WEBVTT

00:00:02.140 --> 00:00:03.560
All right, in this demo,

00:00:03.570 --> 00:00:06.410
we're going to be looking at configuring different transport options

00:00:06.410 --> 00:00:09.490
and establishing multiple client sessions using Pupy.

00:00:10.040 --> 00:00:12.940
To do that, we're going to configure transport encryption options

00:00:12.940 --> 00:00:16.640
to mask our traffic and start clients on multiple targets to

00:00:16.640 --> 00:00:18.750
establish sessions with our Pupy server.

00:00:19.340 --> 00:00:22.970
These features will allow you to establish multiple simultaneous sessions

00:00:23.130 --> 00:00:25.750
and manage multiple targets from a single interface.

00:00:26.370 --> 00:00:29.630
These techniques will also allow you to use different options to mask your

00:00:29.630 --> 00:00:34.210
traffic and make it appear legitimate to network monitoring services. If

00:00:34.210 --> 00:00:36.550
you're ready to continue exploring Pupy's features,

00:00:36.940 --> 00:00:39.450
let's head over to our hacking machine and get started.

00:00:40.230 --> 00:00:43.870
The method we will use to establish multiple transport sessions is to set up

00:00:43.870 --> 00:00:48.450
additional listeners and create clients that use other transport methods. To

00:00:48.450 --> 00:00:52.030
view the available listeners and default setting, we can type the config

00:00:52.030 --> 00:00:54.950
list command and scroll to listeners.

00:00:55.940 --> 00:01:00.180
Here you can see the available listeners within Pupy. To add one of these, we

00:01:00.180 --> 00:01:04.950
will use the listen ‑a command followed by the listener type we want to add.

00:01:05.540 --> 00:01:08.350
For this example, we'll try out the rsa listener.

00:01:09.590 --> 00:01:13.030
Now that we set that up and see the confirmation that Pupy is listening on port

00:01:13.030 --> 00:01:16.850
9091, we need to create a new client for our next target.

00:01:17.440 --> 00:01:18.410
For my next target,

00:01:18.420 --> 00:01:22.560
I'm going to run Pupy on the Metasploitable VM in this lab. I

00:01:22.560 --> 00:01:26.370
exploited the vsftpd vulnerability using Metasploit to gain a

00:01:26.370 --> 00:01:28.250
command shell with root access.

00:01:28.740 --> 00:01:31.950
Now we just need a Pupy client. So we use the gen tool again,

00:01:32.340 --> 00:01:35.530
and this time we'll specify a Linux operating system using

00:01:35.530 --> 00:01:39.350
‑O and an x86 architecture using ‑A.

00:01:40.140 --> 00:01:43.310
We use the connect method again and specify our Pupy

00:01:43.310 --> 00:01:46.540
server IP using the ‑‑host option,

00:01:46.780 --> 00:01:50.830
which in my case is 192.168.1.35. And then we'll

00:01:50.830 --> 00:01:55.700
use a colon to specify the port, which this time will be 9091.

00:01:56.240 --> 00:02:00.850
The last option we need is to specify rsa as the transport using the ‑t option.

00:02:01.320 --> 00:02:03.190
Once we confirm our new client is created,

00:02:03.200 --> 00:02:05.680
we just need to move it to our new target using our shell

00:02:05.690 --> 00:02:09.449
and run it. Once again, I'm going to transfer it over HTTP.

00:02:10.340 --> 00:02:11.670
Now we just need to transfer it,

00:02:11.680 --> 00:02:15.450
which is as easy as running a wget to move it to the Metasploitable client.

00:02:17.040 --> 00:02:21.250
Then we just need to make it executable, and then we run it.

00:02:25.140 --> 00:02:27.150
And then when we come back at our Pupy server,

00:02:27.160 --> 00:02:30.710
we see another session opened, this time with root permissions on our

00:02:30.710 --> 00:02:36.400
Metasploitable client using RSA as transport over port 9091. So now when we

00:02:36.400 --> 00:02:39.450
run the sessions command, we can see both of our sessions,

00:02:39.940 --> 00:02:43.060
the user ID that we've logged onto each with, and a little bit

00:02:43.060 --> 00:02:45.050
of information about each of our targets.

00:02:45.590 --> 00:02:47.740
Let's look at these sessions in Wireshark to see if they're

00:02:47.740 --> 00:02:49.750
both encrypted and how they're communicating.

00:02:50.640 --> 00:02:55.650
So I'll take a look at the Metasploitable target first and follow this stream.

00:02:56.250 --> 00:03:00.800
And when I follow this TCP stream going between our client and our Pupy server

00:03:00.810 --> 00:03:04.320
over port 9091, we can see the traffic is indeed encrypted,

00:03:04.330 --> 00:03:07.410
just like the SSL traffic with our Windows 7 client.

00:03:08.540 --> 00:03:11.700
So we can now mask our traffic using two different encryption methods

00:03:11.710 --> 00:03:16.190
between our server and each of our clients. Before we move on to the next

00:03:16.190 --> 00:03:18.990
demo, let's go over a quick recap of what we covered.

00:03:19.740 --> 00:03:23.810
We started this module by adding a new listener using the RSA transport option

00:03:23.820 --> 00:03:27.550
to encrypt our session, using RSA instead of the default SSL.

00:03:28.440 --> 00:03:31.050
We then generated a new client targeting a vulnerable

00:03:31.050 --> 00:03:33.150
Linux machine we had already hacked into.

00:03:34.240 --> 00:03:37.410
We established the session with the Pupy server over RSA with the

00:03:37.410 --> 00:03:40.830
Linux machine, and we observed the traffic between the client and

00:03:40.830 --> 00:03:45.480
server using Wireshark. In the next demo, we'll manage these

00:03:45.480 --> 00:03:48.940
sessions and explore additional tools to find credentials and

00:03:48.940 --> 00:03:50.950
escalate privileges on our targets.