Persistence via RDP.
In this video, we're going to be exploring
the process of establishing persistent access to a Windows
or on a Windows targeted system by creating a backdoor user
account.
After which, we will also be adding
that backdoor user account to the local administrators group
so that user has administrative privileges.
And furthermore or in addition to that,
we'll be also exploring the process of how
to enable RDP or Remote Desktop Protocol on the Windows target
system and how to use that RDP access to authenticate
with the target system through the backdoor user
that we will be creating.
So again, you should be familiar with what persistence is now
and why it's important.
And also for this particular technique,
we are going to be creating a new user.
So do be cognizant of that.
And you need to be aware of the rules stipulated
within the rules of engagement.
And if you do not have the permission
to create a new user account, then
do not perform this technique.
With that being said, this video has a lab environment
attached to it.
We are going to be getting access to the target system.
After which, we'll be exploring how to create the backdoor user
account, how to add it to the local administrators group,
how to enable RDP, and how to access
the target system via RDP.
And, of course, this requires elevated privileges by default
or in order to be done.
With all of that being said, I'll
be seeing you in the lab environment.
So I'm back within the lab environment.
And you will be provided with the target IP
address, which you can copy.
Do note that this will be different in your case.
All you need to do is just copy it.
So let's identify the vulnerable service that's
running on the target system.
This can of course be done by performing a Nmap
scan on the target.
So we'll say we want to perform a service version
detection scan.
And I'll paste in the target IP there and I'll hit Enter.
And this is going to take a couple of seconds
to a couple of minutes to complete.
So the Nmap scan is complete.
And it looks like we have the port 80 open on the target
system that's hosting a web server.
And the service version is BadBlue version 2.7.
So let's run a quick searchsploit search in order
to identify whether we have any BadBlue exploits that we can
use more specific to the version that is installed
or that is running on the target system.
So we're looking for version 2.7.
And it looks like we have a pass through buffer overflow,
and that is a Metasploit module.
So let's open up the Metasploit framework, MSF Console,
and let's see whether we can gain access
to the target system.
So we'll just say, search BadBlue.
And the module that we want to use
is this one right over here.
The first one is for version 2.5.
We are interested in the buffer overflow exploit.
So I'll say use 1.
And we then need to set the target IP,
so I'll say set our hosts.
And the default payload is the 32-bit Metasploit payload,
which is perfectly fine for reasons
that I've outlined before.
We don't need to change any other options.
If you do need to configure the payload options, more
specifically your Kali Linux IP if it's not set up,
you can check the value of the ethernet 1 interface
and you can also customize the port.
But I'll just type in exploit, and let's see if we gain access
to the target system.
We should be able to obtain a Meterpreter session.
There we are.
So we can say getuserID, and fantastic.
We don't need to elevate our privileges
as we've gained access as the administrator user
account, which is great.
So we can also sysinfo.
The target system is running Windows Server 2016,
build 17763.
It's a 64-bit version of Windows Server.
That makes sense.
Before we actually continue, I'm going to locate the explorer
process because I want to migrate
to a stable process as this particular technique
or this set of commands that we will be running
requires a stable Meterpreter session.
So I'll say pgrep explorer and I'll migrate to that process.
So 4072 is the process ID.
And this should provide us with a 64-bit Meterpreter session.
Indeed it does.
Fantastic.
So what we're going to be doing, firstly,
is we are going to, essentially, be creating a new backdoor user
account.
And we have the permissions or the privileges
to do so as we are currently the administrator.
We are then going to enable the RDP service if it's disabled.
We are then also going to hide the user from the Windows login
screen because one of the issues with Windows
is when you create a new user account and the system
is restarted, then on the log on or on the login page
it will usually display all the user accounts that
are available on that system.
So this will also be disabling or hiding
the user from the Windows login screen.
And we'll also be creating or adding
the user to the administrator group,
as well as the remote desktop group
on Windows, which is essentially used to allow specific user
accounts to log in via RDP.
Now, we can do this through the set
or through the use of a couple of Metasploit framework
modules, however, this can really
be simplified into one command.
So what we're going to do is we are going to say run getgui.
And I'll explain what getgui is.
We are then going to say execute and we
want to create a new user.
So I'll say -e -u.
And the new username we can create whatever we want,
so I'll just use my name.
And then we specify the password for that account.
So we can say the password, we can just set it to maybe hacker
0 or just 123, hacker_123.
But I do know that if there is a password policy,
then we need to have a long password.
So I'll say 123321.
And do take note of that password.
So the username is alexis.
And in your case, you can change this up.
And we'll say hacker_123321.
So that's the password.
OK, so we've taken note of that.
And what this will do is it will run the getgui command.
The getgui command is specifically
used to enable or to check whether the RDP service is
enabled.
And if it is disabled, it will enable it.
Furthermore, it will also create a new user for us
and we can specify the username and password,
which we have done.
It'll also hide the user from the Windows login screen
and it'll add the user to the remote desktop users
group, as well as the local administrators group.
So that means that we can access the target system via RDP,
as well as have administrative privileges once we log on.
All right, so once this is done, we can hit Enter.
And we'll give this a couple of seconds.
All right, so there we are.
So you can see that it's going to, essentially, check
and see whether RDP is enabled.
It'll tell us RDP is disabled, so it's going to enable it.
It's going to set the Terminal Services service start up mode
and it's going to set that to auto.
It's going to open the RDP port in the local firewall
if necessary.
So that if Windows Firewall is active,
then it will add the firewall rule pertinent to port 3389.
That is the RDP port.
It's going to set the user account for log on.
So it's going to add the user alexis with the password
hacker_123321.
It's going to hide the user from the Windows login screen.
It's going to add alexis or the user
account you essentially specify to the remote desktop users
group and the administrators group.
And it says, you can now log in with the created user.
And in order to clean up whatever you've created,
you can use the Metasploit framework resource script
and the path to that resource script is specified right
over here, which is fantastic.
So all the artifacts can be cleaned up.
OK, so now that this is done, we have essentially
established persistent access to the target system
albeit through a Meterpreter session.
But we've done more than just that and I'll
explain why in a second.
So in order to access the target system--
and I'll show you that this does work--
I can exit from Meterpreter and I'll exit from msfconsole.
We can utilize an RDP client to connect to the target.
And in the case of the lab environment,
we can use xfreerdp.
We specify the user.
So the username I created is alexis.
In your case, it'll be different.
And the password is hacker_123321.
And then we specify the target IP address,
so I'll just copy that from the notepad here.
And if successful, we should have graphical user--
we should have a graphical access or GUI
access on the target system as the user alexis
who is a privileged user.
So I'll hit Enter.
I'm going to trust the certificate, so I'll say yes.
And this will open up a window for us.
There we are.
And we are being logged on to the target
system as a legitimate user.
There we are logged on.
It's setting up our user or our desktop because this
is a new user account.
We'll give this a couple of seconds.
There we are.
Fantastic.
So we've, essentially, set up a backdoor user
that we can use whenever we want to gain access to the target
system without exploiting the vulnerability that we
used initially to gain access to the target system.
And this is something that's much better, primarily
because when you create a user account
it's easily identifiable.
And you can essentially have access or obtain access
to the target system whenever you
want through legitimate communication or authentication
as opposed to utilizing exploits, which, again, can
be quite disadvantageous as the vulnerable software that's
running on the target system could be patched.
And because this is a backdoor user,
it's going to be hidden from standard users.
However, if an administrator comes on board
and sees there's a user account, which they'll be able to do,
then, again, that might be an issue.
But for the purposes of demonstrating
how you can create a backdoor user,
I think this is a very good example.
So I now have access on the target system.
If I open up the command prompt, which
I'll say cmd right over here.
And we'll give this a couple of seconds.
There we go. cmd should pop up any second now.
And I can now run it as administrator, so run
as administrator.
It's going to ask me--
it's going to provide me with the user account control dialog
box or consent prompt.
I'll just hit Yes and there we are.
So I can now say who am I. I'm still at alexis,
but I can say whoami and priv.
And there we go.
We have all the privileges you typically
associate with a user account that
is a member of the local administrators group.
And, of course, if I say net user,
this is typically how an administrator
would be able to identify that there is another user
account that looks suspicious.
So if you're going to create a backdoor user,
I do recommend that you try and make it blend in
with the rest of them.
So you could create maybe a guest account
and give it a slightly different syntax
or you can call it guest with a lowercase g
just to make sure that you are undetected.
But, again, this is not really necessary in the case
of a penetration test.
So that is, again, how to create a backdoor user,
how to enable the RDP service, how to hide the backdoor user
account from the Windows log on screen, and, of course,
how to authenticate with the target system via RDP.
So that is going to conclude the practical demonstration
site of this video.
All right, so that is going to conclude
the Windows Persistence section of this course.
The objective of this section was to introduce you
to Persistence.
You know how it works, why it's important, and of course cover
some of the important considerations
to keep in mind when performing Persistence on both Windows
and Linux.
And we explored two really, really cool demonstrations
or techniques that you can use to establish persistent access
to a Windows system.
We're now going to move on to the next section
within this course, which is going to be focused
on Persistence on Linux.
And we'll be exploring a couple of techniques
that you can use to establish persistent access to a Linux
system that you have compromised.
With that being said, I'll be seeing you in the next video.