Welcome back.
And in this video, I want to talk about something called persistence and what is persistence?
Well, persistence is a module that allows us to stay on the target machine even after the target machine
gets rebooted.
So it is essentially adding our payload to the start up folders where it will automatically get started
as soon as the target system gets restarted.
It is a part of maintaining access.
So this is one of the things that we want to do as soon as we get on the target machine.
So what it did right here is establish an interpreter session with the target machine.
I used this module to bypass UAC and get the system privileges on my Windows 10 virtual machine.
And the reason why I'm testing this on a virtual machine is because in this video, I will have to restart
this machine to see whether the persistance is working and how I transferred the shadow to accede to
the Windows 10.
Well, I use the code way of transferring it using the Apache Web server, and to do that you can just
type system ctrl and then start.
And then type Apache to this will ask you for your password and put it right here and this will start
the Apache Web server.
Now what you can do is you can open up Internet Explorer on the target machine and type in the IP address
of your clinics, which will lead you to the Web page of our Linux machine.
Now, you will not see this channel, but you see right there, it is there because I put the payload
inside of the Web server directory.
And to do that inside Linux, after you create the payload, you can navigate to this far slash W w
W and slash HTML directory where you should have two files called index and then dot something.
You can delete those files and you can copy your payload to this HTML directory right here.
Then if you go to your Windows 10 machine, refresh the page, you will have your Shell acce available
to download on your windows and machine.
Just make sure that you disable the Windows defender on your Windows 10 machine, because we're using
a regular interpreter, reverse DCP Shell and it gets detected by the Windows defender.
So after you do all of that and establish the connection, you can then gain system privileges.
And we already know how to do that.
We seem to just test a bunch of those modules that are used to bypass UAC and then we become the system
level account.
Once you do all of that, it is time to run the persistance module.
So how can we do that?
Well, first of all, our background this session and if we type sessions, you can see I have two sessions
available.
The one is on the regular user account and the one is that I elevated, which is this system level account.
So what they want to do to run the persistance is I can type this search persistance inside of my absolute
framework.
This will output me with a bunch of different modules.
And the one that we're going to cover in this video is going to be this one right here.
Exploit Windows Local and then persistance service.
If I copy the module name, go down here and type Qs.
Pays the module press enter, it will set my payload to win the SM, reverse DCP and if I type show
info here, we can see that this module would generate and upload the executable to a remote host.
Next, it will make a persistent service.
It will create a new service which will start the payload whenever the service is running.
Admin or system privilege is required for this module to run.
That is why we created the second session with the system privileges.
So what we need to specify right here, if potential options is we need to set the session and here
we are going to set the session with the system level account.
In my case, I believe it is session two.
That is correct.
And right here, we want to set our payload options.
Of course, if we want to, you can set these other options as well, such as free trade time and free
trade.
Time is simply just the time that we try to connect to if the connection fails.
Five seconds is default.
Now, we can set that to be, for example, ten seconds.
It doesn't have to be five.
That would be too quick.
And after we do all of that, we can run this module press run and this will open the session.
Three.
If I type get you ready, we will be the system level account.
But what is special about the session is that it will automatically connect back to us even after the
target machine is rebooted.
So the target won't need to run this shelter.
After the system is restarted, it will automatically connect back to us again because we ran this persistance
module.
Let me show you what I mean.
If in my interpreter session I run the reboot command press enter this will start restarting the Windows
10 machine.
All of the other sessions will die out because the connection has been closed.
If I control see this exit out of this type sessions, we will have no active sessions anymore.
So what we can do right now is we can type, use, exploit, multi handler set the correct payload and
inside of the show options, we want to set the correct options that we use inside of our persistance
module.
And that is the port for four four four.
And the IP address of our Kalinda's machine, so all I need to do right now is type from.
And here we get the session open because this machine hasn't yet shut down, so we're just going to
close this because this is not the session that we wanted to.
And I'm going to manually exit out of this machine and go and start it once again.
Now that the machine is getting started up, I will run our listener.
And if everything worked correctly, we should get an interpreter.
Session opened as soon as the machine puts up without the target having to do anything but start their
machine.
So let's see whether it will work.
The machine is currently starting up.
And let's give it a few seconds.
And here at this hour, an interpreter, Section five opened on its own and noticed that it didn't even
login to the user yet.
And the best part about this is that if we type get user I.D., I will already be system level account.
So I didn't have to go through the privilege escalation process again.
This bitter session opened without anyone clicking on anything, and that is the good part about persistence.
Now, even if the target shut down this PC once again and started it in a week or two, our persistence
will still work and our payload will automatically connect back to our killing machine if the IP address
of the clinic's machine hasn't changed.
Of course, one more thing to keep in mind is that sometimes persistence can be buggy so it knows not
to work sometimes, but in most cases it should work.
And if it doesn't, there are other modules for persistence as well.
If I type background and search persistence.
I used this model right here, but you can see there are other modules as well.
You can check them out if you want to.
Maybe they will work better, maybe they will suit your needs more.
But whichever one you find work, just use it and you will maintain access on the target system.
Great.
Now that we covered persistance in the next video, we're going to cover the USACHEV post expectation
modules and a few more useful commands that we can do after exploiting the target scene in the next
video.