Instructor: In all of the scenarios 2 2
and videos we done so far, 3 3
we would lose our connection to the target computer 4 4
as soon as the target person restarts their computer 5 5
because we used a normal backdoor. 6 6
Once they restart their computer, 7 7
our backdoor will be terminated, 8 8
the process will be terminated, 9 9
and we'll lose the connection. 10 10
In today's lecture, we're going to talk about methods 11 11
that will allow us to maintain our access 12 12
to the target computer 13 13
so that we can come back at any time 14 14
and regain our full control over that computer. 15 15
There's a number of methods to do that. 16 16
The first one is using Veil-Evasion. 17 17
We can use, instead of the normal backdoor, 18 18
the HTTP backdoor that we created. 19 19
You can use a HTTP service or a TCP service. 20 20
I'll actually show you here. 21 21
If I just run Veil-Evasion, 22 22
and do a list, 23 23
you see that we have, at number seven right here 24 24
and at number five, 25 25
we have service backdoors. 26 26
You can use any of them. 27 27
If I do use five, 28 28
and we can see the info, 29 29
all you have to do is just setup your lhost. 30 30
Put the lhost and then generate the backdoor. 31 31
Once you generate it, you can use it 32 32
and combine it with other stuff 33 33
and send it to the target person like we did, 34 34
or you can upload it 35 35
using the upload command that we learned, 36 36
and then execute it. 37 37
And that will install the backdoor as a service 38 38
on the target computer. 39 39
Then all you need to do is use the multi/handler, 40 40
and any time their target computer starts 41 41
it'll try to connect back to you 42 42
because this is a reverse shell. 43 43
Now, I'm not gonna be explaining this method 44 44
because this method is very simple. 45 45
We've done something very similar to it before. 46 46
We created a backdoor using Veil-Evasion 47 47
and we uploaded stuff to the target computer. 48 48
All you have to do is create a backdoor, 49 49
upload it, execute it, and you're done. 50 50
Also, it doesn't always work, 51 51
so that's why I'm not gonna be explaining it. 52 52
The normal backdoors are much more reliable 53 53
that's why I used a normal backdoor 54 54
when I was combining it with stuff 55 55
and changing its icon and all that. 56 56
The other method is to use 57 57
a module that come in with Meterpreter, 58 58
which is called Persistence. 59 59
Let me show you how you use that. 60 60
If you wanted to use that, all you need to do is do run, 61 61
and the name of the module is persistence, 62 62
so we're gonna type that down. 63 63
Then I'm gonna put minus H to see the help menu 64 64
to show me all the options that I can setup. 65 65
You can use the A to start a 66 66
multi/handler (mumbles). 67 67
You don't really need to do that. 68 68
You don't really need to change the location 69 69
where the backdoor will be installed. 70 70
The minus P option will specify the payload. 71 71
Again, windows/meterpreter/reverse_tcp 72 72
is a really good payload, 73 73
so you don't really need to mess with that. 74 74
S is to get it to start using system privileges. 75 75
Now, as you've seen before, we don't have system privileges, 76 76
we have normal user privileges. 77 77
So, what you should be using is minus U. 78 78
Then you can use the minus i to setup 79 79
the amount of time 80 80
that the backdoor will try to connect back to you. 81 81
It'll try to connect every 10 seconds, 82 82
or 20 seconds, or 15 seconds, 83 83
whatever you specify. 84 84
p to specify the port, 85 85
and r to specify your computer, the IP of your computer. 86 86
To run this, all you have to do is just do run 87 87
persistence, 88 88
use minus U to start it under user privileges. 89 89
I'd use the interval, I probably put it to 20 seconds. 90 90
It'll try to connect back to me every 20 seconds. 91 91
Then I use the minus p, and I'll probably put 80 92 92
because, as I said, the port 80 doesn't look suspicious. 93 93
The target person will see 94 94
that our connection's trying to come out at port 80, 95 95
which is cool, it's not really suspicious. 96 96
Then I'd use minus r to specify my IP, 97 97
which is 10.20.14.203. 98 98
Very simple. 99 99
Persistence is the module that you're gonna be using, 100 100
U to run it under user privileges, 101 101
i, the amount of seconds 102 102
for each time it tries to connect to you, 103 103
p to specify the port that you'll be listening on, 104 104
and r to specify your IP. 105 105
Now, obviously, once you run this, 106 106
if you want it to receive a connection, 107 107
you have to start multi/handler 108 108
on port 80 or on the selected port 109 109
and use in the selected payload. 110 110
The problem with this methods is that 111 111
it's detectable by antivirus programs. 112 112
Therefore, I'm not gonna be explaining (audio cuts off). 113 113
I'm gonna be explaining 114 114
is a combination of both of these methods 115 115
which will not be detectable by antiviruses 116 116
and it's much more robust 117 117
than the first method using Veil-Evasion.