-: (Instructor) So, in this lab we're going to go into a 2 2
couple of technics to cover your tracks and 3 3
also to set up callbacks for those backdoors. 4 4
So, again the first thing we're going to need to do 5 5
is exploit the Windows machine to get back on the box. 6 6
Now that I'm there, again I'm going to check my SID. 7 7
I am sitting there as a system level user. 8 8
Again, I want to switch over to a normal admin user. 9 9
In our case, we're going to go ahead and switch back 10 10
into John Sim at this point because we haven't a remote 11 11
desktop connection to allow us to use that new 12 12
support account that we've created. 13 13
So, what we're gonna do is we're just gonna go ahead 14 14
and migrate into Process 480 which is the explorer, 15 15
and that will give us rights as if we are John Sim. 16 16
And we'll do the get SID again and verify 17 17
that we are John Sim. Now, again, everything I'm gonna 18 18
do here is gonna be from the Windows prompt. 19 19
So, we are going to go ahead and type in shell, 20 20
and now we are back on that box as if we are John Sim. 21 21
Now, the first thing I want to show you is 22 22
how to set up a callback. So, in the last lesson we 23 23
showed how to open up a port on the firewall. 24 24
But, how do we get the machine to always start up 25 25
that Netcat Listener for us so that it can 26 26
callback to us whenever we want? 27 27
Whether we can callback it whenever we want. 28 28
Well, the way you do that is by using the AT command. 29 29
And AT is just an automatic time scheduler. 30 30
So, the way AT works is we can set-up any 31 31
program to run whenever we want. 32 32
And, we can do that based on every day, every week, 33 33
every month or a specific day of the week at a certain time. 34 34
So, what I'm gonna do is, I'm gonna set-up an AT command, 35 35
and first I'm gonna check the time of the local system, 36 36
because if I don't understand the time, 37 37
everything is gonna be messed up, 38 38
because I bet you the Windows machine is not 39 39
showing 9:51 like my Callied machine is. 40 40
So, let's type in time and you'll see that for them, 41 41
it is four o'clock in the afternoon, 16:53. 42 42
So, what I'm gonna do is, we're gonna set-up a time 43 43
to do something and the time we're gonna do it is gonna be 44 44
four o'clock and 57 minutes. That will give us a couple 45 45
of minutes to be ready and be there. 46 46
So, what we're gonna do is type in AT and the time 47 47
we want it to happen. So, in our case it will be 48 48
49 16:57, and we're gonna tell it to do it every Sunday. 49 50
And, then we're gonna give it the command we want. 50 51
Now, what I'm gonna do, because I haven't set-up 51 52
a listener yet, is I'm just gonna use something simple. 52 53
I'm gonna have it bring up a command prompt, 53 54
and in the command prompt I'm gonna have it run a 54 55
system info command and pipe that to a file called 55 56
info.txt in the "C" drive. That will work just fine for us. 56 57
We can type and enter and there's now a new job. 57 58
To show the job, we can just type in AT and 58 59
you'll see that each Sunday at 4:57, 59 60
that is what's gonna happen. Now, 60 61
what will we see on the victim machine? 61 62
Well, we're gonna go over to that box and we're gonna 62 63
see what the victim's gonna see at 4:57. 63 64
So, I'm gonna show you what we're gonna see. 64 65
Right now there's nothing in the "C" drive as far as a file, 65 66
and it is 4:56. 66 67
Now, at 4:57, it's gonna run the command 67 68
and basically just do a system info which is a very quick 68 69
command and dump all that information to a text file. 69 70
And, we should see a text file be created on our "C" drive. 70 71
Now, that particular command takes a little bit to run, 71 72
so while it runs, it takes a minute or two. 72 73
You can see now that we finished and we have the info file 73 74
and it has some data in it. So, if we open it up, 74 75
you can see all the information that you would get 75 76
from a system info command. Now, that's not necessarily 76 77
very useful to us, but it does give us something 77 78
and it shows up the capability of being able to run 78 79
any program we want and again, if you open that firewall, 79 80
it can be doing things like pinging back to you 80 81
and telling you hey I'm still awake and 81 82
I'm under your control or it can call you back 82 83
so that every Thursday at 3am there's that callback 83 84
to you and your machine can answer it, 84 85
and then you can exploit that machine. 85 86
So, maybe you've set-up password sniffers, 86 87
maybe you've set-up network sniffers, 87 88
maybe you've set-up key loggers, 88 89
and every weekend you go back and get those files. 89 90
It can set-up that connection and send those back to you. 90 91
It all depends on what you want to do 91 92
and what program you want it to run. 92 93
And, that's just a little bit of how you can use AT 93 94
as a way to create that backdoor and help set-up 94 95
ways to send things back to you as you need. 95 96
Now, let's talk about how we're gonna hid some information. 96 97
Well, we have this info file, 97 98
so we'll use that as our information file, 98 99
and you have this hacked file. 99 100
Now, I'm gonna do this on John Sim's machine. 100 101
You can do this from the command prompt on the 101 102
interpreter box as well, but we're gonna use it 102 103
over here so you can see what the effect 103 104
is of us doing this. So, first I'm gonna open up a 104 105
command prompt, and what we're gonna do is we're gonna use 105 106
what's called an alternate data stream, an ADS. 106 107
And, we've talked about this in the lecture, 107 108
but now we're gonna use it in practice. 108 109
So, let's say I wanted to hid this info file inside this 109 110
hacked file on the desktop. Now, instead of this being 110 111
the hacked file, maybe this is the person's word 111 112
document, or something like that. 112 113
Alternate data streams work any type of file you want, 113 114
executable or not. So, what we're gonna do here is 114 115
we are going to do, we're gonna get to the 115 116
route directory first. So, we're gonna go to the "C" drive, 116 117
and from the "C" drive we can see that info file. 117 118
Now, on the desktop we have the hack file. 118 119
So, what we're gonna do is we're gonna go ahead and move 119 120
into the John Sim desktop 120 121
and from the desktop you can see 121 122
he has one file called hacked and 122 123
it is 37 bytes, very small file. 123 124
So, what am I gonna do? Well, what I'm gonna do is I'm gonna 124 125
type the c:/info.txt 125 126
which is my info file, 126 127
and that's the one I want to hid. 127 128
So, in my case it could be malware or anything else. 128 129
In our case, we're just gonna hid text inside other text. 129 130
And, we're gonna hid that inside the 130 131
file that we have here on the desktop 131 132
which is the hacked file. 132 133
And, the way we do that is type hacked.txt: 133 134
and then the name of the file, in our case info. 134 135
And, it's done. So, let's see how large that file is. 135 136
It's still 37 bytes and can I still open the hacked file? 136 137
Yes, it still looks the same. How do I get that 137 138
info file out? Well, the way we're gonna do that, 138 139
we're gonna read it. You delete that, so I'll show you 139 140
that it's no longer there. Well, if I just typed 140 141
to the screen hack.txt you'll see that's all I have 141 142
is that one line. Now, how do I, if I open it using 142 143
notepad, well, if I open it I can do 143 144
notepadhacked.txt it opens up and I get the hacked file. 144 145
Now, if instead I want the info file, 145 146
I have to do start and then do notepad, then do 146 147
hacked.txt:info.txt and hit enter. 147 148
And, what do you see? The information we that we hid. 148 149
Now, is that information still in the original file? 149 150
No, because we deleted it, right? 150 151
And, you can see here that file doesn't exsist. 151 152
So, there's really no hint that I've hidden a file 152 153
inside this hacked file. If I open it, 153 154
as the user, I just see the normal file. 154 155
I don't see the hidden information. 155 156
That's what an alternate data stream allows you to do. 156 157
It just hides it and even from the operating system 157 158
again, you see that that file size has not changed. 158 159
It's still 37 bytes. Now, in reality, it's larger. 159 160
But, that data is hidden inside this alternate data stream. 160 161
And, this is a function of the way NTFS file systems work. 161 162
Now, why is this useful to us? 162 163
Well, inside of hiding text, I could be hiding malware. 163 164
And, then I can call that malware using the AT program. 164 165
So, I can actually hid things very cleverly inside 165 166
the file system. No one's gonna ever see 'em because 166 167
they are that alternate data stream, 167 168
but then I can actually start them using the AT 168 169
command every night at midnight or every night at 3am. 169 170
And, that malware will make that callback to me. 170 171
This is how attackers maintain their access. 171 172
They dig in, they hid and they cover their tracks. 172 173
And, that's what we're doing with the AT command 173 174
and the alternate data streams.