Welcome to Part Twelve of this module.
In this lesson we're going to be looking at how to achieve persistent access against a Windows machine
with mature spitter.
We're going to be picking up right where we left off in the last video so as to avoid any unnecessary
repetition.
That means we're starting off with more turpitude open right off the bat.
I realize in the past I've spoken somewhat glibly about possible ways of achieving persistent access
to an infected machine and that is what we're going to be covering here today.
There are many ways of doing this and before we even begin you need to be aware that this is not an
easy thing to do over the long term for many reasons.
Gaining and keeping a foothold on a system indefinitely is the sort of thing that nation states devote
considerable resources to being able to accomplish.
That being said there is a method built right into my turpitude or that will work for our purposes.
It's quick and dirty and very likely to be detected over time.
But if you just need to ensure future access and you aren't too worried about making it last a lifetime
then this technique should work well enough for you.
I should add that the maturity session we are using here does in fact have escalated privileges.
It is recommended that you escalate your privileges before attempting to gain persistence to avoid both
errors and any prompts asking for authentication from the user.
That is to say that the user of the target computer that might alert them that something is up it isn't
absolutely necessary in all cases but for the method used in this example it is the best way to go.
Our target is still going to be are Windows 10 64 bit professional virtual machine.
This is a virgin installation with no updates.
Now we're going to get persistence as you have no doubt realized by now the biggest weakness getting
a maternity session is that as soon as the target computer goes off line for any reason the session
closes down and the target has to be reinvented to get a new session.
You do all this work and the stars line up and you have your admin access and the user decides to turn
off the computer.
I know it's frustrating and it it's happened to all of us.
So here is an easy built in way to deal with that.
So if we type run persistence TAC H for help we're greeted with this thoroughly unhelpful output in
the old pre Cali days of backtrack.
This was a helpful menu detailing all of the persistence options.
Why did they change this.
I really couldn't begin to guess.
This is the help menu that we were supposed to be greeted with.
Maybe they hit it somewhere else when they made the switch to Cali and I'm just missing a really obvious
Commander switch.
But heck if I can find it regardless let's go over these options now in the simplest form you can just
type run persistence without any switches and this will write a script into the target's local temp
folder and windows.
And in theory that will work just fine.
We can do a little better than that though so tack a will automatically start a matching exploit multi
handler connect to the to connect to the agent.
Pretty self-explanatory Tak L is a good one to remember.
It allows you to write the payload to something a bit more subtle than the windows temp folder.
Keep in mind every antivirus worth the name knows to check the temp folder and it's also going to be
one of the first places that a system administrator is going to look for trouble.
Tack P lets you set the payload in our case it will of course be mature spitter but it doesn't have
to be.
Maybe you want to use a payload that simply runs at a certain time and all it does is add a second user
with Admin privileges on the Windows system.
So why would you want to do something like that.
Well there is a high probability in an office environment that a mature spitter or a reverse shell of
any kind or any kind of strange connection is going to be noticed sooner or later.
Maybe you just want to get access to the target computer for a few seconds drop a payload on a timer
that creates a second admin account say 15 minutes after everyone else goes home and then walk over
to the computer.
You now have an account on and access it remembering to delete the account and the payload when you're
done a bit James Bond.
I know but my point is there are a lot of exploits and it may not always be your objective to gain a
constant reoccurring connection.
This class focuses on the main line stuff that most people care about but that doesn't mean you shouldn't
explore the subtle unorthodox uses of metal split.
Once you master the basics the TAC s option will toggle whether or not the agent is going to start on
boot with system privileges.
Now be careful with this.
This is very likely to stand out to any system administrator who does a routine check and it is certainly
more likely to be picked up by antivirus or malware detection.
Any user who uses a common program like C cleaner and notices a file that is just a weird string of
letters and numbers in their system boot list is going to raise an eyebrow.
T lets you use a different executable template.
Not really within the scope of this tutorial but the option is there.
Nevertheless tack you starts the user agent when the user actually logs on.
This does differ significantly from TAC s because it doesn't leave a glaringly obvious fingerprint in
the boot order.
Given a choice between S and U.
I personally prefer the latter but it is your option.
If you run persistence without any switches I do believe it defaults to tack s the tack X switch is
basically Tak s except the agent isn't going to have admin privileges so the user isn't going to get
prompted and in theory it's a bit more quiet.
But then again your session will automatically have authority system.
It's still going to show up is something funny in the boot list though so it's really no less likely
that it will be detected if somebody goes in and eyeballs the boot sequence.
Lowercase h is the useless help menu we just saw and not this nice one pulled from backtrack tack lowercase
I.
Lets you set the interval between connection attempts this is recommended and you'll see it used in
the example TAC lowercase P and lowercase are pretty self-explanatory.
They allow you to set your port an IP.
Again I know it's been said before but if you're doing this over the Internet and not on a local network
you will have need to setup port forwarding.
Please see the video on that for more information.
And remember one more thing about these options.
Whatever IP address you give the payload that is the IP address the payload is going to be constantly
trying to dial home too.
If it gets discovered it is a very easy thing to look at outgoing connections and see exactly where
it is trying to connect to.
This is where virtual private servers proxies command and control centers and the light come into play.
We will be talking about these more later.
One more thing before we see this in action.
I'm sure that anyone watching these videos are doing so because they are either penetration testers
hoping to hone their craft for legal use or system administrators looking to see how hackers operate.
Remember that even if you're doing a lawful pen test with written permission that permission may not
extend indefinitely.
It is your responsibility to remove any back doors you place on a system leaving something like this
in place after the test is over may create a legal liability for you.
OK enough preamble.
Let's see this in action.
Going to go ahead and I'm going to clear the screen
and return to our session and then we're going to type run persistence TAC uppercase U which specifies
that we want the the agent to essentially dial home as soon as the user logs on TAC ie lowercase for
the interval we're going to set this for five seconds which means that after the user logs on every
five seconds the user agent will attempt to dial home TAC lowercase P for port it's going to remain
for 4 4 4 TAC lowercase r for our own IP address.
This will be a network IP if you're doing this on a network which I am or your public IP.
If you're doing it over the Internet keeping in mind the need to setup port forwarding for non-local
hosts and then we press enter.
This may require a few moments.
Okay.
And there we go.
This funky looking VB s file has just been written to users admin app data local temp and the auto run
we can see has been installed right down here to this directory
so now I'm going to go over here real quick and I'm going to shut down windows causing our current mature
operators session to die before I do that though.
Let's just real quick.
Press are windows plus are key to open up the run menu and we'll search for the temp folder that's a
percent temp percent.
Now inside our temp folder.
Notice that we can find this VB script file in my case there are three because I've tested this a few
times prior to making this video.
Again this will stand out like a sore thumb to anyone who knows what to look for.
If you are a system administrator and you see any sketchy VB script files sitting in your temp folder
Well you have a pretty good idea of what has been causing those network anomalies you've been noticing.
This is why writing to better locations is advisable.
But again this is good enough for demonstration purposes.
It's not really like the average user goes digging through their temp file looking for on scripts that
don't belong there but it's something to keep in mind.
So now what I'm going to do is I'm going to power off the Windows system
so here we're shutting down and if we come back over to Cali we can see that our fritter session has
just died.
So now we've shut down Windows 10 and we've closed out of our interpreter session.
So now that we've closed everything down are Windows 10 are dead mature fritter the whole thing we've
cleared the screen now we're going to once again use exploit forward slash multi force slash handler
any options shouldn't have changed good going to exploit and our TGP handlers now listening so
we're going to start up Windows 10 again
and there we go.
As seen in real time if we flip over to our session now I think that took a little longer than five
seconds.
It's supposed to dial home every five seconds but this is virtual box.
So some allowances have to be made I suppose now in a perfect world the target user will never run antivirus
never check their temp folder and never notice any open connections that shouldn't be there.
In which case you can expect to maintain a persistent foothold on the target system over the long term
as I said.
The reality is sooner or later this method will be discovered and shut down.
Long term access is a challenge.
Also keep in mind there are other ways to do this.
Once you have a mature spitter you could again in theory use the upload command to send the target a
better piece of malware like a rootkit that you've put through multiple corruptors or whatever.
Although it is well outside the scope of this tutorial some pen testers like to use them interpreter
to setup some extremely well scripted malware that includes a secure connection like open VPN leading
to a command and control center on a virtual private server.
These concepts will be covered in more detail later in this class.
For now it is enough to know that while this is not the best way of getting long term access this technique
which is entirely within met a split can be used to gain a reoccurring foothold which which should hopefully
be enough for you to be able to leverage.
Just remember to clean up those scripts and payloads when you're done because they are a dead giveaway
to a system administrator that a pen test is taking place using met a split of course not to the average
user but anyone with any skill in cyber forensics will be able to spot it right away.
Thank you for your attention as always.
Never use anything shown in these videos against any system that you do not have written permission
from the owner to penetration test be ethical and lawful at all times and I'll see you in the next session.