In this lesson,
I want to perform a quick demonstration to show you
how easy it is to create
and use a virus and remote access Trojan.
Now before we begin, it's important to note
that I'm using an older legacy-style machine
for this demonstration
because these are known vulnerable Windows 7 machines
that I'm using inside of my lab environment.
Now this is a great operating system to use
for these types of security demonstrations
because they are vulnerable
and there is no longer any new security patches
for Windows 7 systems in existence.
So if you're trying to replicate this demonstration
on a more modern workstation like Windows 11 or Windows 10,
it will usually be detected
and blocked by your modern antivirus software
like Windows Defender.
But there are newer tools
that are being developed by threat actors, attackers,
and penetration testers all the time that you can use.
Now I've had many students ask
where they can download a tool like JPS Virus Maker
that I'm going to be using in this demo,
and you can find these things online.
Now, because I did not create this tool
and I don't own the copyright to it,
I am not able to provide you
a direct download link for this tool
or tell you where you can actually go and download it.
Making a virus is not considered a testable item
for your exams,
but I wanted to provide this quick demonstration
so you can see what kind of things
a virus like Trojan can do
once they've compromised your targeted system.
Now, if you move into the world
of penetration testing later on in your career,
you'll learn all about the different tools that we use
in modern networks to be able to create viruses and Trojans
to be able to break into corporate networks
as part of your penetration testing assessments
and engagements.
Alright, let's jump into the demonstration.
So I have two machines set up here,
I have one on the left, which will be my attacker,
and one on the right, which will be my victim.
On the attacker's machine,
I'm running a program called Virus Maker 3.0 or JPS.
Here is basically a point-and-click options
of all the things that I can do
to that machine on the right.
For our example, I'm going to do one that's easy to see.
It's called Crazy Mouse.
So I'll go ahead and click that
and then I'm going to select
what do I want it to be called after installation.
We'll go ahead and call it the service host.
And what do we want the server name to be called?
The file name.
And I'm going to go ahead and call it Explorer.exe.
You could really choose whatever you want.
It just depends on how sneaky you're trying to be.
Now the next thing I'm going to do
is I'm going to create that virus.
At this point, that has been created
and saved to my Downloads folder.
Now at this point,
I need my victim to be able to download this virus,
and there's lots of ways to do that
based on your social engineering,
tying this virus into another program,
using a spear phishing campaign,
putting it as a rogue download, all sorts of things.
For this particular example though,
I'm just going to show you the effect
if the person was able to download it and if they ran it.
So at this point the user's been tricked,
they've downloaded the file and now they run it
because they think it's a game or whatever else it is.
In this case, they think it's a picture.
If we go ahead and run that, see what happens.
And there you can see the mouse just starts going,
jumping all over the screen
so that if I wanted to try to open something
like the trash can,
I can't because every time I click on it,
it jumps away someplace else.
That's the idea of this very simple virus.
It's just a nuisance.
It's trying to a problem for them.
Now let me show you an example
of what a remote access Trojan or RAT looks like.
Now, on the left is my attacking machine,
and on the right is my victim machine.
So I'm using a program called ProRat.
So the first thing I want to do is create a ProRat server.
I'm going to click on General Settings,
and from here
you can see the port it's going to operate on, 5110,
which I can change to anything I want.
The server password, in this case, 12345,
again, not very secure,
but for our lab purposes, it's just fine.
And then the victim's name if we have it.
From here, we can give them error messages,
we can melt the server on install,
which means once the ProRat
has been installed on the victim computer,
it will delete itself while still maintaining a connection.
We can kill the antivirus and firewall on start,
we can disable Security Center
and all sorts of other things like that.
I'm going to go ahead and give a fake error message here
saying "You have been hacked."
Now normally you wouldn't want to send a message to your user
showing that they've been hacked,
but I just want to show it to you for demonstration purposes.
Maybe you're doing this as a ransomware
and you've encrypted their files.
This is a way to send them a message
saying you need to pay me if you want access to it.
And from there we'll just go down
and we can go ahead and hit Create Server.
From there, the server is going to be created for us.
Go ahead and hit OK.
So if we want to be a little trickier,
we're going to go ahead and bind it with a file.
So we're going to select a picture,
in this case, the desert,
go ahead, hit Open on that.
And then we're going to give it another server extension here.
We want to call it EXE, SCR, COM, PIF or BAT,
EXE will be just fine.
And for the icon, what do we want this to look like?
Well, we want it to look like a photo.
So we're going to go ahead and make it a JPEG
and then we can go ahead and hit Create the Server.
And this is going to be in our current directory.
So if I look back in my current directory,
I now have the binded server with a JPEG icon.
And from here we can go ahead and rename it
and let's call it Desert.
So now they think they're getting a photo of the desert.
At this point, again, we would use some form of trickery
or social engineering to get it to them,
and once we do, it'll be on their desktop.
So at this point,
I've tricked the user and they now have the file.
They're going to go ahead and open that file,
and when they run that file,
you're going to see the error message that we told it to have.
There's the picture and you've been hacked.
Oh-oh, now what's going on?
Let's go ahead onto our target machine
and connect to that server that's now been installed.
Again, we're going to use our password 12345.
And at this point, we now have access to that machine.
We can find out information about it.
In this case, if we go ahead and get the system information,
I know now the computer name is Bob Sales.
I know what kind of machine it is.
It's using English for its language, System 32 is its path.
I find out what kind of users it has.
I found out the date and time of the machine,
all of that information.
And if I close this on the right,
that'll move out of the way.
We can get all that information here
from our attacking machine about our victim machine.
We can also look at the last 25 websites they visited
and maybe that would be something
that would be helpful for us to be able to attack.
We can take screenshots and we can actually open it
and see what we're going to see.
So if I do a screenshot,
I see what's on their screen.
So if they're on a website like Google here,
which is not going to connect
'cause I'm in a live environment here
that's disconnected from the machine,
I'll go ahead and hit Snapshot
and now I can see that.
If they had a webcam, I could view their webcam.
Again, I have lots of access
to do whatever it is we want to do on this machine.
I can send them messages if I want,
so I can do a message and say Test.
And I'll say, "I don't work for you anymore."
So we're going to go ahead and send that over there.
And there it is, "I'm sorry, I don't work for you anymore."
And so you can see the power of a remote access tool.
And so this allows me to do all sorts of different stuff.
Again, I can take their files,
I can mess with their registry.
I can go through and look at all their files,
I can FTP over and grab their files.
I can chat over to them.
I can do some funny stuff.
Maybe it's my friend and I'm just trying to show them
that I have access to their machine.
For instance, I can hide their desktop icons
and now you should be able to see that that is gone.
And I can show their icons and they're back.
I can make the mouse go crazy and then I can fix it.
I can flip their screen upside down and then I can fix it.
So you can do all sorts of different things on this machine
and take control and do whatever it is that we want
because we have that remote access to them.
I hope you found this demonstration insightful
as you started to see what kind of effects a virus
or a remote access Trojan can have on a victimized system.