WEBVTT

00:00:00.740 --> 00:00:01.890
In this demonstration,

00:00:02.009 --> 00:00:04.880
we will look at how we can use Empire to establish

00:00:04.880 --> 00:00:07.550
remote desktop connectivity for C2.

00:00:07.940 --> 00:00:12.660
We will also use Empire to upload files for remote desktop capabilities,

00:00:12.660 --> 00:00:14.070
and in this case,

00:00:14.080 --> 00:00:19.050
we will use a commonly used tool by real‑world attackers called Ammyy Admin.

00:00:19.740 --> 00:00:23.760
Another way to perform command and control is to use remote desktop.

00:00:24.340 --> 00:00:27.670
Now there are various ways in which you can enable remote desktop.

00:00:28.540 --> 00:00:29.410
In this demonstration,

00:00:29.410 --> 00:00:31.790
we're going to look at how we can do this using the

00:00:31.790 --> 00:00:36.490
registry keys and how we can use a commonly used remote

00:00:36.490 --> 00:00:39.360
desktop program called Ammyy Admin.

00:00:40.240 --> 00:00:41.950
And when we use Ammyy Admin,

00:00:41.950 --> 00:00:47.240
we will upload the file to the target and from Empire using a shell command,

00:00:47.360 --> 00:00:50.690
we will install the Ammyy Admin as a service.

00:00:50.870 --> 00:00:53.090
You'll notice that I have used the previous

00:00:53.090 --> 00:00:55.390
demonstration on the Windows 10 machine,

00:00:55.400 --> 00:00:57.700
and I now have 5 agents reporting.

00:00:57.980 --> 00:00:59.820
They are essentially the same machines.

00:01:00.340 --> 00:01:05.209
I have 2 from the Windows 7 machine, one using the HTTP HOP jump server,

00:01:05.209 --> 00:01:09.020
and one using a normal HTTP listener, and the same for Windows.

00:01:09.020 --> 00:01:09.590
10.

00:01:09.880 --> 00:01:11.990
We'll begin with the Windows 10 session in which I

00:01:11.990 --> 00:01:14.040
have an administrative agent running.

00:01:14.040 --> 00:01:15.510
With the Windows 10 machine,

00:01:15.510 --> 00:01:19.150
we're going to use a registry key to enable remote desktop.

00:01:19.740 --> 00:01:23.760
Before we do this, let's double‑check if remote desktop is working or not.

00:01:24.740 --> 00:01:28.500
I will use a built‑in tool within Kali Linux called rdesktop,

00:01:28.500 --> 00:01:31.470
and when I issue the command, I am unable to connect.

00:01:31.480 --> 00:01:33.790
So this tells me that remote desktop is not working.

00:01:34.440 --> 00:01:37.760
In order to enable remote desktop, I'm going to use the registry key,

00:01:37.940 --> 00:01:40.620
and within Empire I'm going to issue a shell command

00:01:40.940 --> 00:01:43.040
followed by the registry command.

00:01:43.370 --> 00:01:45.550
Once the task is completed successfully,

00:01:45.810 --> 00:01:47.940
I am now going to try to connect to the Windows 10

00:01:47.940 --> 00:01:50.160
machine using the Remote Desktop Protocol.

00:01:50.540 --> 00:01:52.370
I'll use the same built‑in tool again,

00:01:52.740 --> 00:01:54.960
and now I can see some success because it's giving me

00:01:54.960 --> 00:01:56.670
the option to accept the certificate.

00:01:57.140 --> 00:01:58.830
However, since this is Windows 10,

00:01:58.950 --> 00:02:01.970
there are additional security features that I enabled,

00:02:01.980 --> 00:02:03.400
such as NLA.

00:02:03.540 --> 00:02:06.680
Let's go ahead and disabled this using a registry key as well.

00:02:06.680 --> 00:02:09.090
I will now issue the command within Empire,

00:02:09.110 --> 00:02:11.260
and once this is completed successfully,

00:02:11.340 --> 00:02:13.160
let's try the RDP connection again.

00:02:13.740 --> 00:02:17.250
And now I have the ability to remote desktop to my target machine.

00:02:17.740 --> 00:02:20.000
From here, I can log in as another user.

00:02:20.010 --> 00:02:21.230
Alternatively,

00:02:21.240 --> 00:02:26.710
I can log in as the logged‑on user by disabling the Connect a smart card option.

00:02:28.520 --> 00:02:30.880
Let's turn our attention now to the Windows 7 machine.

00:02:31.500 --> 00:02:32.040
This machine,

00:02:32.040 --> 00:02:36.070
we would like to establish remote desktop capabilities using Ammyy Admin.

00:02:36.840 --> 00:02:39.580
Now I've already got an administrative agent running,

00:02:39.590 --> 00:02:42.450
and I've achieved us using the bypass UAC command.

00:02:43.220 --> 00:02:46.480
Let's interact with this agent now and confirm that it

00:02:46.480 --> 00:02:48.090
is the Windows 7 target machine.

00:02:48.370 --> 00:02:50.670
You'll notice that I have a high integrity of 1.

00:02:51.740 --> 00:02:53.750
We'll take a look at our current working directory,

00:02:54.140 --> 00:02:57.450
and we're currently within the C:\Windows\system32 directory.

00:02:57.780 --> 00:03:00.950
This is a good place to upload the Ammyy Admin agent.

00:03:01.500 --> 00:03:05.750
We will go ahead now and upload this, and once the upload is completed,

00:03:05.760 --> 00:03:07.840
we can verify that the file exists.

00:03:07.840 --> 00:03:11.020
And we have confirmation now that the file currently exists.

00:03:12.140 --> 00:03:16.840
Next I will issue the install command using the shell command within Empire.

00:03:16.840 --> 00:03:21.380
Now that Ammyy Admin is installed, let's take a look at the running processes

00:03:21.390 --> 00:03:25.670
to see if it's running. And now I can see that I've got Ammyy Admin currently

00:03:25.670 --> 00:03:29.840
running. Depending on the version of Ammyy Admin that you use, sometimes it

00:03:29.850 --> 00:03:32.460
might not actually run when it's installed.

00:03:33.440 --> 00:03:36.760
In order to get this running, you would then need to start the service

00:03:36.770 --> 00:03:42.100
using a command line net start command. To demonstrate how that would

00:03:42.100 --> 00:03:44.770
work, your command would look something like this,

00:03:45.740 --> 00:03:49.250
and you'll see the output, which confirms that the service has started.

00:03:50.140 --> 00:03:54.970
Now that we have Ammyy Admin installed, we can use the Ammyy Admin agent and

00:03:54.970 --> 00:03:58.460
establish a remote desktop connection to the target machine.

00:03:59.610 --> 00:04:03.890
This demonstrates the ability of Empire, where you can use Empire to upload

00:04:03.890 --> 00:04:09.830
files to a target machine, and you can execute shell commands to install

00:04:09.830 --> 00:04:12.480
those files and execute some additional tasks.