WEBVTT 00:00:02.240 --> 00:00:02.960 In this demo, 00:00:02.970 --> 00:00:07.050 we're going to use our Pupy sessions to capture a user input from our targets. 00:00:07.490 --> 00:00:10.640 We're going to use Pupy's tools to capture user activities 00:00:10.650 --> 00:00:13.760 like taking screenshots and then transfer that information to 00:00:13.760 --> 00:00:15.550 our Pupy server for later use. 00:00:16.239 --> 00:00:18.930 Using these tools enables a hacker to transfer files 00:00:18.930 --> 00:00:21.580 and capture screenshots, keystrokes, mouse clicks, 00:00:21.590 --> 00:00:23.150 audio, and even video. 00:00:23.740 --> 00:00:25.530 If you're ready to gather some information, 00:00:25.700 --> 00:00:29.430 let's head over to our Pupy server and get started. Time for 00:00:29.430 --> 00:00:32.380 the last step in making use of our Pupy sessions, gathering 00:00:32.380 --> 00:00:33.950 information from our clients. 00:00:34.540 --> 00:00:37.850 We'll start with our Windows 7 target and try to gather some files. 00:00:38.340 --> 00:00:41.350 First, we want to run commands only on our Windows 7 session. 00:00:41.740 --> 00:00:45.150 From this menu, we have two choices to interact with our Windows 7 target. 00:00:45.840 --> 00:00:48.380 Let's use session 3 since it has system‑level 00:00:48.380 --> 00:00:51.460 permissions. We can then use the ls command, 00:00:51.620 --> 00:00:54.100 followed by a directory we want to view the contents 00:00:54.100 --> 00:00:56.140 of. Let's take a look the C drive. 00:00:57.020 --> 00:00:59.050 Let's take a closer look at the Users directory. 00:01:00.140 --> 00:01:02.150 From here, we see the IEUser directory. 00:01:02.570 --> 00:01:05.050 Let's actually go one step further and explore that 00:01:05.050 --> 00:01:07.670 user's desktop. For this example, 00:01:07.680 --> 00:01:11.150 I'm going to try and pull the entire shortcuts folder back to the Pupy server. 00:01:11.590 --> 00:01:13.150 There's nothing that interesting in here, 00:01:13.540 --> 00:01:15.900 but as you can see here, once you have a Pupy session, 00:01:15.980 --> 00:01:18.370 you're free to explore any directory you want, 00:01:18.380 --> 00:01:21.520 including a user's personal desktop and documents. 00:01:21.940 --> 00:01:25.450 Let's go ahead and try to pull an entire folder over to our Pupy server. 00:01:26.110 --> 00:01:29.260 To do that, we just need to run the command to download the directory, 00:01:29.270 --> 00:01:32.720 followed by the directory we want in quotes, similar to our 00:01:32.720 --> 00:01:36.050 ls command. Let's take a quick look at it. 00:01:36.840 --> 00:01:38.950 Once we navigate all the way down into that path, 00:01:39.440 --> 00:01:43.760 we can see the original directory structure, C:/users/IEUser/desktop 00:01:43.770 --> 00:01:47.450 shortcuts and all the shortcuts I had placed in that folder. 00:01:47.940 --> 00:01:50.660 Although the contents of this particular folder aren't 00:01:50.660 --> 00:01:53.050 anything that a hacker might be interested in, 00:01:53.360 --> 00:01:56.540 this command could be used by hackers to pull down important files 00:01:56.620 --> 00:02:00.420 containing personally identifiable information or important business 00:02:00.420 --> 00:02:04.550 documents if they were accessible under these same permissions. Let's look 00:02:04.550 --> 00:02:06.620 at one more tool that's a little bit more fun, 00:02:06.870 --> 00:02:08.850 and that would be in the screenshot tool. 00:02:09.389 --> 00:02:11.520 Let's take a quick screenshot of our Windows target. 00:02:11.880 --> 00:02:15.450 All we have to do is type screenshot into our Pupy server interface, 00:02:16.040 --> 00:02:18.050 and now we can pull up that image. 00:02:21.640 --> 00:02:22.620 And there it is. 00:02:23.340 --> 00:02:26.310 This feature has potential use for gathering any information 00:02:26.310 --> 00:02:28.450 the victim might have open on their desktop. 00:02:29.210 --> 00:02:31.860 Let's look at one more tool, the ability to open a remote 00:02:31.860 --> 00:02:33.750 desktop session through a web browser. 00:02:34.640 --> 00:02:36.710 If you prefer to interact with your target over a 00:02:36.710 --> 00:02:38.440 GUI rather than the command line, 00:02:38.450 --> 00:02:41.360 you can even open a remote desktop session with a 00:02:41.360 --> 00:02:43.150 victim using the rdesktop tool. 00:02:44.540 --> 00:02:50.210 Once run, it gives you a web address, which you can then plug into your browser. 00:02:51.690 --> 00:02:54.340 Now we can explore the machine using the GUI and find 00:02:54.340 --> 00:02:56.750 additional files to download to our Pupy server. 00:02:57.440 --> 00:03:00.930 We can also upload files to our victim using Pupy and run attacks 00:03:00.940 --> 00:03:03.950 on other network machines from our RDP session. 00:03:04.980 --> 00:03:06.660 To recap what we learned in this demo, 00:03:06.830 --> 00:03:09.900 we started out downloading a directory from our victim's desktop 00:03:09.900 --> 00:03:13.160 to our Pupy server and viewing the contents. We then took a 00:03:13.160 --> 00:03:15.860 screenshot of the victim's desktop to see if any valuable 00:03:15.860 --> 00:03:17.750 information was displayed on the screen. 00:03:18.840 --> 00:03:19.420 Finally, 00:03:19.430 --> 00:03:21.510 we opened a remote desktop session in our web 00:03:21.510 --> 00:03:23.850 browser using the user's credentials. 00:03:24.540 --> 00:03:26.750 This brings us to the end of our course on Pupy. 00:03:27.400 --> 00:03:29.710 There are many more tools and modules to explore, 00:03:29.800 --> 00:03:32.550 and I hope I've captured your interest in its ability as a 00:03:32.550 --> 00:03:35.150 post exploitation command and control server. 00:03:35.840 --> 00:03:39.150 Next up, we have a quick overview of additional resources.