrypted,
just like the SSL traffic with our Windows 7 client.
So we can now mask our traffic using two different encryption methods
between our server and each of our clients. Before we move on to the next
demo, let's go over a quick recap of what we covered.
We started this module by adding a new listener using the RSA transport option
to encrypt our session, using RSA instead of the default SSL.
We then generated a new client targeting a vulnerable
Linux machine we had already hacked into.
We established the session with the Pupy server over RSA with the
Linux machine, and we observed the traffic between the client and
server using Wireshark. In the next demo, we'll manage these
sessions and explore additional tools to find credentials and
escalate privileges on our targets.