Hello everybody.
And welcome back.
And right now let's see how we can perform the persistence function or persistence auction for our rivers
show.
So first of all let me just exit the show from our previous video.
We have our show right here.
We can delete this show since we will use another one after we compile it.
Let me just delete this.
OK.
Doesn't want to delete.
Yes.
So we were deleted in just a few seconds.
And right now what we want to do is we want to know our reverse dot shall our pardon me reverse underscore
shall dot pi.
Here we have everything we need from now on.
And what we want to do right now is called the part where we will actually perform the persistent on
target system.
Now before we do that I want to introduce you to a certain part of Windows called the registry.
Now you can enter the registry in Windows by going to the search bar typing in run opening the run application
and typing in the run application rack at it.
Once you click on the edit you can click OK it will prompt you for administrator password.
Since you're entering the Registry Editor.
If you specify.
Yes it will open up your registry as we can see the registry is basically the heart of windows.
Here we can actually create a registry key which will actually run our target or pardon me our backdoor
on target every time the target builds up.
So what we want to do is go to the first of all that and just put this.
This is something that you will probably see once you open the registry for the first time.
So we can see these five registry directories we are currently interested in these two right here.
One of them is the HP current user.
And the other one is HP local machine.
Now where they both will be performing the same function for us if we go to the HP current user and
code and make a registry key for our backdoor in that part it will only run after the restart if the
user logs into the same account.
Now if we copy it in the HP local machine it will run our backdoor no matter on which account the user
logs in for now on our target you will run this on user account and we do not have the administrative
privileges even if we add the function to call PD or to make the registry key for our backdoor in the
HQ local machine.
We will not be able to do it since it requires administrative privileges.
We can only make the persistence at the moment for our HQ current user.
That means we can only make the persistence after the user logs in to the same account.
So we will do that for now.
If we go to the HQ current user please press on the arrow right here.
Go to the software as we can see you find the software right here.
Press on the arrow down there.
Find the Microsoft Press there the arrow as well scroll down and what you want to find is the windows
and individuals you want to find the current version so let me just show you how that looks like.
So you found the Microsoft you pressed on the arrow scroll down on windows right here found current
version and you want to find the run folder here or the registry keys are here for the files or programs
that will run at the startup of the user log in so we can see we already have some such as cleaner and
one drives team and other default applications that most of us have on our P.C..
Now this is also some part of the P.C. where most of the viruses and back doors will be if you have
one and this is also where we will actually install the registry key for our own backdoor but we want
to perform a smart thing which is actually keeping our backdoor first to some other directory where
the user won't find it and then putting the registry key to run the backdoor from that other directory.
So for example if the target closes the our backdoor in the task manager they can then delete the file
simply.
Now I'm not really sure why right now.
Probably because I didn't close it.
Good.
So let me just open my task manager so I can delete this reverse shell.
Seems like the process is already running for some reason which I'm not really sure why but it doesn't
really matter we'll just find it right here cause the ending the task of it and then we can now delete
it.
And this is how the user will also be able to delete it.
So we want to make sure to copy the reverse shell right after they run it into some different directory
and then we want to create the registry key for that different directory.
As you can see the registry key is something like this.
You performed name and it will perform on the set.
The path to the program that you want to run.
So for this program for example the path easy program path Gaza and then JPY stationed at the CDC the
program that will run at startup.
Every time I log into my windows state account so let's see how we can perform that.
First of all we we want to implement two different libraries for python one of them is the OS library
which we will use for multiple things later on and one of them is the CS library.
Now I will show you how you can perform all of that in the next video.
From now on I just wanted to explain what we will be doing so that in the next video when we actually
code all of this you don't get confused by what am I doing.
So I will also explain the next video every app I do what exactly that means.
So I hope I see you in the next video and take care by.