WEBVTT

00:00:01.730 --> 00:00:02.850
In this demonstration,

00:00:03.080 --> 00:00:08.310
we will use Starkiller to obtain a persistent agent using a WMI attack.

00:00:08.840 --> 00:00:13.180
As we revisit the diagram, we will be focusing on the Helpdesk user.

00:00:13.840 --> 00:00:18.220
Since we have already established a persistent agent on the Helpdesk machine,

00:00:18.400 --> 00:00:22.270
we're going to solidify our persistent foothold by increasing the number

00:00:22.270 --> 00:00:26.100
of attack vectors deployed on the startup machine.

00:00:26.100 --> 00:00:31.740
To perform the WMI attack, we will do this within Starkiller.

00:00:31.740 --> 00:00:35.560
Starkiller gives you the ability to perform all the

00:00:35.560 --> 00:00:39.540
functions of PowerShell Empire, but using a graphical interface.

00:00:39.540 --> 00:00:41.400
When you start Starkiller,

00:00:41.410 --> 00:00:44.350
you will be presented with a screen as you see currently.

00:00:45.740 --> 00:00:47.240
I've already set up a listener,

00:00:47.590 --> 00:00:50.990
and I have renamed the agents that are reporting in so

00:00:50.990 --> 00:00:53.070
that they are more easily identifiable.

00:00:53.640 --> 00:00:56.650
In the previous demo, we looked at the Helpdesk PC,

00:00:56.660 --> 00:00:58.860
and we have established an elevated agent.

00:00:59.640 --> 00:01:03.960
We're going to use that same elevated agent to perform the WMI attack.

00:01:04.730 --> 00:01:08.350
I'm going to click on the agent, which will allow me to interact with it.

00:01:08.410 --> 00:01:12.780
Here I've got the ability to issue any type of command or execute the module.

00:01:12.780 --> 00:01:17.790
If I click on View, it gives me the ability to view information such as the ID,

00:01:18.080 --> 00:01:21.670
any type of integrity levels, and a bit more.

00:01:21.680 --> 00:01:22.190
However,

00:01:22.190 --> 00:01:25.510
the output here is not as populated as if you would run

00:01:25.510 --> 00:01:27.560
the sysinfo command on the agent.

00:01:27.540 --> 00:01:29.700
I'll switch back to the interaction page.

00:01:29.700 --> 00:01:33.520
And under Execute Module, I have a drop‑down box,

00:01:33.520 --> 00:01:37.980
which gives me the ability to browse all the various modules that are currently

00:01:37.980 --> 00:01:41.840
loaded within PowerShell Empire that I can use on the box.

00:01:41.840 --> 00:01:44.960
Now I can scroll through the list and search for persistence.

00:01:45.030 --> 00:01:45.480
However,

00:01:45.480 --> 00:01:47.680
I would like to make my life a little bit easier and

00:01:47.680 --> 00:01:49.550
just simply type in persistence,

00:01:50.440 --> 00:01:54.570
and this will give me all of the persistence modules that are available.

00:01:54.570 --> 00:01:58.640
Now the one we're going to use is listed under the PowerShell,

00:01:58.720 --> 00:02:02.230
persistence, elevated, and WMI.

00:02:02.390 --> 00:02:06.100
Once I click on the module, I have some options that I can configure,

00:02:06.100 --> 00:02:10.169
the first one being the listener that will be used to establish the connection.

00:02:11.200 --> 00:02:12.780
I will select my current listener.

00:02:13.250 --> 00:02:18.190
I can define a name for the WMI entry and any optional fields.

00:02:18.320 --> 00:02:21.270
A good field to use is the AtStartup field.

00:02:21.270 --> 00:02:24.210
When I set this field to the value of true,

00:02:24.210 --> 00:02:27.380
essentially what happens is as soon as the machine starts up,

00:02:27.390 --> 00:02:30.920
a connection will be established back to my attacking machine.

00:02:31.180 --> 00:02:34.540
This is a good way to obtain persistence when a machine is rebooted.

00:02:34.810 --> 00:02:38.060
The rest of the options I will leave as the defaults,

00:02:39.040 --> 00:02:40.750
and I will go ahead and click on Submit.

00:02:41.140 --> 00:02:42.630
As soon as I clicked on Submit,

00:02:42.780 --> 00:02:45.700
Starkiller pipes the command back to PowerShell Empire,

00:02:45.820 --> 00:02:48.670
which ultimately sends it across to the target machine.

00:02:49.440 --> 00:02:50.660
After a couple of minutes,

00:02:50.730 --> 00:02:54.410
you will get a response back that says the WMI persistence has

00:02:54.410 --> 00:02:58.550
been established to the listener that we have defined with the

00:02:58.550 --> 00:03:00.610
onstartup subscription trigger.

00:03:00.770 --> 00:03:03.310
Now that we have the WMI subscription configured,

00:03:03.490 --> 00:03:06.570
I'm going to go ahead and trigger the WMI event.

00:03:07.140 --> 00:03:10.460
This will then trigger a connection back to my Kali machine,

00:03:10.460 --> 00:03:12.960
and a new agent will be established.

00:03:13.340 --> 00:03:15.560
We now have the new agent that has been established.

00:03:15.890 --> 00:03:17.810
Let's take a look at this agent's properties.

00:03:17.990 --> 00:03:22.110
You'll notice that this agent has been established under the system context.

00:03:22.640 --> 00:03:25.950
This ultimately gives us the highest permissions on that box.