WEBVTT 00:00:00.540 --> 00:00:01.640 In this demonstration, 00:00:01.770 --> 00:00:06.360 we will look at how we can obtain a persistent agent by using a scheduled task. 00:00:07.240 --> 00:00:10.550 As we revisit our diagram, in this demonstration, 00:00:10.560 --> 00:00:13.050 we're going to focus on the administrator's machine. 00:00:13.840 --> 00:00:16.510 What I've done is I've already established an elevated 00:00:16.510 --> 00:00:19.150 agent on the IT administrator's machine. 00:00:20.340 --> 00:00:21.190 Using that agent, 00:00:21.280 --> 00:00:25.350 we will create an additional persistence method using a scheduled task. 00:00:27.740 --> 00:00:30.260 Another way that you can establish persistence is 00:00:30.260 --> 00:00:31.970 with the use of a scheduled task. 00:00:32.540 --> 00:00:35.150 Let's take a look at how this can be done using Empire. 00:00:36.440 --> 00:00:40.070 I'm going to interact with my administrative elevated agent, 00:00:41.040 --> 00:00:43.440 and I'll confirm the details of the target machine using 00:00:43.440 --> 00:00:46.420 the sysinfo command, and we can see that we are currently 00:00:46.420 --> 00:00:48.170 logged in as the admin user. 00:00:49.440 --> 00:00:53.410 Let's set up a scheduled task by using the module under 00:00:53.410 --> 00:00:57.050 persistence, elevated, scheduled tasks. 00:00:58.720 --> 00:01:00.600 Let's take a look at the options that's available. 00:01:01.510 --> 00:01:04.349 There are a number of options that's available for us to use. 00:01:04.940 --> 00:01:09.640 We can define the agent name, Listener. We can go and obfuscate 00:01:09.640 --> 00:01:14.560 the commands, bypass the antimalware scripting interface, and we 00:01:14.560 --> 00:01:16.600 can define things like the daily time, 00:01:17.040 --> 00:01:20.590 and this will be the trigger time for the script. And we can also set 00:01:20.590 --> 00:01:23.400 up an idle time in which the script will trigger. 00:01:25.330 --> 00:01:29.910 We can define the OnLogan option, and this is a good option to keep enabled. 00:01:30.340 --> 00:01:30.960 Ultimately, 00:01:30.960 --> 00:01:34.580 what it means is when the machine is rebooted and the user 00:01:34.580 --> 00:01:37.870 logs in, the schedule task is kicked off. 00:01:38.540 --> 00:01:42.910 We can define the task name and registry path, and with these two options, 00:01:43.250 --> 00:01:47.020 it would be a good practice to define values that are not obvious to 00:01:47.020 --> 00:01:50.170 the persistence task. In the interest of the demo, I'm going to 00:01:50.170 --> 00:01:52.590 change the task name to something obvious, 00:01:53.040 --> 00:01:56.480 and I'm going to leave the values for the daily time and the registry path 00:01:56.740 --> 00:02:00.030 as it is. Of course, you can tweak this as you please. 00:02:00.390 --> 00:02:02.550 I'm going to go ahead now and execute this module, 00:02:03.360 --> 00:02:06.360 and I get the warning about it not being OPSEC safe. 00:02:06.450 --> 00:02:09.639 I'm going to accept this, and our Empire goes ahead and 00:02:09.639 --> 00:02:12.270 creates the persistence scheduled task. 00:02:12.900 --> 00:02:17.210 Let's go ahead now and trigger this task to see what happens. Now I 00:02:17.210 --> 00:02:21.230 will go ahead and issue the command to run the scheduled task. And as 00:02:21.230 --> 00:02:23.410 soon as it has been successfully executed, 00:02:23.690 --> 00:02:27.370 we see an agent pops up. And notice that this new agent has 00:02:27.370 --> 00:02:29.760 been established under the system context. 00:02:30.400 --> 00:02:35.380 This ultimately gives us an agent to the remote system under the system context, 00:02:35.610 --> 00:02:37.450 which is the highest privilege possible. 00:02:37.940 --> 00:02:40.490 From here, we can perform various other tasks 00:02:40.940 --> 00:02:42.770 without worrying about permissions.