WEBVTT

00:00:01.640 --> 00:00:03.930
All right, welcome back to our Kali Linux.

00:00:03.930 --> 00:00:07.170
One of the most common ways of creating persistence is by

00:00:07.170 --> 00:00:09.820
installing a hidden reverse shell that connects back to

00:00:09.820 --> 00:00:11.660
our server every few seconds.

00:00:12.540 --> 00:00:15.400
So first, we need a reverse shell payload.

00:00:15.400 --> 00:00:17.670
In a real red team engagement,

00:00:17.680 --> 00:00:20.000
you can create your own custom reverse shell to try

00:00:20.000 --> 00:00:21.990
to bypass antivirus solutions.

00:00:21.990 --> 00:00:24.260
And here, to make things easier,

00:00:24.270 --> 00:00:27.160
I'll create a reverse shell payload using msfvenom,

00:00:27.540 --> 00:00:29.690
which is part of the Metasploit framework.

00:00:29.690 --> 00:00:33.150
With this tool, it is really simple to create a reverse shell.

00:00:33.840 --> 00:00:40.360
I just have to type msfvenom, then ‑p to define the payload that I want to use,

00:00:41.440 --> 00:00:44.930
then windows/meterpreter/reverse_tcp.

00:00:46.040 --> 00:00:49.140
Then, after that, I have to define the LHOST flag,

00:00:49.140 --> 00:00:52.150
which is the IP address of my attacker machine.

00:00:52.150 --> 00:00:58.020
Also, I'll define the LPORT to define which port my server will be listening to.

00:00:58.020 --> 00:00:59.040
And then,

00:00:59.040 --> 00:01:03.440
I will use the flag ‑f to define the type of payload that I want to use.

00:01:03.440 --> 00:01:05.110
And that's something to remember.

00:01:05.110 --> 00:01:08.330
This persistence attack only accepts Visual Basic payloads,

00:01:08.330 --> 00:01:11.150
so I have to use the VBS format here.

00:01:11.150 --> 00:01:16.780
Okay, now I just have to output this to a file, which I will call shell.vbs.

00:01:16.780 --> 00:01:21.650
Once I run this, msfvenom will create a Visual Basic reverse shell,

00:01:21.650 --> 00:01:23.460
and we'll save that into the file.

00:01:24.940 --> 00:01:25.210
Okay,

00:01:25.210 --> 00:01:28.230
then we can even take a look inside of the file just to make sure

00:01:28.230 --> 00:01:30.160
that we have a Visual Basic script in there.

00:01:31.540 --> 00:01:32.120
Perfect.

00:01:32.130 --> 00:01:34.300
Now we need to set up a listener for the shell,

00:01:34.300 --> 00:01:36.380
so then, when the script is executed,

00:01:36.380 --> 00:01:39.000
we are ready to get a reverse shell connection.

00:01:39.000 --> 00:01:40.290
For that,

00:01:40.300 --> 00:01:43.620
I will open a new terminal and run the Metasploit

00:01:43.620 --> 00:01:46.460
console using the command msfconsole.

00:01:48.640 --> 00:01:49.160
Perfect.

00:01:49.170 --> 00:01:53.350
In here, I'll use the exploit/multi/handler to receive the reverse shell.

00:01:54.540 --> 00:01:59.900
Then, let me set the payload as the windows/meterpreter/reverse_tcp shell.

00:01:59.900 --> 00:02:02.410
If you're not too familiar with Metasploit,

00:02:02.420 --> 00:02:04.760
I do recommend you pausing the video here and trying

00:02:04.760 --> 00:02:05.950
to understand what are we doing.

00:02:06.340 --> 00:02:09.949
The idea is creating a listener so when the payload is executed,

00:02:09.949 --> 00:02:11.160
we have a reverse shell.

00:02:12.340 --> 00:02:15.160
So okay, let me take a look at which options that I have set up in here.

00:02:16.340 --> 00:02:17.000
Take a look.

00:02:17.000 --> 00:02:19.270
It seems that the listening port is already set up,

00:02:19.270 --> 00:02:21.950
so I just have to configure the IP of my machine.

00:02:24.240 --> 00:02:30.060
Then, once I run this command, Metasploit will open a listener on port 4444.

00:02:30.440 --> 00:02:32.560
And whenever the Visual Basic shell is executed,

00:02:32.560 --> 00:02:34.660
we have access to the victim computer.

00:02:36.140 --> 00:02:38.320
All right, it seems that we have everything ready now.

00:02:38.320 --> 00:02:42.680
All we have to do is set up a WMI task on the victim computer that

00:02:42.680 --> 00:02:45.300
runs the Visual Basic script once in a while.

00:02:45.300 --> 00:02:49.450
And the good news here is that with Impacket, we can easily do that.

00:02:50.340 --> 00:02:55.370
So I'll go to the Impacket examples folder. And then in here, I'll use the

00:02:55.370 --> 00:02:59.620
wmipersist script. And the commander looked like this,

00:02:59.620 --> 00:03:02.980
python3 wmipersist.py.

00:03:02.980 --> 00:03:08.460
And then, now I have to put the domain the machine is registered to.

00:03:09.340 --> 00:03:14.710
In my case, my victim machine is part of the globomantics.com domain.

00:03:14.710 --> 00:03:15.900
After that,

00:03:15.900 --> 00:03:20.850
I'll use a slash and put the username that I want to use to execute the action.

00:03:21.640 --> 00:03:25.360
Remember, there's an admin user on the target machine.

00:03:25.360 --> 00:03:31.250
After that, I'll use the at sign and put the IP address of my target machine.

00:03:32.740 --> 00:03:33.310
Perfect.

00:03:33.320 --> 00:03:33.720
Now,

00:03:33.730 --> 00:03:38.190
I'll use the word install to specify that I want to install a new WMI task,

00:03:38.190 --> 00:03:42.860
and I'll add the flag ‑name to define the name of my task.

00:03:44.540 --> 00:03:45.110
After that,

00:03:45.110 --> 00:03:49.320
I will use the flag ‑vbs to specify the Visual Basic script

00:03:49.330 --> 00:03:51.350
that I want to execute in the victim computer.

00:03:52.240 --> 00:03:53.380
Remember, in here,

00:03:53.380 --> 00:03:57.350
I'll use the reverse shell payload that we created with msfvenom.

00:03:57.350 --> 00:04:03.390
And the last flag is the ‑time to specify the interval between the runtimes,

00:04:03.390 --> 00:04:06.050
and we specify this in milliseconds.

00:04:06.060 --> 00:04:11.140
So I'll use 1000 here, meaning that the script we will run once every second.

00:04:11.140 --> 00:04:15.140
In a real red team engagement, you should set up a longer interval,

00:04:15.140 --> 00:04:18.850
maybe once every 5 minutes, so you don't create too much noise.

00:04:18.850 --> 00:04:23.550
In my case, I'm using just 1 second so we don't have to be waiting for too long.

00:04:24.440 --> 00:04:25.810
Okay, once I run this,

00:04:25.820 --> 00:04:28.960
it will ask me for the password for the user account that I'm using.

00:04:29.540 --> 00:04:30.650
So let me quickly type it.

00:04:31.940 --> 00:04:32.550
Perfect.

00:04:32.560 --> 00:04:35.880
This script will now create a new WMI task and will

00:04:35.880 --> 00:04:37.660
sign the Visual Basic script to it.

00:04:38.940 --> 00:04:41.380
One important thing to note is that if the target

00:04:41.380 --> 00:04:44.660
server has any kind of antivirus, you might be detected.

00:04:45.440 --> 00:04:46.010
Take a look.

00:04:46.010 --> 00:04:49.130
In here, the Windows Defender detected my payload.

00:04:49.130 --> 00:04:52.240
And that's why in the beginning of this demo I mentioned

00:04:52.240 --> 00:04:53.770
that in a real red team engagement,

00:04:53.770 --> 00:04:57.470
it is recommended that you create your own code or you find

00:04:57.470 --> 00:04:59.450
a way to bypass the antivirus solution.

00:05:00.240 --> 00:05:02.600
As in here, I'm using a Metasploit payload.

00:05:02.610 --> 00:05:04.110
I knew that it would get detected,

00:05:04.110 --> 00:05:07.850
but that's okay here. For this demo, I will just allow this file

00:05:07.850 --> 00:05:10.160
in the antivirus so we can see how it works.

00:05:10.740 --> 00:05:12.840
But again, in a real red team engagement,

00:05:12.850 --> 00:05:15.960
make sure your payload is obfuscated so you're not detected.

00:05:16.840 --> 00:05:20.760
Okay, now that the file is allowed, let's take a look at my attacker machine.

00:05:21.840 --> 00:05:23.660
Let's go to the listener that we had created.

00:05:25.140 --> 00:05:25.740
Perfect.

00:05:25.750 --> 00:05:28.350
See here, we have a Meterpreter session to the machine.

00:05:28.840 --> 00:05:30.660
I can run any command I want.

00:05:30.660 --> 00:05:35.050
As you can see, the shell is running as a system, which is amazing.

00:05:35.060 --> 00:05:37.030
I have full access to the machine.

00:05:37.030 --> 00:05:40.250
And the best part is that now we have persistence.

00:05:40.940 --> 00:05:42.650
Even if I close this connection,

00:05:42.860 --> 00:05:47.330
I can just reopen my listener and wait for the new connection to come.

00:05:47.330 --> 00:05:50.070
See, got another shell.

00:05:50.070 --> 00:05:52.760
And this means that in a real red team engagement,

00:05:52.760 --> 00:05:54.250
you can close your attacker machine.

00:05:54.250 --> 00:05:57.470
And a few days later, if you want, you can just open a new listener,

00:05:57.470 --> 00:05:59.460
and you have access to the victim computer.

00:06:00.140 --> 00:06:00.860
Pretty cool, right?

00:06:02.240 --> 00:06:06.360
Now, let's say you finish your project, and you need to clean up the server.

00:06:06.360 --> 00:06:10.260
To remove the WMI task that we created is really simple.

00:06:10.640 --> 00:06:13.480
I'll use the same wmipersist command as before.

00:06:13.480 --> 00:06:16.150
But instead of using the command install,

00:06:16.160 --> 00:06:17.360
I'll use remove,

00:06:17.940 --> 00:06:20.800
and I'll use the ‑name flag to specify the name of

00:06:20.800 --> 00:06:22.350
the task that I had created before.

00:06:23.540 --> 00:06:27.150
Once I run this, the malicious script that was uploaded will be removed,

00:06:27.150 --> 00:06:29.860
and the WMI trigger will also be removed.

00:06:31.040 --> 00:06:34.160
Just make sure we can run the Metasploit listener again.

00:06:35.440 --> 00:06:37.850
And as you can see, we have no new connections,

00:06:37.850 --> 00:06:40.760
and this means that the WMI task was removed.