WEBVTT

00:00:00.540 --> 00:00:01.650
In this demonstration,

00:00:02.140 --> 00:00:08.420
we will use the PowerBreach module within Empire to create a dead user attack.

00:00:08.420 --> 00:00:11.590
This attack works by either creating the user account or

00:00:11.590 --> 00:00:13.760
leveraging an existing user account.

00:00:14.240 --> 00:00:19.410
The PowerBreach module then set up a task that looks for that specific user.

00:00:20.340 --> 00:00:25.180
As long as that user exists, a reverse persistent shell will not be established.

00:00:25.840 --> 00:00:28.590
However, as soon as the user is deleted,

00:00:29.240 --> 00:00:31.890
a new persistent agent will then be established.

00:00:32.800 --> 00:00:37.740
This is often seen in real world attacks where APT groups monitor

00:00:37.740 --> 00:00:39.860
for specific high privileged user accounts,

00:00:40.090 --> 00:00:42.120
and as soon as those accounts are deleted,

00:00:42.270 --> 00:00:45.760
a persistent agent is then established back to the attackers.

00:00:46.440 --> 00:00:48.940
As we revisit the diagram, in this attack,

00:00:48.950 --> 00:00:51.450
we're going to make use of the IT administrators machine.

00:00:52.140 --> 00:00:54.690
I have used the previous demos to establish an

00:00:54.690 --> 00:00:57.570
elevated agent on the IT admins machine.

00:00:57.940 --> 00:01:01.480
I'll get started by interacting with the administrators machine and the first

00:01:01.480 --> 00:01:04.440
thing that I will do is query the existing user accounts.

00:01:04.730 --> 00:01:08.440
I'm going to issue a shell command and I'm going to use the net user command

00:01:08.450 --> 00:01:11.850
to see what user accounts currently exist on this machine.

00:01:11.950 --> 00:01:15.760
One account that is of interest to me is the help desk user account.

00:01:16.090 --> 00:01:18.090
The reason why it's interesting is because this

00:01:18.090 --> 00:01:21.150
account could probably be a local admin.

00:01:21.150 --> 00:01:24.930
Generally in organizations, they have a local administrator account,

00:01:24.990 --> 00:01:30.390
which is using the same password across all the endpoints and this is a

00:01:30.390 --> 00:01:34.650
real bad practice because this is an easy lateral movement path, but

00:01:34.650 --> 00:01:36.410
this course is not about lateral movement.

00:01:36.610 --> 00:01:39.640
Let's make use of that help desk user account and

00:01:39.640 --> 00:01:41.150
use it for the PowerBreach deck.

00:01:41.830 --> 00:01:47.360
I'm going to go ahead now and use the module persistence/powerbreach,

00:01:47.940 --> 00:01:51.350
and under PowerBreach, we have the deaduser module.

00:01:51.730 --> 00:01:53.380
Let's look at the options for this,

00:01:53.940 --> 00:01:56.750
and you can see that we've got options such as the agent name,

00:01:57.000 --> 00:01:59.740
the listener, the username, and of course,

00:01:59.740 --> 00:02:02.860
if this was a domain account, you can specify the domain name.

00:02:03.800 --> 00:02:06.670
Now there is a number of timeout options that you can modify,

00:02:06.720 --> 00:02:07.970
such as the timeout,

00:02:07.980 --> 00:02:11.130
and this equates to the time in seconds for the backdoor to run.

00:02:11.470 --> 00:02:13.850
If you leave it at 0, it will, of course, run forever.

00:02:14.440 --> 00:02:15.970
And then we've got the sleep timer.

00:02:16.340 --> 00:02:20.920
Now I've already set the sleep timer to 5 seconds for the interest of the demo.

00:02:21.300 --> 00:02:23.910
So I'm going to execute this module now and now the

00:02:23.910 --> 00:02:25.550
module has completed successfully.

00:02:25.940 --> 00:02:29.750
What I will now do is delete that help desk user account.

00:02:30.240 --> 00:02:34.090
And as soon as I delete the account, once the sleep timer triggers,

00:02:34.370 --> 00:02:37.310
we should get a new persistent agent established.

00:02:37.740 --> 00:02:41.670
So I'll use the net user command sequence to delete the help desk user, and

00:02:41.670 --> 00:02:44.340
before I could even confirm that the account has been deleted,

00:02:44.620 --> 00:02:46.280
we now have a new persistent agent.

00:02:46.840 --> 00:02:50.010
Let's confirm that the account really is deleted and now the

00:02:50.010 --> 00:02:52.270
help desk user account no longer exists.

00:02:53.240 --> 00:02:57.400
We'll switch back to our agents list and you can see now that the new

00:02:57.420 --> 00:03:00.770
persistent agent has been established from the same administrator

00:03:00.770 --> 00:03:03.650
machine and it is a high integrity agent.