Well, well, well, now it's time to take all the knowledge that we've learned in the previous skill and in this one concerning services and start finding a way for us to maintain persistence on the system.
And if the title of the skill hasn't given a hint, we're doing it through the services.
So in order to do this, we're going to be in our lab on the actual Windows 10 system to the left.
And you may notice on the right that I have Kelly opened up with MSF console ready to go.
We'll be there in just a minute.
In fact, let's go ahead and prep it.
So we've covered this already in previous skills.
We're just going to use the exploit of multi handler.
Then we're going to set our payload to Windows.
Sorry, I had a bit of a hiccup there with my video.
We're using the Metafree to reverse TCP show, and we're setting our Kelly box to be the listener with the port of 4444.
Now we're going to go ahead and hit exploit on this so that it's opened and listening.
We're going to move on over real quick to our Windows 10 system and go into the actual command prompt.
I'm just going to do start our CMD.
Now in the code box below, I have for us actual commands on creating a service.
And for the demonstration purposes only, to get the idea of this down, we're going to be using dummy.exe on our desktop.
I have it highlighted.
I'm going to zoom in for you real quick.
Right there, just to the left.
So we're going to kind of use that as our baseline and see if we could create a hidden service on the system and enact it.
Once we start this service, it should theoretically open up a connection to our Kelly box on the right.
Now, in order to do this, we're going to be staying in command prompt, just so you're aware.
So sc create, and we're going to call this service name dummy with a bin path equal to, and again, all commands below.
This is going to be exclamation point C drive users, and we can do a tab in this one, learner slash desktop slash dummy.
And then we're going to say start equals auto.
So that way, whatever the service is, it's going to enact whenever the computer starts up or logs in.
So it's always going to try to reach out to that reverse TCP listener set inside the configuration of the dummy.exe, which we made previously with MSF Venom.
We're going to go ahead and click start, and you'll notice that access is denied.
I tricked you.
This has to be done with administrative mode, and we've covered this in previous skills as well.
I just want you to see that this is not a regular user thing.
So we're going to copy that entire command right there.
Right click, close it, and now hit start CMD, right click, and open up command prompt.
Now, how would you trick them into doing this?
Well, you could use a file inclusion attack, which we have the link for that skill below,
or you could actually trick them with a macro inside of one of the many Microsoft Office products that we've also covered in previous skills.
I did create that skill, and you can tell because as I pasted it in there, you see create service success.
So now there should be a service inside the MMC for services called dummy.
We can test this by taking a look in here and seeing if it auto updated real quick, and it's alphabetical.
It didn't update in here real quick, so we'll open up an MMC console.
Yes, we want to open it up as administrator, and oh, I just saw something real quick right here.
Not only did it create the service, it started automatically because we set it on start auto, right, and it already made a connection to our Kali box.
So the service is ready behind the scenes.
We can verify this with our MMC console, go and add, remove, snap in real quick, go down to services for the local machine, click on finish.
OK, click here, and we're going to go down to D-U-M-M-Y right there.
I'll open it up for you real quick, and you can see that the dummy service has been created and is set to automatic.
Notice that the path to executable is what we set it to on the desktop, and it is an automatic.
You'll also notice there is no digital signature tab on this because it was a self-generated file using MSF Venom.
Now, as a bonus, I'm going to skim through this so you'll see a fast forward here.
I'm going to restart this system, and I'm going to exit out of that session of MetaPreator and run exploit here in just a moment, but I'm going to restart the system.
Once this starts restarting, I am going to come over here and go to exploit, and once I see that it is, I'm going to go restart anyway because I want to make sure it's a true success
and not one from a service that's running while it's trying to shut down.
So, once we get the go ahead of going to the BIOS startup, we will hit exploit, and then I'll fast forward for you right there.
And right there, there it is.
You can see that MetaPreator just opened up.
I'm going to zoom in for you, and we haven't even gotten to the login screen yet because our service was set to auto, which means now every time this system restarts, automatically the dummy service starts up and brings us a connection to our Kali listener inside of MSF console.
Now, it is a little bit shaky because it is not a recognized service inside of Windows, and on top of that, you may see that it comes up with this is a virus or something along those lines.
Remember, this is a testing environment.
Not everything is going to be perfect.
Restart the service if you need to, and take a look and explore a little bit.