In this demo,
we're going to use our Pupy sessions to capture a user input from our targets.
We're going to use Pupy's tools to capture user activities
like taking screenshots and then transfer that information to
our Pupy server for later use.
Using these tools enables a hacker to transfer files
and capture screenshots, keystrokes, mouse clicks,
audio, and even video.
If you're ready to gather some information,
let's head over to our Pupy server and get started. Time for
the last step in making use of our Pupy sessions, gathering
information from our clients.
We'll start with our Windows 7 target and try to gather some files.
First, we want to run commands only on our Windows 7 session.
From this menu, we have two choices to interact with our Windows 7 target.
Let's use session 3 since it has system‑level
permissions. We can then use the ls command,
followed by a directory we want to view the contents
of. Let's take a look the C drive.
Let's take a closer look at the Users directory.
From here, we see the IEUser directory.
Let's actually go one step further and explore that
user's desktop. For this example,
I'm going to try and pull the entire shortcuts folder back to the Pupy server.
There's nothing that interesting in here,
but as you can see here, once you have a Pupy session,
you're free to explore any directory you want,
including a user's personal desktop and documents.
Let's go ahead and try to pull an entire folder over to our Pupy server.
To do that, we just need to run the command to download the directory,
followed by the directory we want in quotes, similar to our
ls command. Let's take a quick look at it.
Once we navigate all the way down into that path,
we can see the original directory structure, C:/users/IEUser/desktop
shortcuts and all the shortcuts I had placed in that folder.
Although the contents of this particular folder aren't
anything that a hacker might be interested in,
this command could be used by hackers to pull down important files
containing personally identifiable information or important business
documents if they were accessible under these same permissions. Let's look
at one more tool that's a little bit more fun,
and that would be in the screenshot tool.
Let's take a quick screenshot of our Windows target.
All we have to do is type screenshot into our Pupy server interface,
and now we can pull up that image.
And there it is.
This feature has potential use for gathering any information
the victim might have open on their desktop.
Let's look at one more tool, the ability to open a remote
desktop session through a web browser.
If you prefer to interact with your target over a
GUI rather than the command line,
you can even open a remote desktop session with a
victim using the rdesktop tool.
Once run, it gives you a web address, which you can then plug into your browser.
Now we can explore the machine using the GUI and find
additional files to download to our Pupy server.
We can also upload files to our victim using Pupy and run attacks
on other network machines from our RDP session.
To recap what we learned in this demo,
we started out downloading a directory from our victim's desktop
to our Pupy server and viewing the contents. We then took a
screenshot of the victim's desktop to see if any valuable
information was displayed on the screen.
Finally,
we opened a remote desktop session in our web
browser using the user's credentials.
This brings us to the end of our course on Pupy.
There are many more tools and modules to explore,
and I hope I've captured your interest in its ability as a
post exploitation command and control server.
Next up, we have a quick overview of additional resources.