Now, let's look at another situation where Métis boy makes it very easy to backdoor the system using
nothing more than the built in system tools.
Now it helps you to make a remote desktop connection to the target.
Interpretor has two options for this first one is interpretor script get gooey.
And you can utilize that get gooey script, which enables remote desktop and creates a user account
for you to log in with pretty convenient.
And then the other one is a reliable post module and able RTP.
So have a look at how to use them.
So I have a interpreters session on medicine voidable three.
And as you know, throughout the course, we have learned how to extract hashes and passwords.
And now you have many credentials for Métis Voidable three, so you may want to make a remote desktop
connection with one of these credentials.
So that's what I'm going to do here.
So let's open up a new tab.
Now we use the vagrant user and password, so.
Our desktop, you vagrant p vagrant.
And the IP address is voidable three.
Ed.
And very good, you have a remote desktop connection on the target.
But when I bring a target to my main screen, you can see that the actual user screen is locked and
not a very good thing and it certainly isn't stealthy.
And when this user on the target tries to log back in, my connection is going to be terminated as as
you just saw there.
So how do we avoid this situation?
The interpreter script and post module are the best solution, so we're going to first start with script.
Run, get gooey H gives a, hmmm, some brief information about the script.
But run get gooey without parameters to see the options.
And the options are clean, so now let's run, get gooey.
You pen test one, P pen, test one.
So the script enables our DP.
Arranges firewall rules and as our user and then adds this user to remote desktop users and look at
that, the script is executed successfully.
So why don't we go to another tab?
Our desktop, you can test one.
P pen, test one.
Tend tend to dot 10.
The RTP session is open now.
Let's bring the target to the main screen.
And look at that, see, the current user is still on the machine and we can use it without being disturbed.
And to verify the user.
Open the command prompt on Métis, voidable three.
Type net users to view the users.
And here is the Pentax, one user.
Net user pen test won.
To get detailed information for Pantheist one, OK, so it's also in the users group, Purrfect.
Now it's the post module's turn.
So here we have the information about the enable our post module.
Windows.
Ménage.
Enable our DP.
Username equals Pentax to.
Password equals Pentax to.
So it does the same thing is they get gooey script.
OK, so go to another tab.
Make an R desktop connection with Pentax to.
On this change, the ones to twos.
So as you see, the current user on the target can still use the desktop.
And to make it clear, open Windows command prompt net users and sure enough points to is on the list.
And.
It's also in the RTP users group.
And now you can interact with a user's desktop, look for critical files and everything else that you
want to do.