‫So now is it time to persist on the Windows eight system?
‫As we've seen before, the persistence method of interpretor suggests to us to use post windows managed
‫persistence, Emmanuel.
‫Now we can use the manual directly with the run command as seen in the example in this regard, we have
‫to set the options in the command line.
‫So I prefer using the module with use command to be able to interrogate the options in detail.
‫So I'll use the background command to drop back to MSF console interface.
‫And I use the use command to use the module.
‫Now, let's look at the options.
‫RISC path is the option where we set the executable file, which will be used as the back door.
‫My pretty back door was under the output folder of the fat rat.
‫So we need a session and we have one, let's list the sessions to see its ID number, the ID number
‫of our session is one.
‫Start-Up Option asks when to trigger the back door.
‫It can be triggered when the user system or service is started.
‫And as you see in the session details, our session runs with the system privileges, so we'd better
‫use system for the Start-Up option.
‫Now, let's look at the options once again, just to double check that we have them properly back doors.
‫OK.
‫Session is one RISC name is the name of our back door in the victim system.
‫I left it as default, but you can change it anywhere you want and startup is system great.
‫We are ready to run the module.
‫OK, let's see what happened.
‫So it says the back door has been written as default you under the tent folder.
‫So now I go to the victim to verify it, open the Windows Explorer, go to the Tim folder under the
‫Windows folder.
‫Default audio file is right here, as expected.
‫OK, so now is it time to examine whether we are able to persist on the victim's system or not?
‫It's all use sessions I command to interact with an interpreter, says info to check the connection
‫and the system.
‫Now, let's reboot the victim system using interpreters reboot command.
‫Now look at the Windows eight VM.
‫Yep, that's restart.
‫So now we're going to lose the interpreter session in a second, but remember, from the first method,
‫the back door will try to connect back to us.
‫So we need a listener, also known as a handler, to listen to the connect back requests.
‫So I'll draw back to the MSF console interface using the back door command to create a handler.
‫So use exploit multi handler.
‫A lot has to be the same as a payload used in the back door.
‫And remember, that is Windows Interpretor Reverse TCP.
‫OK, let's look at the options.
‫Set El Hostis Carly.
‫Airport was for three to one in our back door.
‫Remember, the airport has to be the same as you used in back door.
‫So I start the handler using the exploit command.
‫OK, so go back to Windows eight.
‫Yeah, it's restarted and we're ready to log in now.
‫I log into this system.
‫And back to Carly.
‫So we're supposed to have a session in seconds, so wait for it.
‫Yes, the materialisation opened well for sessions are open, so double check, triple check, quadruple
‫check then.
‫Now we've got the answer.
‫We have a persistent back door on Windows eight victim.