WEBVTT

00:00:01.940 --> 00:00:02.490
Hey there.

00:00:02.500 --> 00:00:05.330
Welcome to the course, Persistence with Impacket.

00:00:05.330 --> 00:00:06.550
In here,

00:00:06.560 --> 00:00:09.720
you'll learn how to create a foothold on your target environment

00:00:09.730 --> 00:00:12.060
so you can access it at any time you want.

00:00:13.340 --> 00:00:14.780
So, imagine that.

00:00:14.780 --> 00:00:17.790
Imagine that you're working as a red team specialist and

00:00:17.790 --> 00:00:19.710
trying to compromise an environment.

00:00:19.710 --> 00:00:22.550
We have in here some servers on the right side,

00:00:22.560 --> 00:00:25.330
and they use their laptops that connect to those servers.

00:00:25.330 --> 00:00:29.360
After some time, you're able to compromise one user laptop,

00:00:29.740 --> 00:00:32.950
and from there you compromise some of the internal servers.

00:00:33.540 --> 00:00:34.350
Pretty cool, right?

00:00:34.740 --> 00:00:35.090
Now,

00:00:35.090 --> 00:00:38.020
let's say that people in our target detected some of your actions

00:00:38.030 --> 00:00:40.260
and they patched the vulnerability you exploited.

00:00:40.840 --> 00:00:43.490
So, if you didn't create any type of persistence,

00:00:43.530 --> 00:00:46.150
this would mean that you'd lose access to the whole environment.

00:00:46.940 --> 00:00:50.720
But, if you learn about Impacket, right after exploiting the servers,

00:00:50.730 --> 00:00:54.090
you'd create some persistence on the servers so you could access the

00:00:54.090 --> 00:01:00.100
servers at any time you want, even if the target patches the servers. There

00:01:00.100 --> 00:01:03.260
are several ways of creating persistence, and although you could do

00:01:03.260 --> 00:01:06.480
everything manually, there are a few tools out there that can help you to

00:01:06.480 --> 00:01:08.150
automate the creation of persistence.

00:01:08.840 --> 00:01:14.410
My favorite one is Impacket. Impacket is a really known Python library that

00:01:14.410 --> 00:01:19.270
allows you to interact with network packets and low‑level protocols. In

00:01:19.270 --> 00:01:23.400
reality, Impacket can do much more than persistence. It can help you through

00:01:23.400 --> 00:01:27.760
the whole red team engagement, but in here we'll focus on the features that

00:01:27.760 --> 00:01:29.460
can help us to build persistence.

00:01:30.240 --> 00:01:34.970
This too is maintained by the SecureAuth Corporation, but it has more than 115

00:01:34.970 --> 00:01:38.840
contributors. By the amount of people in the team, you can imagine that this

00:01:38.840 --> 00:01:41.250
tool is a really important tool in red teaming.

00:01:42.840 --> 00:01:46.360
What I love about Impacket is that it's an open source tool, meaning that

00:01:46.360 --> 00:01:48.860
you can download and use the tool as much as you want.

00:01:49.440 --> 00:01:52.050
You can even create your own custom scripts based on it.

00:01:52.940 --> 00:01:57.390
As I mentioned, Impacket is a Python library that allows you to interact with

00:01:57.390 --> 00:02:01.220
network packets and several Microsoft protocols. For example,

00:02:01.230 --> 00:02:06.340
you can create custom SMB packets with this tool, but in my opinion, the

00:02:06.340 --> 00:02:09.710
beauty of this framework is the several out‑of‑the‑box scripts for

00:02:09.710 --> 00:02:13.800
privilege escalation and persistence. As you'll see in the demos, they

00:02:13.800 --> 00:02:17.520
already created for us several tools that you can simply execute from the

00:02:17.520 --> 00:02:21.990
command line, and there are dozens of tools there, like the WMI Persist,

00:02:22.000 --> 00:02:28.030
Wmiexec, Active Directory Recon tools, Minikatz in Python, SecretsDump,

00:02:28.040 --> 00:02:28.960
and so on.

00:02:30.740 --> 00:02:33.030
If you're familiar with the kill chain methodology,

00:02:33.040 --> 00:02:36.820
we can use the Impacket from after the exploitation phase all the way to

00:02:36.820 --> 00:02:41.000
the action phase, meaning that after exploiting a machine, we can use the

00:02:41.000 --> 00:02:44.800
Impacket library to pretty much all the other steps, including escalating

00:02:44.800 --> 00:02:46.550
privileges and creating persistence.

00:02:48.540 --> 00:02:51.330
Also, if you're familiar with the MITRE ATT&CK framework,

00:02:51.340 --> 00:02:56.160
we can map this course to two phases, the persistence and execution.

00:02:57.240 --> 00:03:00.330
The main technique that we'll be focusing on in this course is the

00:03:00.330 --> 00:03:06.270
T1546, called event triggered execution. In more specific, we'll be

00:03:06.270 --> 00:03:10.710
executing this sub‑technique 003, which is Windows Management

00:03:10.710 --> 00:03:12.660
Instrumentation event subscription.

00:03:13.140 --> 00:03:16.170
And this sounds like a complicated name, but basically we'll create

00:03:16.170 --> 00:03:18.660
a hidden task that executes every few seconds.

00:03:19.740 --> 00:03:20.910
Also as a bonus,

00:03:20.920 --> 00:03:26.370
I want to show you two more techniques that can be interesting, like the T1078

00:03:26.380 --> 00:03:30.120
in which you collect several existing accounts in the server, so you can try

00:03:30.120 --> 00:03:32.360
to use those accounts to log into your target.

00:03:33.340 --> 00:03:37.570
And, we'll also discuss how to use Impacket to execute files via

00:03:37.570 --> 00:03:40.860
WMI, or Windows Management Instrumentation.

00:03:41.440 --> 00:03:43.780
As you can see, a lot of interesting stuff in here.

00:03:43.930 --> 00:03:45.550
So, let's talk about the demo.

00:03:47.440 --> 00:03:51.040
So for this demo, we will have two machines, one is the attacker

00:03:51.040 --> 00:03:55.580
machine and one is the target machine. In here, we assume that you

00:03:55.580 --> 00:03:58.450
have already compromised the server, which could be using a

00:03:58.450 --> 00:04:00.160
vulnerability or a compromised account.

00:04:01.240 --> 00:04:04.560
Once we have access to the server, we can then create persistence.

00:04:05.240 --> 00:04:08.880
What we are doing here is creating a reverse shell payload and using

00:04:08.880 --> 00:04:13.370
Impacket to transfer it to the target. Impacket will also create a

00:04:13.370 --> 00:04:17.170
scheduled event that runs every few seconds, making sure the reverse

00:04:17.170 --> 00:04:21.269
shell is being executed. Once we have the reverse shell payload

00:04:21.279 --> 00:04:25.340
implanted into the server, even if you lose the original point of entry,

00:04:25.350 --> 00:04:28.460
the server will still try to connect to your machine every few

00:04:28.460 --> 00:04:33.620
seconds. In this way, all we have to do is open a listener and we

00:04:33.620 --> 00:04:35.160
have a direct shell to the target.

00:04:35.840 --> 00:04:40.360
Pretty cool, right? If you want to follow this demo on your own environment,

00:04:40.370 --> 00:04:45.750
you need two things. First, you need an attacker machine. In here,

00:04:45.760 --> 00:04:50.540
I'm using a Kali Linux version 2021.2 because it contains pretty much

00:04:50.550 --> 00:04:54.740
everything we need for this demo. But in theory, you can use any

00:04:54.740 --> 00:04:56.460
Linux or Windows version you want.

00:04:57.340 --> 00:05:03.150
Also, you need a victim machine. In here, I'm using a Windows 2016 server,

00:05:03.540 --> 00:05:07.580
but you could use any Windows machine you want. And that's it.

00:05:07.590 --> 00:05:09.320
That's all we need for this demo.

00:05:09.330 --> 00:05:09.900
So,

00:05:09.910 --> 00:05:12.830
enough of theoryet's go to the lab environment and see how

00:05:12.830 --> 00:05:14.460
this technique is done in real life.