WEBVTT 00:00:02.140 --> 00:00:03.650 All right, in this first demo, 00:00:03.660 --> 00:00:06.810 we're going to start the Pupy server and look at how to navigate through 00:00:06.810 --> 00:00:09.320 the tool and how to use some of the basic options. 00:00:09.690 --> 00:00:10.700 To accomplish this, 00:00:10.710 --> 00:00:13.960 I'm going to show you how to start the Pupy server on your hacking workstation, 00:00:14.210 --> 00:00:16.620 generate a client file and run it on a target, 00:00:16.730 --> 00:00:20.250 and explore the interface and available actions to take against the target. 00:00:20.640 --> 00:00:23.450 Let's head over to our hacking workstation and get started. 00:00:24.340 --> 00:00:28.690 I installed Pupy on a 64‑bit Kali Linux image obtained from the Offensive 00:00:28.690 --> 00:00:32.450 Security website using the instructions on Pupy's GitHub page. 00:00:32.880 --> 00:00:36.080 I did not use the Docker installation instructions for this course, 00:00:36.260 --> 00:00:38.900 but the instructions are available, if that's your preference. 00:00:39.610 --> 00:00:41.180 If you have not done so already, 00:00:41.190 --> 00:00:46.630 one other command you'll need to run is the pip install ‑r requirements.txt 00:00:46.640 --> 00:00:50.250 from the directory where the requirements.txt file is located. 00:00:51.240 --> 00:00:54.890 The two targets I'll be using in this course are a Window 7 image 00:00:54.890 --> 00:00:57.850 from Microsoft and the Metasploitable 2 image. 00:00:58.310 --> 00:01:01.150 Links to these images are in the exercise files. 00:01:01.570 --> 00:01:05.410 To get started, we need to open a terminal and navigate to our Pupy directory. 00:01:05.840 --> 00:01:06.460 From here, 00:01:06.470 --> 00:01:10.590 you'll run the pupysh file located in the bin folder in your Pupy workspace, 00:01:10.840 --> 00:01:12.450 which for me is along this path. 00:01:12.450 --> 00:01:15.600 And that's all we need to get it started. 00:01:15.660 --> 00:01:19.050 Our server is online and listening on port 443. 00:01:19.440 --> 00:01:21.260 Before we explore additional options, 00:01:21.390 --> 00:01:24.350 let's get a client session established from one of our targets. 00:01:25.440 --> 00:01:26.470 For this example, 00:01:26.660 --> 00:01:31.490 I'm starting with a reverse shell into a Windows 7 target over port 4444. 00:01:31.690 --> 00:01:34.890 If you want a quick way to get these shells up and focus on Pupy, 00:01:34.910 --> 00:01:38.340 I recommend using msfvenom to generate an EXE 00:01:38.340 --> 00:01:40.150 payload and run it from your target. 00:01:40.540 --> 00:01:44.490 Now we have to generate a Pupy client to run from our shell and establish a 00:01:44.490 --> 00:01:49.250 session with the Pupy server. To create a basic client that establishes a 00:01:49.250 --> 00:01:51.920 connection using the default SSL transport, 00:01:52.000 --> 00:01:53.610 we will use the gen tool. 00:01:54.040 --> 00:01:57.060 We will follow it with a ‑f to specify the format, 00:01:57.070 --> 00:01:58.750 which in our case will be client. 00:01:59.840 --> 00:02:03.950 We'll follow that with a ‑O to specify the Windows operating system 00:02:04.540 --> 00:02:08.199 and then a ‑A to specify a 64‑bit architecture. 00:02:08.740 --> 00:02:12.630 Next, we have to specify a launcher, which will be connect for this example. 00:02:12.980 --> 00:02:16.230 This tells the client to connect back to our Pupy server. 00:02:16.320 --> 00:02:20.450 So we need to specify that IP address using the ‑‑host command 00:02:21.340 --> 00:02:23.860 followed by the IP address of our Pupy server, 00:02:23.870 --> 00:02:27.640 which in my case is 192.168.1.35. 00:02:28.040 --> 00:02:31.030 We'll follow this with a colon and the port number, which 00:02:31.030 --> 00:02:34.830 since its SSL is 443, and then we have to specify the 00:02:34.830 --> 00:02:37.020 transport using the ‑t option. 00:02:37.380 --> 00:02:40.370 And as I said, we use ssl for the transport. 00:02:40.610 --> 00:02:41.950 Then we can generate the client. 00:02:42.740 --> 00:02:44.970 Once that completes, we see our file location, 00:02:45.090 --> 00:02:48.830 which we can copy to another location and rename and then send to our 00:02:48.830 --> 00:02:53.310 target for execution. To transfer the file over to the target, I place 00:02:53.310 --> 00:02:57.890 the file in the HTML directory of my hacking machine, started Apache, and 00:02:57.890 --> 00:03:01.610 created and ran a simple PowerShell script on the target through the 00:03:01.610 --> 00:03:03.100 shell to download the file. 00:03:03.640 --> 00:03:05.480 Once we confirm that it's on our target, 00:03:05.680 --> 00:03:09.690 we can run this shell and then go back to the 00:03:09.690 --> 00:03:11.420 terminal window with our Pupy server, 00:03:11.770 --> 00:03:15.150 and we see that a session has opened with our Windows 7 target. 00:03:15.640 --> 00:03:17.140 Once we have our session opened, 00:03:17.200 --> 00:03:20.870 we can use Pupy to take other actions against our target. Before 00:03:20.870 --> 00:03:23.660 we take any actions, let's take a closer look at the session 00:03:23.660 --> 00:03:25.650 between our target and the Pupy server. 00:03:26.240 --> 00:03:29.240 We can use Wireshark and see that our traffic between the 00:03:29.240 --> 00:03:32.970 target and our Pupy server is encrypted using SSL and 00:03:32.970 --> 00:03:34.950 appears as legitimate web traffic. 00:03:35.900 --> 00:03:39.250 Pupy has more transport options that we'll configure in the next demo. 00:03:39.740 --> 00:03:40.260 For now, 00:03:40.270 --> 00:03:43.000 let's go back to our server and look at some of the actions we 00:03:43.000 --> 00:03:46.420 can take on our target. We can view all available commands and 00:03:46.420 --> 00:03:49.450 modules using the help ‑M command. 00:03:49.940 --> 00:03:52.700 The commands are listed first and are all the options we 00:03:52.700 --> 00:03:54.450 can use to manage the Pupy server. 00:03:54.940 --> 00:03:58.270 Some examples are run to specify whether to run against one or 00:03:58.270 --> 00:04:02.010 multiple clients, sessions to list active sessions and interact 00:04:02.010 --> 00:04:05.610 with them, connect to connect to a bind payload if we use that 00:04:05.620 --> 00:04:07.110 instead of the reverse payload, 00:04:07.540 --> 00:04:09.910 listen to manage our listeners, and a few 00:04:09.910 --> 00:04:12.060 self‑explanatory commands like restart, 00:04:12.070 --> 00:04:16.019 help, and exit. Continuing on to the available modules, 00:04:16.029 --> 00:04:19.140 we can see that Pupy breaks the modules down into categories 00:04:19.140 --> 00:04:22.100 based on their function. The first category being admin 00:04:22.100 --> 00:04:25.240 modules that list files, copy files, 00:04:25.510 --> 00:04:29.780 start remote desktop sessions, and can enable or disable RDP, 00:04:29.790 --> 00:04:30.850 among other options. 00:04:31.320 --> 00:04:33.800 The admin functions also have commands that can be used for 00:04:33.800 --> 00:04:36.900 privilege escalation attacks, like beroot, which will try to 00:04:36.900 --> 00:04:39.050 discover different methods to accomplish this. 00:04:39.640 --> 00:04:41.870 The next category has modules that can retrieve 00:04:41.870 --> 00:04:44.050 credentials using a variety of techniques, 00:04:44.060 --> 00:04:45.600 including memory retrieval, 00:04:45.720 --> 00:04:49.350 dumping from Windows systems, and retrieving stored passwords. 00:04:49.940 --> 00:04:50.950 After credentials, 00:04:50.960 --> 00:04:54.130 we have exploit categories that allow you to run further 00:04:54.130 --> 00:04:57.170 exploits on the target to gain escalated privileges or 00:04:57.170 --> 00:04:58.850 maintain access to the system. 00:04:59.540 --> 00:05:03.980 The gather category includes multiple tools to get information from the target, 00:05:04.260 --> 00:05:08.450 including a keylogger, mouselogger, webcam tool, and screenshot tool, 00:05:08.460 --> 00:05:11.980 which we'll explore in a later demo. Under the manage category, 00:05:11.990 --> 00:05:14.330 there are functions for downloading files and also 00:05:14.340 --> 00:05:16.650 remotely editing files on the target system. 00:05:17.240 --> 00:05:20.390 The last three categories of modules include additional tools for 00:05:20.390 --> 00:05:23.720 privilege escalation, like getsystem, to attempt to get system 00:05:23.720 --> 00:05:27.990 privileges, and bypassusac, to attempt to avoid the user access 00:05:27.990 --> 00:05:30.750 control tool in Microsoft operating systems. 00:05:31.440 --> 00:05:34.520 There are also a few network commands that we can use to run 00:05:34.520 --> 00:05:36.750 a port scan or TCP dump on the target. 00:05:37.340 --> 00:05:42.420 And finally, a few commands under a troll category to pop up a message box or, 00:05:42.430 --> 00:05:46.150 if your target's a phone, make it vibrate or even say something. 00:05:46.840 --> 00:05:51.080 The last part of the help menu is a list of aliases you can use from the 00:05:51.080 --> 00:05:54.050 interface and their corresponding commands or modules. 00:05:54.740 --> 00:05:56.050 Before we go to the summary, 00:05:56.350 --> 00:05:59.200 let's run one troll command on our target and cause a 00:05:59.200 --> 00:06:00.950 message box to pop up on our screen. 00:06:01.440 --> 00:06:06.950 To do that, we'll type the message box command, msgbox, followed by our message. 00:06:09.240 --> 00:06:10.930 And when we go over to our target, 00:06:11.260 --> 00:06:14.770 we see the message box on the screen. In an actual 00:06:14.770 --> 00:06:17.560 penetration test, this would give you away and be 00:06:17.560 --> 00:06:19.250 something you would want to avoid doing. 00:06:19.640 --> 00:06:21.470 But since we're just practicing in the lab, 00:06:21.530 --> 00:06:24.950 go ahead and have fun. Before moving on, let's do a quick 00:06:24.950 --> 00:06:26.750 recap of what we learned in this demo. 00:06:27.380 --> 00:06:29.940 We went over the lab environment I'm using in this 00:06:29.950 --> 00:06:31.550 and other demos for this course. 00:06:32.140 --> 00:06:35.250 We then started up the Pupy server on our hacking workstation. 00:06:35.840 --> 00:06:36.310 Next, 00:06:36.310 --> 00:06:39.350 we generated a client file and ran it from a target that we had 00:06:39.350 --> 00:06:42.450 previously exploited to establish a session with the server. 00:06:43.010 --> 00:06:44.970 We also looked at the traffic between the client and 00:06:44.970 --> 00:06:48.270 server using Wireshark and confirmed that it's using SSL 00:06:48.270 --> 00:06:51.520 encryption over port 443. Finally, 00:06:51.530 --> 00:06:54.290 we explored and discussed the functions within Pupy that 00:06:54.290 --> 00:06:56.050 we can use once we have a session. 00:06:57.000 --> 00:06:59.700 In the next demo, we'll dig a little deeper into the transport and 00:06:59.710 --> 00:07:03.520 encryption options in Pupy to mask traffic and start clients on 00:07:03.520 --> 00:07:07.370 multiple target machines. We'll then manage multiple targets from a 00:07:07.370 --> 00:07:09.250 single Pupy server interface.