WEBVTT

00:00:05.340 --> 00:00:06.470
Hey there.

00:00:06.480 --> 00:00:09.750
Welcome to the course, Persistence with Impacket.

00:00:10.140 --> 00:00:12.250
In this Cybersecurity Tools course,

00:00:12.260 --> 00:00:15.140
you'll learn how to create persistence in compromised

00:00:15.150 --> 00:00:17.670
servers using the Impacket library.

00:00:17.680 --> 00:00:21.430
So, imagine you're working on a red team engagement.

00:00:21.430 --> 00:00:24.040
After getting initial access to a server,

00:00:24.050 --> 00:00:27.300
you need to maintain a foothold on the server so you

00:00:27.300 --> 00:00:32.430
can access it at any time you want, even if the initial vulnerability is patched.

00:00:32.430 --> 00:00:35.530
And one of the main ways of doing that is using Impacket

00:00:35.540 --> 00:00:38.170
to create hidden tasks in the system.

00:00:38.170 --> 00:00:41.810
In this course, we cover the Impacket framework,

00:00:41.820 --> 00:00:44.150
which allows you to perform several attacks,

00:00:44.540 --> 00:00:48.220
including creating WMI events and triggers to automate tasks.

00:00:49.340 --> 00:00:51.890
We start this course by discussing how you can

00:00:51.890 --> 00:00:53.990
leverage Impacket to create persistence.

00:00:54.840 --> 00:00:56.460
Then, in our first demo,

00:00:56.470 --> 00:00:59.930
you'll learn how to use Impacket and the WMI protocol to

00:00:59.930 --> 00:01:01.950
execute a file in a remote server.

00:01:02.940 --> 00:01:07.190
After that, in our main demo, you'll learn how to deploy a hidden reverse

00:01:07.190 --> 00:01:11.840
shell using Impacket, and this reverse shell would be useful for you to

00:01:11.850 --> 00:01:17.040
access the server at any time you want. And in our last demo, you'll learn

00:01:17.050 --> 00:01:21.610
how to use Impacket to harvest hash credentials, which can be useful to log

00:01:21.610 --> 00:01:23.550
into the servers later if you need.

00:01:24.040 --> 00:01:28.480
So, whether you're trying to establish persistence in a red team engagement or

00:01:28.480 --> 00:01:31.770
just testing the detection capabilities of your own company,

00:01:31.780 --> 00:01:34.720
join me in learning how to create persistence with

00:01:34.730 --> 00:01:37.560
Impacket, here at Pluralsight.