In this demonstration,
we will look at how we can use Empire to establish
remote desktop connectivity for C2.
We will also use Empire to upload files for remote desktop capabilities,
and in this case,
we will use a commonly used tool by real‑world attackers called Ammyy Admin.
Another way to perform command and control is to use remote desktop.
Now there are various ways in which you can enable remote desktop.
In this demonstration,
we're going to look at how we can do this using the
registry keys and how we can use a commonly used remote
desktop program called Ammyy Admin.
And when we use Ammyy Admin,
we will upload the file to the target and from Empire using a shell command,
we will install the Ammyy Admin as a service.
You'll notice that I have used the previous
demonstration on the Windows 10 machine,
and I now have 5 agents reporting.
They are essentially the same machines.
I have 2 from the Windows 7 machine, one using the HTTP HOP jump server,
and one using a normal HTTP listener, and the same for Windows.
10.
We'll begin with the Windows 10 session in which I
have an administrative agent running.
With the Windows 10 machine,
we're going to use a registry key to enable remote desktop.
Before we do this, let's double‑check if remote desktop is working or not.
I will use a built‑in tool within Kali Linux called rdesktop,
and when I issue the command, I am unable to connect.
So this tells me that remote desktop is not working.
In order to enable remote desktop, I'm going to use the registry key,
and within Empire I'm going to issue a shell command
followed by the registry command.
Once the task is completed successfully,
I am now going to try to connect to the Windows 10
machine using the Remote Desktop Protocol.
I'll use the same built‑in tool again,
and now I can see some success because it's giving me
the option to accept the certificate.
However, since this is Windows 10,
there are additional security features that I enabled,
such as NLA.
Let's go ahead and disabled this using a registry key as well.
I will now issue the command within Empire,
and once this is completed successfully,
let's try the RDP connection again.
And now I have the ability to remote desktop to my target machine.
From here, I can log in as another user.
Alternatively,
I can log in as the logged‑on user by disabling the Connect a smart card option.
Let's turn our attention now to the Windows 7 machine.
This machine,
we would like to establish remote desktop capabilities using Ammyy Admin.
Now I've already got an administrative agent running,
and I've achieved us using the bypass UAC command.
Let's interact with this agent now and confirm that it
is the Windows 7 target machine.
You'll notice that I have a high integrity of 1.
We'll take a look at our current working directory,
and we're currently within the C:\Windows\system32 directory.
This is a good place to upload the Ammyy Admin agent.
We will go ahead now and upload this, and once the upload is completed,
we can verify that the file exists.
And we have confirmation now that the file currently exists.
Next I will issue the install command using the shell command within Empire.
Now that Ammyy Admin is installed, let's take a look at the running processes
to see if it's running. And now I can see that I've got Ammyy Admin currently
running. Depending on the version of Ammyy Admin that you use, sometimes it
might not actually run when it's installed.
In order to get this running, you would then need to start the service
using a command line net start command. To demonstrate how that would
work, your command would look something like this,
and you'll see the output, which confirms that the service has started.
Now that we have Ammyy Admin installed, we can use the Ammyy Admin agent and
establish a remote desktop connection to the target machine.
This demonstrates the ability of Empire, where you can use Empire to upload
files to a target machine, and you can execute shell commands to install
those files and execute some additional tasks.