Welcome back everybody. We're just gonna go ahead and create a persistent reverse
shell. We already have a reverse shell which is gonna make it persistent, that
would be a better way to put it. Anyway, hopefully you have the same setup as
before. If not, just go ahead and repeat the steps, no big deal. Let me just show
you sessions -l. I still have it up and running here, my session IDs are
5 and 6. Yours will probably be different if you have decided to redo
the process, or if you were doing the process like me in the first place,
you'll probably have different session IDs. They'll probably be 1 and 2, or
something of kind, because I've opened quite a bit of them and I haven't closed
MSF, I haven't cleared the cache, or anything of a kind. It doesn't really
matter. Different session IDs don't really mean that much, you can just
change them, that's just one number in the whole command. Be careful about that.
Anyway, let's go ahead and bring one of these sessions into the foreground. Now
session 6 is the one with elevated privileges, so let's go ahead and use it.
Just like I showed you before, sessions -i spaced 6. So this session ID, you see
where I'm typing 6 here, might be different for you. Just change it
accordingly. Press ENTER, there we go. Meterpreter is now up and running. So, if
I...I cannot of clear the screen here. This is annoying beyond belief.
Excellent! So, what do we need here? We need to type in run space persistence,
space -h for the help menu, and wait for it, there we go. So we got us several
options here. It says automatically start a matching multi/handler to connect the
agent, location, payload to use, automatically start the agent, alternate,
there are a lot of things. We want this one, automatically start the agent when
the system boots. Feel free to experiment with pretty much anything else here that
you can see. Use different ones, see what sort of options will you get, but
they will work on pretty much the same principle like what I'm going to do now.
I just want the agent to boot immediately
when somebody turns on the computer. That is what interests me the most. So, same as
before, run persistence space, instead of
space -h you must type in space -X, press Enter, and wait for it to do
running, installing, persistent script, excellent! So one of the bad things about
this is that these sessions don't actually require any login credentials.
Anyone listening to this, yeah, they would be able to connect.
Anybody following through the connections, anybody attempting to
connect, you would be able to listen for the connections that are being
transmitted from the other end. They would be able to, well, not perhaps
connect directly because the IP addresses are set there. But, those IP
addresses, if you're going over the net, are dynamic, and if you're in LAN, okay,
maybe they're static. Maybe they're dynamic in LAN, I don't know, depending on
how it was configured. But they would still definitely be able to listen to
the traffic as well. So, that's going to be a bit problematic. And it's an open
type connection, it only depends on the IP address, there are no actual login
credentials, which is not really nice. However, remember to clean up
after yourselves, it says here resource file for cleanup. You can see where it is,
the first line I believe, and then it says installing into autorun as HKLM
software current version. There you can see it as well, and here you can see where the script is
located. It's actually a visual basic script. Oh, that's not a surprise, really.
Anyway, you get the idea here. Now that persistence is up and running, the
meterpreter is up and running, let's just try to reboot the system on the other
end and see what happens. If I type in help, I'm sure that the command for
reboot is reboot, but let's just be certain of that. Oh,
come on...read, resource run, nope. Upload, search, okay, it doesn't seem to be here.
Okay, so here it is: Reboot the remote computer system. Under system
commands of course, me being a genius that I am looking in the wrong places
all the time. So, type in reboot, and this is unlikely to work. Operation failed,
let's see if the Windows machine is still running. It is, yep, there we go. No
problems there, no change has taken effect. As I said, some commands here will
work, some will not, but you always have the option of typing in shell and then
doing it manually yourselves. Type in shutdown
/r, press Enter, oh, access is denied. Which session have I
opened? Meterpreter session 6 closed, oh, no, I've closed it. That's not what I want.
But, it doesn't really matter. The persistence is still running on the
other side. Let's just see, I do believe that I have another one that is running.
OK, session 5 is running. Sessions - i 5, press Enter, interaction is active. Shell,
meterpreter is there. OK process...you're gonna give me the shell? Yep, you will
give me the shell. Let's go cd .., I'm gonna exit out of here, and shutdown /r
shutdown /r.
Are you gonna do it? Okay, so there's a default timer of one minute. I should
have configured a timer as well. If I just type it in one more time you will
see a system shutdown has already been scheduled. So, this is gonna start pretty
soon. I should have given a timer. Let's see,
shutdown /r /t 0. Will this work better?
Excellent! So, it will. If you give it a time it's gonna shut down
immediately. If you don't give it a time I think the default is one minute, which
is, I don't know, I guess I could have waited. But it's a tutorial, so I didn't want to
waste any time. Anyway, you can see that the Windows 8.1
machine is actually rebooting, and what you need to do on the other end, just
press enter here, and type in session. No active sessions. Okay, so just go
as before, use exploit multi-handler. Use exploit/multi/handler, and, let's see, show options
because you need to reopen it again on your end. Excellent! So this seems to be, it all
seems to be in order here. If I type in exploit, it's listening. So as
soon as, okay, the machine has booted, but I haven't really logged in. Let me just
log in and see what happens on the other end.
No, nothing. Come on, be a pal here.
Ah, it just started and I interrupted it. But, oh, no, okay,
it did open. Meterpreter session 7 opened. So if I type in shell, shell,
I don't know, I didn't work the first time, but let's see. Just cd .., cd.., dir,
and there we go. I am effectively in a Windows machine, and I can do again
whatever I want to it. From this point onwards, I am in command of this Windows
machine, I am omnipotent on it, I have greater power than the user. I just don't
have the access to that shut down physical button. But, anyway, it doesn't
really, I don't know, it does make some difference, I guess, but nothing
significant. You have full control over the machine, you can do, from this point
on, you can do whatever you want to it. Your options are countless. I've already
showed you where you can find the options for keylogging and webcam. Webcam
is actually quite nice. It does take quite a bit of bandwidth, and keep in
mind that somebody's gonna be able to see when you turn the webcam on because
the light is gonna be turned on. However, I was honestly surprised
when I saw that people didn't actually notice that, always. They do notice it
after a while, but not immediately. Anyway, feel free to play around, do whatever you
wish with it. Try to find new ways of doing this, of elevating privileges, try
out other exploits, and feel free to report your results in the udemy discussions.
And if you get stuck with anything, I'll, as always, I am more than happy to help
you out. Just ask your questions away. Quick
reminder, I have given it in one of the other tutorials as well, if you could
post the error messages that you get immediately, that does help me quite a,
that does help me a lot when solving your problem. And if you type in the
exact command that you used, and if you type in the exact error that you got
from the system, that does help me a great deal because I can
provide the solution far faster than you describing your problem, and then me
asking what the error message is, and what the command is, and then you
get one or two unnecessary cycles, as opposed to just going immediately to the
problem. Anyway, I bid you all farewell, and I hope to see you in the next
tutorial.