WEBVTT 00:00:01.140 --> 00:00:02.760 Welcome to our lab environment. 00:00:03.140 --> 00:00:04.900 I have in here two machines. 00:00:05.100 --> 00:00:09.860 This one here is my attacker machine, which is a Kali Linux version 2021. 00:00:10.640 --> 00:00:13.260 This other one here is my victim machine, 00:00:13.270 --> 00:00:17.560 which is a Windows 2016 Server, and this sever is actually 00:00:17.560 --> 00:00:19.380 a domain controller in my environment. 00:00:19.380 --> 00:00:22.780 For this demo, we're assuming that you already got access to a 00:00:22.780 --> 00:00:25.190 machine and you're trying to build persistence, 00:00:25.190 --> 00:00:27.680 so you can come back anytime you want. 00:00:27.680 --> 00:00:31.160 For this demo, I have the credentials to one of the admins. 00:00:31.740 --> 00:00:33.450 So okay, let's start by the beginning. 00:00:33.450 --> 00:00:37.350 First, let's go to our attacker machine and install the Impacket in there. 00:00:38.240 --> 00:00:41.240 Let me quickly open the terminal and then create a 00:00:41.240 --> 00:00:42.660 folder so we can work from it. 00:00:44.840 --> 00:00:45.480 Perfect. 00:00:45.490 --> 00:00:48.220 Now we need to download the content of the Impacket 00:00:48.220 --> 00:00:49.960 GitHub into my attacker machine. 00:00:50.640 --> 00:00:53.400 And the easiest way of doing that is copying the URL of the 00:00:53.400 --> 00:00:58.600 repository and then using the command git clone to download 00:00:58.610 --> 00:01:00.160 all the data from the repository. 00:01:02.540 --> 00:01:05.500 Done. Now we have the Impacket files in my machine. 00:01:05.500 --> 00:01:10.480 And the easiest way to install this tool is using the Python pip command. 00:01:10.480 --> 00:01:14.270 So let me just make sure that I have the pip installed on here. 00:01:14.270 --> 00:01:21.650 For that, I'll use apt‑get install python3‑pip. 00:01:21.650 --> 00:01:25.340 And this might take a little while, 00:01:25.340 --> 00:01:27.450 so I'll speed up this video to save us some time. 00:01:29.840 --> 00:01:30.670 Perfect, done. 00:01:30.670 --> 00:01:34.360 Now that we have everything we need, the installation process is really simple. 00:01:34.940 --> 00:01:37.620 I'll go inside the Impacket folder that we downloaded, 00:01:37.620 --> 00:01:48.410 and then I'll use the command python3 ‑m pip install and then dot, meaning 00:01:48.410 --> 00:01:50.860 that I want to install the files from this folder in here. 00:01:52.140 --> 00:01:56.000 Once I press Enter, the pip will review the requirements for Impacket, 00:01:56.000 --> 00:01:58.560 and it will install any libraries that are necessary. 00:02:00.640 --> 00:02:04.840 Perfect. Impacket is now installed, and you can even take a look at some of 00:02:04.840 --> 00:02:09.060 the out‑of‑the‑box scripts that comes with this tool. For that, I'll go to 00:02:09.060 --> 00:02:15.440 the folder examples and list what is in there. As you can see, I have a lot 00:02:15.440 --> 00:02:21.470 of interesting scripts here, like mimikatz, smbserver, secretsdump, and much 00:02:21.470 --> 00:02:25.730 more. To make sure everything is working, I will try to connect to my victim 00:02:25.730 --> 00:02:32.060 server using the WMI protocol. For that, I'll use this wmiexec script here. 00:02:33.040 --> 00:02:42.100 So let's type python3, then wmiexec.py. Then, after that, I'll type the 00:02:42.100 --> 00:02:46.160 username that I want to use and the IP of my target machine. 00:02:47.440 --> 00:02:50.250 Then, once I run this, it would ask the password for the 00:02:50.250 --> 00:02:52.860 account that I'm using. And that's it. 00:02:53.240 --> 00:02:58.150 Take a look. We have now a shell to the machine. As you can see, I'm logged as 00:02:58.150 --> 00:03:01.050 Kenny, and I can even see the IP address of the machine. 00:03:01.840 --> 00:03:02.650 Pretty cool, right? 00:03:03.040 --> 00:03:06.290 That's a way to execute remote commands in a machine using the 00:03:06.290 --> 00:03:10.880 terminal. But okay, we are here to create persistence. So let me close 00:03:10.880 --> 00:03:13.360 the shell and clear my screen for the next demo.