WEBVTT 00:00:00.640 --> 00:00:01.830 In this demonstration, 00:00:01.960 --> 00:00:04.470 we will look at how we can obtain a persistent 00:00:04.470 --> 00:00:07.160 foothold by using a registry implant. 00:00:07.160 --> 00:00:10.460 In the demo, we will focus on the server, 00:00:10.940 --> 00:00:14.050 and we will leverage the persistence module that does 00:00:14.050 --> 00:00:16.250 not require a high‑integrity agent. 00:00:16.640 --> 00:00:20.150 Empire gives you the ability to use the registry key module, 00:00:20.540 --> 00:00:24.320 which ultimately creates a registry entry that establishes a 00:00:24.320 --> 00:00:27.070 reverse session back to your attacking machine. 00:00:27.840 --> 00:00:29.370 Let's go ahead and set this up. 00:00:29.740 --> 00:00:32.650 I'm going to interact with the server agent, 00:00:33.440 --> 00:00:37.180 and I'm going to use the module persistence and you'll notice 00:00:37.180 --> 00:00:39.270 that we have two types of registry attacks. 00:00:39.670 --> 00:00:43.270 The one can be executed when you have an elevated agent, 00:00:43.440 --> 00:00:47.400 and the other one can be executed when you do not have an elevated agent. 00:00:47.640 --> 00:00:50.370 Since the server agent is not an elevated agent, 00:00:50.740 --> 00:00:53.860 let's go ahead and use the standard userland registry. 00:00:53.980 --> 00:00:56.350 And let's take a look at the options that's available, 00:00:56.740 --> 00:00:58.830 and you can see that we've got the standard options, 00:00:58.840 --> 00:01:02.470 such as the agent name, the listener, which we need to define, 00:01:03.100 --> 00:01:06.070 and then we can define a key name in the registry path. 00:01:06.440 --> 00:01:09.410 It'll be a good idea to use a key name, which is fictitious. 00:01:09.580 --> 00:01:13.250 This will help to evade detection from analysts who are not that savvy. 00:01:14.240 --> 00:01:16.590 So I'm going to go ahead and modify some of the options. 00:01:17.300 --> 00:01:20.570 The first one that I'll need to modify is to define the listener. 00:01:21.940 --> 00:01:23.830 In my case, my listener name is http. 00:01:25.140 --> 00:01:29.250 Next, for the interest of the demo, I'm going to define a keyname of EMPIRE. 00:01:33.140 --> 00:01:36.860 Another setting that I'll modify is the location of the keyname. 00:01:37.540 --> 00:01:39.800 Instead of using the default registry location, 00:01:39.810 --> 00:01:43.890 I have modified this so that the key is created under the run location. 00:01:43.890 --> 00:01:46.930 This ensures that as soon as the machine starts up, 00:01:47.080 --> 00:01:49.360 a persistent agent will be established. 00:01:49.740 --> 00:01:51.490 We'll go ahead and execute this module. 00:01:51.770 --> 00:01:54.590 I get the warning that it's not OPSEC safe, and I'll accept 00:01:54.590 --> 00:01:57.190 this warning, and a task will be created. 00:01:57.350 --> 00:01:59.850 We are then presented with a message to tell us that the 00:01:59.850 --> 00:02:02.690 registry key has been successfully created. 00:02:02.910 --> 00:02:05.840 Let's verify that this registry key actually exists. 00:02:05.850 --> 00:02:08.800 I'm going to go back out of the module, and I'm going to 00:02:08.800 --> 00:02:11.230 issue a shell command to create the registry. 00:02:11.460 --> 00:02:15.270 If we take a look at the output, you'll notice that we have to Empire keyname, 00:02:15.340 --> 00:02:17.050 which is defining the registry. 00:02:17.940 --> 00:02:21.160 Now I'll go ahead and reboot the server and see if we get a 00:02:21.160 --> 00:02:24.580 persistent shell. As soon as the server starts up, we have a 00:02:24.580 --> 00:02:26.050 new agent that is reported in. 00:02:26.540 --> 00:02:27.760 If I list the agents, 00:02:28.440 --> 00:02:31.960 you'll notice that the new agent from the server has been established as 00:02:31.960 --> 00:02:34.650 a normal user and not with a high‑integrity level. 00:02:36.140 --> 00:02:39.010 If we had to use the persistence elevated register 00:02:39.010 --> 00:02:44.560 module, when the server booted up, we would have got a high‑integrity agent.