Instructor: So what we're going to do 2 2
is we're going to use our backdoor, 3 3
the normal HTTP reverse Meterpreter backdoor 4 4
that we created in the first video 5 5
when we created an undetectable backdoor. 6 6
We're gonna use that and inject that as a service 7 7
so that it runs every time 8 8
the target person runs their computer 9 9
and tries to connect back to us 10 10
every certain amount of time. 11 11
So to do this, first of all, 12 12
I'm just going to Control + C this 13 13
and then I'm going to background the current session. 14 14
So we've seen that before. 15 15
You can do background and I can still interact 16 16
with that session on number one 17 17
and I'm going to use a module. 18 18
So this is like the multihandler module 19 19
that comes with Metasploit 20 20
and it's called exploit/windows/local/persistence. 21 21
Then I'm gonna show its options 22 22
to see what we need to configure. 23 23
So you can see here, 24 24
we have similar options to what we've seen 25 25
with the Metasploit service. 26 26
Sot the first thing is the amount of seconds 27 27
that the target will try to connect back to us. 28 28
So the interval and I'm gonna keep that to 10 seconds 29 29
so every 10 seconds, the target computer 30 30
will try to connect back to me. 31 31
Now the EXE_NAME is the name 32 32
that'll show up under the processes 33 33
where the connection's coming back from. 34 34
So I'm gonna set that to browser 35 35
to make it less detectable. 36 36
So we're gonna set the EXE_NAME 37 37
to browser.exe 38 38
and then the path where the payload 39 39
or the backdoor will be installed, 40 40
I'll leave that the same. 41 41
I'll leave the REG_NAME, the registry entry the same. 42 42
Now this is very important. 43 43
You need to specify which session 44 44
to run this exploit on. 45 45
And as you can see now, 46 46
we were using session number one, 47 47
that's our Meterpreter session 48 48
and if I do sessions -l, 49 49
it'll list all the available sessions 50 50
and we can see that it's id number one. 51 51
So what we need to do is we need to set our session here 52 52
to number one. 53 53
So I'm gonna do set 54 54
SESSION to one. 55 55
Okay and the startup, we'll gonna leave it 56 56
for the user person, 57 57
for the user privileges. 58 58
Now, let's show the options. 59 59
So browser, and the session number one. 60 60
That's all good. 61 61
Now, we need to do one thing 62 62
which is the most important thing 63 63
is to specify the payload that will be injected 64 64
as a service. 65 65
So to do that, 66 66
we're going to do a show advanced 67 67
and we haven't seen this before 68 68
so every module has advanced options 69 69
that we didn't have a look on before. 70 70
So show advanced will show you advanced options 71 71
that you can set up for this particular module. 72 72
So when I run this, 73 73
you'll see, I'll get so much more options 74 74
and the one that we're interested in is this one 75 75
so it's called EXE: Custom 76 76
which means that we're going to use a customer EXE 77 77
to run and inject into the target computer 78 78
as a service. 79 79
So I'm gonna set my EXE:: Custom 80 80
to /var/www/html/backdoor.exe. 81 81
As you remember, I had that running on backdoor, 82 82
I had that stored in /var/www/html/backdoor.exe 83 83
so I'm gonna hit Enter 84 84
and I'm just gonna do show advanced again 85 85
to make sure that it was set up properly 86 86
'cause sometimes I misspell things 87 87
and it's /var/www/html/backdoor.exe. 88 88
So that's perfect. 89 89
Everything is good to go. 90 90
I'm gonna exploit this. 91 91
And that will upload /var/www/html/backdoor.exe 92 92
on the target computer using the session that we specified, 93 93
session number one. 94 94
As you can see now, it's been uploaded 95 95
and installed and one important thing 96 96
that you need to keep in mind is this resource file 97 97
'cause you can use this to clean up 98 98
and delete the backdoor once you're done 99 99
so if you don't want the backdoor anymore 100 100
on the target computer, 101 101
you can use this file to delete that backdoor 102 102
so I'm gonna store that in a Leafpad here 103 103
so that I can run it and delete my backdoor if I wanted 104 104
to delete it anytime in the future. 105 105
If I do sessions -l, 106 106
I still have my session here 107 107
and I can interact with it. 108 108
So what I'm going to do 109 109
is I'm actually gonna kill that session. 110 110
I'm gonna kill all my sessions. 111 111
And now if I list, I have no connections 112 112
with the target computer as you can see 113 113
and I'm going to go to use my exploit/multi/handler, 114 114
so I can listen for incoming connections 115 115
and everything is configured correctly already on this. 116 116
So I have my write port and my write IP. 117 117
Now, if I exploit this, 118 118
right now, I'll get a connection straightaway 119 119
because my backdoor has been injected 120 120
into the target computer on port 8080 121 121
on reverse HTTP but I'm not gonna do that now, 122 122
I'm actually gonna restart the target computer 123 123
just to show you that I'll always have connection now 124 124
with this computer. 125 125
So I'm just gonna do a normal restart. 126 126
So this computer will basically try to connect back 127 127
to me every 10 seconds. 128 128
No matter how many times they restart it, 129 129
they shut it down, every time this computer is running, 130 130
it'll try to connect back to me 131 131
in every 10 seconds. 132 132
So all I have to do is run my Meterpreter handler 133 133
and wait for connections. 134 134
Now, this connection's running as you can see. 135 135
It doesn't have to be at the startup 136 136
when I'm listening 137 137
and I'm just gonna do exploit to listen. 138 138
And it will take a maximum of 10 seconds 139 139
to get a connection back 140 140
and as you can see, I got a connection 141 141
to the target computer, 142 142
I go do sysinfo and run all the commands 143 143
that we learned so far 144 144
and have full access on that computer.