Welcome back everybody.
We're just going to go ahead and create a persistent reverse shell.
We already have a reverse shell.
We're just gonna make it persistent.
That would be a better way to put it.
Anyway, hopefully you have the same setup as before.
If not, just go ahead and repeat the steps.
No big deal.
Let me just show you sessions- l.
I still have it up and running here.
My session IDs are 5 and 6.
Yours will be probably different if you have decided to redo the process.
Or if you were doing the process like me in the first place,
you'll probably have different session IDs.
It'll probably be 1 and 2 or something of a kind because I've opened quite
a bit of them and I haven't closed MSF.
I have not cleared the cache or anything of a kind.
Doesn't really matter.
Different session IDs don'really mean that much.
You can just change them.
That's just one number in the whole command.
Be careful about that.
Anyway, once you go ahead and bring one of the sessions into foreground,
session 6 is the one with elevated privileges, so let's go ahead and use it.
And just like I showed you before, sessions -i 6.
So this session ID, you see where I'm typing 6 here, might be different for you.
Just change it accordingly.
Press Enter, there we go, meterpreter is now up and running.
So if I just, I cannot clear the screen here, this is annoying beyond belief.
Excellent.
So what do we need here?
We need to type in run persistence -h for
help menu and wait for it.
There we go.
So we got several options here.
It says automatically start a matching multi/handler to connect to the agent.
Location, payload use, automatically start the agent, alternate.
There are a lot of things.
We want this one, automatically start the agent when the system boots.
Feel free to experiment with pretty much anything else here that you can see.
Use different ones.
See what sort of options will you get.
But they will work on pretty much the same principle like what I'm going to do now.
I just want the agent to boot immediately when somebody turns on the computer.
And that is what interests me the most.
[SOUND] So, same as before, run persistence space -h.
Instead of space -h, you must type in -X.
Press Enter and wait for it.
[SOUND] Running, installing persistence script.
Excellent.
So one of the bad things about this is that these sessions don't actually require
any login credentials.
Anyone listening to this, yeah, they would be able to connect.
Anybody following through the connections, anybody attempting to connect would
be able to listen for the connections that are being transmitted from the other end.
They would be able to,
well not perhaps connect directly because the IP addresses are set there.
But those IP addresses, if you're going over the net, are dynamic.
And if you're in LAN, okay maybe there's static, maybe there's static,
maybe they're dynamic in LAN.
I don't know, depending on how it was configured.
But they will still definitely be able to listen to the traffic as well.
So that's gonna be a bit problematic.
And it's an open type connection.
It only depends on the IP address.
There are no actual log in credentials which is not really nice.
However, remember to clean up after yourselves.
It says here resource file for cleanup.
You can see where it is.
The first line I believe.
And then it says installing into autorun as HKLM\Software CurrentVersion.
This is the regedit files if I'm not mistaken.
There you can see it as well.
And here you can see where the script is located.
It's actually a visual basic script.
That's not a surprise really.
Anyway, you get the idea here.
Now the persistence is up and running, the meterpreter is up and running.
Let's just try to reboot the system on the other end and
see what happens if I type in help.
I'm sure that the command for reboot is reboot, but let's just be certain of that.
Come on.
Read, resource, run.
Nope.
Upload, search okay there.
It doesn't seem to be here.
Okay so here it is.
Reboots the remote computer system under system commands of course.
Me, being a genius that I am, looking in wrong places all the time.
So type in reboot.
And this is unlikely to work.
Operation failed.
Let's see if the Windows machine is still running.
It is.
Yep, there we go.
No problems there.
No change has taken effect.
As I said, some commands here will work, some will not.
But you always have the option of typing in shell and
then doing it manually yourselves.
Type in shutdown /r, press Enter.
Oh, access is denied.
Which session have I opened?
Meterpreter session 6 closed.
Oh no, I've closed it, that's not what I want.
But it doesn't really matter.
The persistence is still running on the other side.
Let's just see.
I do believe that I have another one that is running.
Okay, session 5 is running, sessions -i 5.
Press Enter.
Interaction is active, shell,
meterpreter is there.
Process, you gonna give me the shell?
Yep, you will give me the shell.
Let's go cd.
I'm gonna exit out of here and then shutdown /r.
Shutdown is not, oh, shutdown /r.
Are you gonna do it?
Okay, so there's a default timer of one minute.
I should've configured a timer.
As well if I just type it in one more time
you will see, a system shutdown has already been scheduled.
So, this is gonna start pretty soon.
Should've given a timer.
Let's see, shutdown /r /t 0.
Will this work better?
Excellent. So it will.
If you give it a time, it's gonna shut down immediately.
If you don't give it a time, I think the default is one minute which is,
I don't know.
I guess I could have waited, but it's a tutorial,
so I didn't wanna waste any time.
Anyway, you can see that the Windows 8.1 machine is actually rebooting.
And what you need to do on the other end,
just press Enter here and type in session.
No active sessions.
Okay, so just go as before.
Use exploit multi handler,
use explot/multi/handler.
And let's see, show options, cuz you need to reopen it again on your end.
Excellent.
So all seems to be in order here.
If I type in exploit, it's listening.
So as soon as the.
Okay, the machine has booted, but I haven't really logged in.
Let me just login and see what happens on the other end.
[SOUND] Windows, Kali.
No, nothing?
Come on be a pal here.
Start up.
It just started, I interrupted it.
But oh, no, okay.
It did open, meterpreter session opened,
so if I type in shell, shell.
I don't know. It didn't work the first time,
but let's see.
Just cd, cd, dir.
There we go.
I am effectively in a Windows machine and I can do, again,
whatever I want to it from this point onwards.
I am in command of this Windows machine.
I am omnipotent on it.
I have greater power than the user.
I just don't have the access to that shutdown physical button.
But anyway, I don't know, it does make some difference I guess, but
nothing significant.
You have full control over the machine.
You can do, from this point on, you can do whatever you want to it.
Your options are countless.
I've already showed you where you can find the options for key logging and web cam.
Web cam is actually quite nice.
It does take up quite a bit of bandwidth.
And keep in mind, that somebody's going to be able to see when you
turn the web cam on because the light is gonna be turned on.
However, I was honestly surprised when I saw that people
didn't actually notice that always.
They do notice it after awhile, but not immediately.
Anyway, feel free to play around.
Do whatever you wish with it.
Try to find new ways of doing this.
Of elevating privileges, try out other exploits.
And feel free to report your results on Udemy in the discussions.
And if you get stuck with anything, as always,
I am more than happy to help you out.
Just ask your questions away.
Quick reminder, I had mentioned in one of the other tutorials as well.
If you could boast the error messages that you get immediately,
that does help me a lot when solving your problem.
And if you type in the exact command that you used, and if you type in the exact
error that you got from the system, that does help me a great deal because
then I can provide the solution far faster than you describing your problem and
then me asking what your messages and what the command is.
And you get one or
two unnecessary cycles as opposed to just going immediately to the problem.
Anyway, I bid you all farewell and I hope to see you in the next tutorial.