[MUSIC PLAYING]
Welcome to the Windows persistence
section of this course.
In this section, we're going to be exploring what persistence
is and how we can establish persistence access on a Windows
system that we have compromised, all right?
So we'll be exploring Windows persistence first,
and then we'll move on to Linux persistence.
Now, before we actually get started
with the practical demonstration,
let's get an idea of what persistence is.
And there are a few things that I
want to highlight here because it's very important, right?
So persistence consists of techniques
that adversaries use to keep access
to systems across restarts, changed credentials,
and other interruptions that could cut off their access.
Techniques used for persistence include any access, action,
or configuration changes that let
them maintain their foothold on systems
such as replacing or hijacking legitimate code
or adding startup code.
This definition was pulled from the MITRE ATT&CK website.
And the reason I pulled it is primarily because it really
encapsulates everything about persistence
into one very well-formatted paragraph, right?
So the crux of what that is saying
is that once you gain access to a target system,
the next logical step is to perform local enumeration--
try and identify as much information
as you can about the system that you've just compromised.
You can then go ahead and start transferring the files
that you need to transfer.
The next logical step would be to elevate your privileges
if you obtained a non-elevated session.
The reason you need to elevate your privileges
before establishing persistence is primarily
because persistence techniques will typically
require administrative access in order for them
to be performed correctly.
So why is persistence important or why does it
feature within the post-exploitation methodology?
Well, let's use an example, right?
Let's say you're performing a pen test
and you gain access to a target system,
you're able to elevate your privileges,
and you pack it up for the day, right?
And the next day when you actually
go ahead and try and gain access to that system,
you find that that system--
the vulnerability that you're exploited on that system
to gain access has been patched.
And you think to yourself, well, how will I gain access
to this target system now?
I gained access yesterday.
Why didn't I set up a system or mechanism
of ensuring that I have persistent access on a target
system that I compromised at one point?
So that's why persistence is important is primarily
because once you've compromised the system,
you want to make sure that even if you're
done with it from the perspective of a penetration
tester, that you still have access to it in the event
that you ever want to do something else
or you want to exfiltrate some data
or to perform some additional tests, right?
So that's why persistence is important.
Now, in the context of Windows primarily,
the persistence technique that you will use or end up using
will need to be in accordance with the rules of engagement
laid out and agreed upon with the client.
So if you go back to the earlier sections of this course,
I mentioned very clearly that whenever you're modifying data
on a target system that does not belong to you--
it belongs to the client--
you need to make that as clear as possible
before you begin the pen test.
You need to actually sit down with the client and say, OK,
let's agree upon what we can and cannot do after we have gained
access for example.
And the client will say, OK, once you've gained access,
I don't want you to modify any files
or I don't want you to modify the Windows Registry.
I don't want you to leave any artifacts on the operating
system that could be very difficult to trace and remove,
right?
And that's a fair thing.
That's something that clients actually request quite a bit.
So in that event, you, again, will
need to decide or choose upon the correct method or technique
of persistence that you're going to use and one that
fits within or is in compliance with the rules of engagement
that you agreed upon with the client.
Now, the reason I'm saying in this phase of this course
is primarily because this is where
that particular statement or where this really
comes into play or why it's so important
here is primarily because persistence techniques will
typically involve modifying the system in various ways
from creating a new user or backdoor user to changing user
passwords to creating services to modifying the Windows
Registry.
Persistence, even if you actually take a look at it
from the entire penetration testing lifecycle,
persistence will typically leave the most amount of artifacts
after you've performed a persistence technique.
And furthermore or in addition to that, if I, for example, try
and establish persistence on a Windows system
through the Windows Registry, that
can be very difficult to actually trace
and then later on removed from the system
that you've just compromised.
So do take that into consideration.
If the rules of engagement that you agree upon with a client
state that you cannot make any changes to the system and you
cannot create any users, then, again,
that's something that you want to keep in mind.
Probably, the best option then is to, essentially, perform
a hash dump and obtain the hashes of the user accounts
on that system so that you can always authenticate
legitimately back on that target system that you've compromised.
So do keep that in mind.
Now, as I said, there is tons of persistence techniques
for both Windows and Linux.
And we're going to be exploring two techniques in this section.
And before we actually get started
with the practical demonstration,
I want to highlight the MITRE ATT&CK website
and just show you the various types of techniques
that you can perform in terms of establishing persistence.
So let me just switch over to my browser really quickly.
All right, so I'm back on my browser,
and I'm currently on the MITRE ATT&CK website.
If you're not familiar with the MITRE ATT&CK framework
as the description states right over here,
MITRE ATT&CK is a globally-accessible knowledge
base of adversary tactics and techniques
based on real-world observations.
The ATT&CK knowledge base is used
as a foundation for the development of specific threat
models and methodologies in the private sector,
in government, and in the cybersecurity product
and service community.
All right, so the mission of MITRE ATT&CK
is essentially to solve problems for a safer world
by bringing communities together to develop
more effective cybersecurity.
Now, what this means is that in the case of MITRE
ATT&CK for enterprise is it actually
lists out the various phases that adversaries or APT teams
will typically utilize when they're trying to compromise
a company or a target network.
So they start off with reconnaissance, resource
development, initial access-- which is exploitation.
You then have execution and persistence.
So again, this can also be used by penetration testers.
And the only reason I'm using it is primarily
because it lists out pretty much all of the techniques
that you can use.
So if I click on Persistence here,
you can see that this is the definition that I pulled
from the MITRE ATT&CK website.
And then it lists out the various techniques, right?
So these are the techniques that you
can use to essentially establish persistence.
For example, we have account manipulation.
What falls under account manipulation is, of course,
you can modify user account password, et cetera.
So it gives you an idea of what that particular tactic
or technique is used for.
So adversaries may manipulate accounts to maintain access
to victim systems.
Account manipulation may consist of any action that
preserves adversary access to a compromised
account, such as modifying credentials or permission
groups.
We then have a few other techniques
here that we can also explore like, for example,
creating a logon script on Windows.
So adversaries may use Windows logon scripts
to automatically executed at log on essentially
to establish persistence.
So that's another one.
One of the ones that we are going to be utilizing
is the create account technique, which
we will be exploring in the second video in this section,
where we'll be creating an account on the target Windows
system and then utilizing it to essentially ensure
that we have persistent access on that target system.
So I do recommend that you go through this
if you want to learn more about persistence techniques
as well as privilege escalation, exploitation
techniques, credential access, so on and so forth.
The website is attack.mitre.org
Now, that we have an idea of the various techniques
that we can use to establish persistence
and what persistence is and the important considerations
to take in--
the important things that you need to be aware of,
we can actually move on to the practical demonstration
side of this video.
So this video has a lab environment attached to it.
And of course, you can start it up,
and you can follow along with the techniques.
So the flow is going to be as follows.
We're going to gain access to the--
we're going to essentially exploit a vulnerable service
on the target system.
Once we've have gained access to the target system,
we can then establish persistence.
If we need to elevate our privileges,
we will do that before we actually establish persistence.
And this is going to be done through the use
of the Metasploit framework as this is the easiest
way to essentially showcase and demonstrate
how to set up persistence, especially on Windows.
So I'll see you in the lab environment.
All right, so I'm back within the lab environment.
And you will be provided with the target IP address.
Of course, in your case, it's going to be different.
But all you need to do is just copy it.
So the first step, of course, is to identify
the vulnerable service that's running on the target system
that we can exploit.
So I'll just open up a terminal, and I'll
perform a quick service version detection
scan on the target system.
And we can also, again, specify additional options
regarding the ports.
But in this case, I'll just hit Enter.
And I'll give this a couple of seconds
to a couple of minutes given the fact that this is a Windows
system.
All right, the Nmap scan is complete.
And you can see on port 80 we have a web server running.
And the web server is the all familiar HTTP file server
version 2.3 developed by Rejetto.
So by this point, you should know
that there is a Metasploit framework exploit module that
can exploit or that can be used to exploit
this specific version of the HTTP file server.
So I'll open up MSF console here.
And we'll give that a couple of seconds
to start up after which we can search for the Rejetto module.
There we are so it's say search and Rejetto.
And we are using this exploit module here.
So we'll say use zero.
And this will provide us with a Meterpreter session.
So you can see the default is Windows Meterpreter reverse
TCP.
That's a 32-bit Meterpreter payload.
You can modify this if you want to.
However, do keep in mind that at this point,
we still don't know what the target operating system
architecture is.
So it's always safe to utilize the 32-bit Meterpreter payload.
If we show the options for the module,
you can see that we need to set up the payload option.
So this is your Kali Linux IP.
You can set that by saying set L host
and then specifying your Kali IP.
The L port is set to the default, which is 4444.
Make sure that this is not in conflict
with any other reverse handlers you have running or listeners.
And we need to set up the target IP.
So I'm just going to copy the target IP here.
And we'll say set Rhosts.
Paste that in there.
And I can type in exploit.
All right, this should provide us with a Meterpreter session.
There we go.
Fantastic.
OK, so let's perform some basic enumeration.
So I'll say sysinfo.
We can see the target system is running Windows Server 2012 R2.
It is a 64-bit version of Windows,
and we have a 32-bit Meterpreter session.
We can also identify our current user and the privileges
associated with that user by typing and get user ID.
We are currently the administrator user,
which is fantastic.
It means that we do not need to elevate our privileges
and we can move--
we can essentially move on to the next phase,
which is essentially establishing persistence.
All right, now, as I said, in this video,
we're going to be focusing on how
to establish persistence to a Windows persistence service,
right?
So we're going to be exploring how
to set up a service that will connect back to our Metasploit
framework multihandler listener and provide us
with persistent access whenever we want.
So in order to run that particular module,
you do need to have elevated privileges, right?
So let's put this in the background,
and we're going to search for the module.
All right, so I'm going to say search.
And we're just going to say persistence,
and we can say service.
And let's see if that comes up.
There's the one there.
This is a postexploitation module.
However, it is categorized as an exploit module,
so I'll say use zero, right?
And the default payload is set to the Windows--
to the 32-bit Meterpreter payload,
which is perfectly fine as we can always
migrate our process into a different process
that is actually a 64-bit process.
So the way this module works is that it
will generate and upload an executable to the target
system.
It will then make it a persistent service, right?
And you've already learned about services.
They run in the background as I already
went over that during the Windows local enumeration
section.
This module will then create a new service
which will start the payload whenever
the service is running.
And you do require administrative or system
privileges in order to utilize this particular module here.
So if I show the options, you can
see that there are quite a few options.
And you might be a little bit confused
here because if this is so-called postexploitation
module, why do we have the payload option here?
Well, remember, the way this module works is it
generates a payload with MSF Venom.
And in this case, it's going to be the 32-bit Meterpreter
payload, so that means you need to specify a different L
port here than the one you're currently using.
Or you can keep the same L port, however,
you then need to terminate your previous session in order
to see if this works.
So in my case, I'll change the L port to 4433, OK?
We then need to set the session, which is required.
So let's do that right now.
So if I list out my sessions, set session one.
OK, and if we show the options again--
I'm going to explain a few things.
So this module will generate a payload with MSV Venom.
This payload will then be essentially uploaded
to the target system.
This module will then make it a persistent service.
So it'll create a new service, which will then
start the payload that was generated
and upload it to the target system
whenever that service is running.
And in order to do this, in order
to create a new service on Windows,
you require an elevated session or elevated privileges, OK?
And there are a few other options that you can customize.
So for example, the remote victim name.
You can also change the remote victim exe path to run.
So it's going to use the temp directory
as a default, which is good.
The retry time that the shell connect failed.
So again, the duration as to--
this is used to specify the duration for essentially
retrying the connection.
So after every five seconds, the persistent service
will execute the payload, which will then try and connect
to the handler that we will set up.
And then, of course, you can specify
the unique name of the service.
This is a fantastic feature as it
allows you to create a service that is not easily identifiable
by an administrator on the target system.
So you can pretty much give it a name
that is associated with one of the Windows services
to make sure that it blends in.
If you don't specify that, then a random string
is going to be used.
In this case, we'll leave them as is,
and we can just type in exploit.
Once we exploit, you can see a few things happening here,
all right?
So it'll stop the reverse TCP handler, which is fine.
That's perfectly fine.
It's going to run the module against the target system.
You can see that the Meterpreter service executable was written
to the following directory-- so C users admin
appdata local temp, and this is the name of the executable.
So this particular persistence technique
has created an artifact that you need to actually note down
because after the penetration test,
you actually need to be able to delete this as, again, it
is going to be stored on the system.
And as per the rules of--
the actual rules of engagement, you
need to be aware of all of this information
and you need to keep up with all of the changes you're
making to the target system.
It'll also tell you the name of the service that it created.
So again, this is a random string.
And it will then receive a connection, primarily
because the persistent service is running.
And the service, after every five seconds,
executes the payload which consequently connects back
to the actual listener.
That is why we obtain an Meterpreter session
almost immediately.
So we have essentially established persistent access.
Now, they also provide you with a clean up Meterpreter
RC that's stored under the following path here.
This can be used to clean up all the actual artifacts left over,
which is extremely useful as you don't need
to go through this manually.
If you're not familiar with Metasploit resource,
scripts then you can check out the Metasploit framework course
that covers how to use them and how they can
be executed almost immediately.
So with that in mind, what we can do now
is let us exit from this session.
Before we do that, we can say get user ID.
You can see NT authority system.
So that's one of the great things
with a persistent service is it provides you
with the highest level of privileges
available on a Windows system.
You are not tied down to a particular user account.
So I'm going to exit.
And we also have the other session here.
So I'll say sessions kill one to terminate
that particular session.
So now, we don't have any sessions on the target system,
all right?
And you might be a little bit confused because I've just
terminated any access I had.
Well, remember the persistent service is
running on the target system.
And after every five seconds, it's
going to execute the payload that will then connect back
to the listener.
So we haven't set up a listener.
Now, to show you that this works,
I'm going to exit from the Metasploit framework,
and I'm then going to start it up
again just to prove to you that this indeed does work so.
We'll give this a couple of seconds.
We can then set up the actual handler or the listener
for lack of a better word.
So use multihandler.
We then set the payload that we used
or that we specified when we were using the persistence
module, which by default was the 32-bit Meterpreter payload.
So we'll say set payload Windows Meterpreter reverse TCP.
You then need to specify the exact options
you used when you were using the persistence module.
So if I say Show Options, make sure that the Kali Linux
IP is set.
So we can say set L host to ethernet one.
And then, the port that we specified-- again,
remember that we actually changed it to 4433.
There we are.
And you'll actually see what will happen.
So I'll type in exploit, and we immediately
get access to the target system without even
targeting the system.
So just to prove it to you-- sysinfo, get user ID.
We're on the system, and we'll keep
getting access to the system so long as the system is online.
When it comes back online, if we have our listener running,
we'll get access almost immediately.
And as I said, this runs after every five seconds,
which you can customize.
So I'll prove it to you again.
I'll say exit.
And if I run the handler once again or the listener,
there we are-- another session.
So what we've done here is we've essentially
ensured that we have access to this system irregardless of how
we gained access to the system in the first place.
So we don't have to exploit the Rejetto HTTP file server.
That service can be patched.
We will still have access to the target system.
So I hope this was an illuminating demonstration
as to how persistence works and why it's so important.
So this is going to conclude the practical demonstration
side of this video.
All right, so hopefully, as I said,
that was a good example how persistence works
and why it's important and a technique that you
can utilize on Windows.
So that was one of the techniques
that I wanted to highlight.
In the next video, we're going to be exploring
another technique that will involve creating another user
account, also known as a backdoor user account,
that we will be privy to and will essentially provide us
with a means of accessing the target system whenever
we want to.
So I'll be seeing you in the next video.