‫OK, let's persist, our Métis Boite framework session in the first example will see how to persist.
‫Amateur operators session.
‫OK, I'm in Cali, so first I checked the IP address, it's two to two.
‫Now, this is the first victim, a Windows XP system, so I'll check its I.P. address as well, it's
‫two zero seven.
‫So now back to Cali, let's have an interpreter session on the victim's system, first start the MSF
‫console since we've already seen all this before, I'll try and keep it as far as I can.
‫But remember, the more practice you get, the more you are able to learn.
‫From the previous lectures, we know that the system has M0 wait 067 vulnerability, so the search for
‫now.
‫And here's the exploit, so let's use it.
‫I said the reverse DCP material payload.
‫So the options.
‫Set the options, remote host.
‫Listen, host.
‫We have the ports with the default values and run the export.
‫OK, so now we have an interpreter session.
‫Now this info to check the connection and the target.
‫Everything seems OK.
‫Interpretor has a persistance method.
‫So let's look at the help menu of the method first using the parameter.
‫Now, the beginning of the help page, it says The method is deprecated and it suggests to us to use
‫persistance XY post module, so we'll use that module as well.
‫But first, I want to show you how to persist Immaturities session using the persistance interpreter
‫method because the persistance key post module requires a malicious executable, whereas persistance
‫method creates the malware itself.
‫So let's create a valid persistance method.
‫First, we need to have a handler to be able to reply to the connection request that will be requested
‫by the victim systems.
‫Well, at this point, I guess I better explain what the handler is in a back door, use a payload with
‫the reverse connection to let the victim connect to your system when the back door binary is executed.
‫If you use a payload with a reverse connection, also known as a connect back, you, the attacker,
‫have to set up a handler.
‫We can also use a word listener first on your box.
‫The victim or target machine acts as a client connecting to that listener.
‫And then finally, you receive this session.
‫So in the persistance module, we can start a listener automatically using a parameter.
‫The el parameter is to define the location in the victim system, to put the back door binary file.
‫It's the temp folder by default, which is OK by me.
‫So you set the payload that will be used to connect to the victim, it's interpreter's reverse TCP by
‫default, which is the same with the payload we used while creating an interpretive session so we can
‫leave it as is or let's just set it in this example.
‫Access to start agent automatically when the target system is booted.
‫I is to set the interval of the TREIS in seconds between the connection attempts, I don't actually
‫know the default.
‫So let's set it, for example, 10 seconds.
‫Now, these are the most important parameters of the method P is to set the listen all, set it to five
‫five, five five, and R is to set the listen host, which is running the meds midpoint and ready to
‫listen for the connection requests.
‫And that's my colleague to.
‫To to.
‫Now we are ready to run the persistance method, so hit enter.
‫And that's finished, so let's look at the messages to see what happened.
‫So this method looks like it put the back door under the Windows temp folder of the victim's system.
‫And let's go to the victim's system and look at the temp folder open in Windows Explorer and go to the
‫folder Windows Temp.
‫And here is the back door, it's a visual basic script file.
‫Now I turn back to Cali to continue to look at the messages.
‫Now, the method has started the handler, which is required to listen for the request of the victim's.
‫And lastly, it's installed a key into the registry, which will be used to ought to run the back door
‫when the system boots.
‫So now go into the victim's system and look at the registry to check if the auto run key is installed.
‫Now, from the start menu, click, run, type, rejected and hit enter.
‫So now we're in the registry, Ed I'll follow the path written into the message.
‫Each key local machine software, Microsoft Windows current version.
‫Run.
‫And here it is, here's the inside key and its value to Rex, to the installed back door file.
‫And finally, last message says that the method has created another maturity's session.
‫So I'll go back to the MSF console interface using the background function, list the sessions and jump
‫into the session that's created by the persistence method.
‫So let's just say that as the user of the victim machine, I decided to restart the computer.
‫Without the persistent step, we would lose the interpreter session forever and we would have to exploit
‫the system all over again.
‫But now we have run the persistance, let's see what happens when the victim system reboots, the victim
‫system is shutting down.
‫Now, let's look at our interpretor session, a command sis info, for instance, and as expected,
‫it doesn't respond.
‫And yeah, there it is.
‫It says a session died control.
‫See back to the MSF console.
‫Now look at the active sessions using sessions and command session.
‫One seems active, but it's not.
‫So try to interact with a session using sessions, Eichman run a command such as Cesan.
‫Now look at that.
‫You see that the session is already dead.
‫So use control, see to drop back to MSF console interface.
‫So we have no session at the moment.
‫So go to the vector machine and log in.
‫Well, do you know how to press control alt delete in a virtual machine?
‫In most cases, one of these buttons has a special meaning in the virtual environment, so you cannot
‫simply press the buttons.
‫Instead, you can find a menu item to send control of the leak to the VM.
‫In VMware, Fusion in the main menu, go to virtual machine and select control elite.
‫So back to Cali, as you see, a new interpretor session is opened as soon as the victim is logged into
‫the system.
‫So now Sessions L.
‫And here is the new maturity session.
‫Youth sessions, how to interact with a session.
‫Send the command to check the connection.
‫And look at that, we now have a back door on the victim machine.
‫So let's try to log off and log on again to just to test the persistance, so log off the victim.
‫And the interpreter session dies.
‫Log in again.
‫Yet another session has created.
‫And if the system is in use and is attached to the network, we have a maturity session on it.
‫So I'd like to remind you once again that persistence might be out of the scope in your penetration
‫test, read the conditions of the agreement carefully and do not attempt to persist on any system unless
‫you're allowed to.
‫Very important to remember that.