[MUSIC PLAYING]
Persistance via Cron jobs.
In this video, we are going to be exploring the process of how
to establish persistent access to a Linux system
that you have compromised through the use of Cron jobs.
Now before we actually get started
with the practical demonstration,
let's get an idea as to what Cron jobs are
and how we can take advantage of them as a penetration tester.
All right, so Linux implements task scheduling
through a utility called Cron.
Cron is a time-based service that
runs applications, scripts, and other commands
repeatedly on a specified schedule.
So an application or script that has
been configured to run repeatedly with Cron
is known as a Cron job.
We can utilize Cron jobs to execute a command or script
at a fixed interval to ensure that we have persistent access
to the target system.
So what are Cron jobs?
Cron jobs are essentially the Linux equivalent
of scheduled tasks on Windows.
So we can utilize them to run a specific command or script
at a fixed interval or schedule.
And in terms of how we can leverage
Cron jobs from the perspective of a penetration tester,
and more specifically during the post
exploitation phase is that we can essentially
after compromising the Linux target system,
we can create a Cron job that executes a reverse shell
command, more specifically a bash reverse shell command that
will consequently connect to our Netcat listener
on our Kali Linux system.
And we can set the actual Cron job timing or scheduling
to have that Cron job run or be executed
every minute, of every day, of every week,
of every month, et cetera.
And that's one of the great features of Cron jobs
or rather the Cron utility is that it
allows you to essentially run applications, scripts,
or commands repeatedly on a specified schedule.
Now in order to understand how to set up a Cron job,
you need to have an understanding of how
Cron jobs are set up or the rather the anatomy of a Cron
job.
So this right here is an example of how to set up a Cron job.
So the first five fields are used
to specify the actual schedule or the timing of a Cron job.
So for example, you can see the very first value
is the minute value, where if I wanted
to run a particular command or script or application
or binary, I can specify a value right over here.
So I can say 0 to 59 minutes.
If I want to run it on a specific hour,
I can say I want to run this current job on the 20th minute
of whatever hour.
We can set that to maybe the 12th hour.
And this is in the 24-hour format.
I can then specify the day of the month.
So let's say I only wanted to run this at maybe
we can say 12:30 PM on the 28th of every month, I can do that.
And I can also add the additional parameters
for the month and day of the week options here.
So by default, you can see that these values
in this particular example have an asterisk value assigned
to each of them.
Now an asterisk value for each of them
means that the current job will run
every minute of every hour of every day of every month
and every day of the week, which is what we're going to be doing
because we want to be able to access the system whenever
we want to.
And again, what this means is that when we set up our bash
reverse shell Cron job, we will essentially
set it up so that, that particular Cron job is executed
every minute, of every hour, of every day, of every Month,
and ever day of the week so that we can essentially
receive a connection on our Netcat listener
whenever we want.
So whenever you have the Netcat listener running
after every minute or after a couple of seconds based
on the duration or the timing of the Cron job,
you'll be able to obtain a reverse shell on the target
system.
So in this particular case, it really
doesn't matter what type of access
you have on the target system, because you
can create a Cron job for most user accounts
on a Linux system.
And again, if you have not been able to elevate
your privileges, you can still set up a Cron job
as we will be exploring.
All right, so this video has a lab environment attached to it.
The lab environment is very simple.
We're going to be provided with access to the Kali Linux
system.
We can then SSH into the target system,
and this is going to simulate or emulate the exploitation phase.
Once we have gained access to the target system,
we can create the Cron job that will
connect to our Netcat listener.
And after that is done, we can then
exit from the target system and set up our listener,
and we should receive a reverse shell connection.
So far up the lab environment and I'll
see you there in a couple of seconds.
All right, so I'm back within the lab environment,
and the first step is going to involve identifying the target
IP address.
So we can do that by typing in ifconfig.
We want to take a look at the interface ethernet 1.
And in your case, this value or the subnet will be different.
However, your Kali Linux IP or system
should be on the second IP within the subnet.
You just need to copy this value and change the two to a three,
and that's the target IP address,
irregardless of your subnet within your lab environment.
We can now SSH into the target system.
So I'm going to say SSH student@,
and I'll just change the two to a three.
The password for the student account is password.
I'll just accept that, and I'll say password.
And we have access to the target system.
All right, so we're focusing on setting up a Cron job.
So we can list out the contents of the home directory.
We have the same weight binary that we
had in the previous video within that lab environment.
So once we've set up our Cron job,
we can remove this weight binary to essentially simulate the--
essentially simulate what would happen if the student
user account password was changed,
therefore meaning that we could not gain access to the target
system anymore because we don't know the new password.
So as I demonstrated during the Linux local enumeration
section of this course, we can enumerate the various Cron jobs
by cutting out the contents of the etc/cron file.
And in this case, you can see we can essentially
display all of them.
So I'll say Cron.
And there we are.
So this is the actual crontab file.
The crontab file is where you can essentially create or add
new Cron job.
So these right over here are just
basic Cron jobs, as you can see here,
that have been added to demonstrate
how you can set up a Cron job.
So, for example, we can see that in this particular example,
the first five fields I used to specify
the actual timing or the schedule
that you want to run the Cron job on.
And in order to create a Cron job,
we can create a simple Cron file,
and then add the Cron file to the crontab file.
So we'll just use the echo command.
And this is where we'll specify the command that
needs to be run.
So we will first specify the schedule.
So we'll just use the asterisk values
for the first five fields.
So that means we want this Cron job to run every minute,
of every hour, of every day, of every month, of every day
of the week.
We then specify that we want to execute bin bash.
And we're going to use the i option,
and redirect the output.
We'll use the ampersand command and say--
well actually before we do that because we're running this
directly from the target system, we can use the c command,
and then we'll open up a single quote there and say bash i,
and redirect the output.
And we'll use an ampersand there or a descriptor and we'll say
/dev/tcp/.
So this is where we are telling bash
to connect to a particular IP address and port.
So that's going to be our Netcat listener.
So after /dev/tcp/, paste in your Kali Linux IP address,
which we copied.
We then specify the port the Netcat listener is running on.
In this case, we'll say 1234.
And then we'll say 0, and we'll redirect the output there,
and the descriptor 1.
And we can close the single quote.
So let me just say ampersand 1 there.
We can close the single quotes and the double quotes
are closed.
And we'll output this into a file called cron.
And yeah, I think that should be fine.
And if we get the content of the Cron file,
you can see that it's specified correctly there.
So we can utilize the crontab i command to add this Cron job.
So We'll say crontab i cron, and this will add it as a Cron job.
We can view the list of Cron jobs
by typing in the command crontab l.
And you can see our current job has been added for the student
user account.
And that means that it will be executed
with the permissions relative or pertinent
to the student account.
So if you have access to the target system
and have elevated your privileges,
then set up the Cron job with the root user,
because you will receive access to the target
system as the user that you essentially
used to create the Cron job.
Now that this is done, the Cron job
is going to be running in the background every minute.
However, we haven't set up our listener.
Before we do that, I'm going to remove the wait binary.
And you'll see that our connection will be reset,
and the student user account password will be changed.
All right, there we are.
So let's try and see whether we can SSH back into the target.
So I'll say password.
And as you can see, permission denied.
So this simulates what would happen if we lost access
to the target.
However, if we set up persistence,
we can set up our Netcat listener.
So I'll say netcat nvlp.
And the port we specified was 1234.
I'll hit Enter.
And we're now going to give it a couple of seconds to a minute
in order to receive the connection, after which we
should receive a reverse shell once the Cron job is executed.
There we are, the Cron job gets executed on the target system,
and it provides us with access to the student
account on the target system because the Cron job ran,
and it executed the bash reverse shell command that connected
to our Netcat listener.
All right, so there we are.
Again, one thing to note.
This is not really a non-interactive shell
because we received a bash session.
So we now have access to the target system,
even though the actual password was changed
and we don't have access via SSH anymore,
because the password was changed.
So we can cut the content of the flag.
And voila, so that is essentially
how to establish persistence on a Linux target system
through the use of Cron jobs.
And this will work every minute.
As I said, you don't need to-- this will not just work once.
We will have persistent access whenever we want.
So I can set up the listener again.
And after a couple of seconds, there we are, we gain access
to the target system.
Again, fantastic.
So that is going to conclude the practical demonstration
side of this video.
All right, so that concludes the Linux persistent section
of this course.
And by this point, you should be quite
familiar with what persistence is,
and how to establish persistent or persistent access on both
a Windows and Linux target system.
We will now be moving on to the next section, which
will essentially entail the process of dumping and cracking
password hashes for both Windows and Linux.
So I'll be seeing you in the next video.