Hey everybody welcome to the next video.
We're going to be looking at windows persistence.
So in the next video after this we'll be talking about Linux persistence.
But in this one is gonna be windows.
And I'm going to talk to you about four different types of affordable ways we can perform persistence
on a Windows machine just right off the top.
Now the first one is creating a service.
Now we've created a service before and previous videos we we're going over the Windows OS but this is
gonna be a quick recap for everybody.
So if we go ahead and access our show we'll do a C Create and we'll do a secret as the name of the service.
Path equals with a space at the end.
Always remember that C slash will call this secret C and we'll do start equal to auto which is the important
part here so it starts up on start.
There we go.
So if we go ahead take a look at this service.
So a C query secret we can see that it isn't currently not running which is exactly what we'd expect
a C QC secret we can see that we have our win process it's auto.
It's the path of secret display name is secret but the service start name is local system which means
it's going to start up as local system which is exactly what we want.
We'll go ahead and delete that.
So we don't have that running and causing errors.
But as you can see we've this is the first step in making persistence we've got a service that runs
on startup and then we'll always be good to go.
The next is just like how we're going to show you in the Linux persistent area we're going to create
a user.
So to create a user on Windows it's net user.
And then the name.
So we'll call this team red red team then slash ad that will go ahead and add the user for us and then
we can do net user.
Red Team star that will allow us to reset the password.
However because of the type of prompt that we have it's going to just fail.
It's going to just basically put empty text in the field and enter it.
And that's going to show it.
Having typed the password and typed it again and then command it successfully executed.
Now when you run this on the local system you will have a different.
You'll have a different result but right now we have a user with a with no password which is fine on
some systems and not finding others depending on the group policies that are put into effect because
if there is a policy where you have to have a password to RTP to a machine as an example then you couldn't
use this to already be a machine you would have to find a different way to reset the password.
So I'll go ahead and leave that to you guys to go ahead and find a different way to reset a user's password
through the command line without having to use this particular way.
Now the last step is we're going to want to add the user to a the administrator group so that's not
a local group.
Our local group administrators and then the username slash at.
That's it.
Now we've got it.
Now we've got a user account created called Red team with no password.
And it is also part of the local administrators group which means we are a ok and good to go.
Now the last part I want to show you guys is OK.
It doesn't work there but there's one.
Number three now.
So on this one I want to show you guys how to set up a registry key TIL that allows windows to shoot
when it starts up to use that particular registry key to start an application.
So Bureau.
If you're already managing Windows systems you'll find this registry key pretty straightforward.
It's the current version run which is where everything for that user or for that system goes ahead and
logs in or starts the system.
It'll go ahead and run through this registry key or any registry key in this setting can go ahead and
launch it.
So the first thing we do is do Reg ad and then page Casey you know the current users registry of software
Microsoft Windows.
Current version run is a fairly common path and most things that run on startup for a current user is
going to end up in a registry key here.
So if we do slash V we give it a name.
We'll say secret as well.
Secret and the type in this particular case it's a ragged Ash a C slash F to force any anything else
that's labeled secret.
We'll just overwrite it and slash D.
So the path that we're gonna want to use we'll use sleep.
That's a secret study.
So we've gone ahead and added that so I'm going to show you guys real quickly what this looks like from
a registry viewpoint.
So you can see here we've got a key current user software.
Microsoft Windows current version and we're on run.
So go ahead and refresh.
OK so we can see the reason why we don't see the key but it was created.
If we get the UI D were empty sys authority.
So we're the system user.
So right now this is currently the administrative user.
So what we'll do is we'll go ahead and kill this maternity session we'll rerun it and we'll go ahead
and launch our exploit.
One more time as the system user and you can see here we got it.
So forgive shell.
Now our system instead of or worse administrator instead of system we copy this same command.
It's not what we're looking for.
Copy
go and run that again.
And if we come back in here again under that same one.
But now is the correct user.
And we hit refresh.
We now see our right your key.
Make sure you keep that in mind.
Now if you have it running a system it's a little bit flaky when you do that but you might want to when
you're working with this type of registry key where you're doing a start up you're going to want it
to be under a specific user rather than this rather than the system user.
Now you could do this and have it go against the instead of the current user who can go against the
current machine.
And that works just as fine close as perfect.
Now the last step and I want to talk to you guys about is DLF pre loading.
So what this is is this is allows you to create a binary or a deal with the same name is another one
that's already on the system and you overwrite that binary on the system with your current one.
Now this can be a.
This is normally considered a dirty based persistence because it's very obvious in some cases to the
user or the admin because now all of a sudden the binary is not doing what it's exposed.
It's supposed to do when it's loaded.
So a quick way for us to go ahead and do that as we'll create a binary will do.
Here it is.
We're gonna do MSF phenom.
We're gonna open up a 64 bit interpreter reverse DCP with the correct parameters and we're going to
use a dash f for DL and then we're gonna call this affects SS t yellow so we'll go ahead and create
that now affects SS t is used for the fax service on the windows machine.
So it's less likely to be noticed if there's an error with the fax service because there's not really
as much use for the fax service as there are for like logging in or using the Internet or anything else
like that.
So less obvious to the current user and an admin is less likely to bother looking at a system if it's
having some startup failure for a fact service.
Now.
Go ahead.
Look here we have our ethics assets teed up yellow and in our material shall keep up we're not in our
shell anymore we're interpreter shell if we go ahead and do l l s dash l.
So that's the locals.
You can see this is our local machine but if we do a less dash l we can see that this is now our external
machine are the one we're actually compromised.
So you can do local change directory so we'll do slash routes.
You just put an L in front of whatever you want when you're referring to it locally.
So what we're gonna want to do is when upload effects assess teased out the yellow upload effects that's
teed up the yellow it'll upload to whatever the current directory is.
So we do dash L.
We can see we now have it moved in here correctly.
Let's go ahead and go shell and we'll do the IRR just to make sure it's there and it is.
So what you would normally do is copy effects assessed heat up as well and we would copy that over into
Windows system 32.
And that's then you would say yes you want to overwrite anything there.
However you're going to get an access denied.
So what I want you guys to do is take a little bit of time and research to identify why.
Keep in mind this is a Windows 7 machine not a Windows XP.
Why is it not allowing you to overwrite this file and then what are some ways for you to write the file
I want you guys to take that a little bit of extra time and do the research around it and go back to
the Facebook group and let us know how you guys decided to go about it.