‫Let's try to create malware which cannot be detected by the security systems.
‫I'd like to try to create a backdoor with the MSF venom first.
‫Go to the fat rat folder and run fat rat script.
‫If you let the tool add a shortcut to the system, you don't need to go to the fat rat folder.
‫You can run it from anywhere.
‫It checks all dependent applications in conditions such as internet connection at the beginning.
‫Don't upload to VirusTotal warning.
‫OK, there are several different methods to create backdoors using the fact that you can create backdoors
‫here using MSF Venom Food, Win, avoid P.W. in, et cetera.
‫In addition, you can add backdoors into the original Android APK packages.
‫Let's create a malware with a backdoor using the MSF Venom in this example, type one and hit enter
‫into the main menu.
‫MSF Venom creator module menu appears.
‫Now, since our victim's machine's operating system is Windows, I chose here the second option in this
‫menu.
‫It first gives me the IP information of my local machine, then asks for the listener IP address.
‫Thanks for the kindness.
‫Since I use this machine as the listener, I enter its IP address, asking for the listener port, I'll
‫choose double five, double five for this time.
‫Now it wants me to enter the base name for the output files that the tool is going to generate while
‫trying to find the correct payload and malware.
‫You may need to try a lot of different options.
‫So to be able to recognize which file I generate for this time, I use the day of the month and the
‫time in file names.
‫For this example, since today is the first day of the month and it's 22 55.
‫I use oh one Dash 22 Dash 55 as the file name base.
‫Next step is to choose the payload.
‫Let's choose Windows Sigma interpreter slash reverse underscore TCP number three.
‫It uses almost all facilities of MSFT venom.
‫It encodes the payload with 10 iterations with Shikata underscored G.A. underscore and A.I. encoding
‫method first, then encodes with another method eight times and three other encoding follow.
‫The malicious executable was created.
‫It's in the output folder under the fat rat folder.
‫Now, let's go to the victim machine and transfer the file using when ACP connect to your county machine.
‫Remember, ACP protocol uses the SSA, so be sure that the SSA is running in calling.
‫My colleagues, S.H. is serving from four, four three.
‫Don't ask why.
‫OK.
‫We connected.
‫Go to the folder and where our file is root fat rat output.
‫And here it is.
‫Drop it and drag to the desktop of the Windows system.
‫But first, let's start Windows Defender and see if our malware is able to avoid it or not.
‫OK.
‫It's already running.
‫Now let's transfer the malware into the Windows system.
‫Oops!
‫Our malware is detected by Windows Defender.
‫And deleted in a few seconds.
‫Anyway, there are always some computers which do not have any security protection.
‫Let's examine our malware that works on them.
‫Go to Settings Administrator pane and uncheck the turn on this app checkbox to disable Windows Defender
‫and press save changes.
‫Now drag the malware again and drop into the desktop.
‫For running the application and the victim machine, let's think about the hackers side.
‫Are we ready as a hacker?
‫What do we need to connect to the back door if the malware succeeds?
‫Sure, we don't have a listener at the moment.
‫Go to Kalli Machine to start a listener.
‫Start Metasploit Framework Council using MSV Console Command.
‫While Metasploit Framework is starting, I look at the information of the back door in the terminal
‫where I create it to make sure the payload is the one I used.
‫Why?
‫Because I have to use the exact same payload while creating the listener.
‫MSF started type use, exploit slash multi slash handler first.
‫And then set the payload that we used in the malware.
‫Look at the options using the show options command, set the Elle host again, I use the information
‫of the malware.
‫Set the port, which was five, five, five five on my malware.
‫Now, type exploit to start the handler.
‫Go to the victim machine now.
‫And run, the malware we copied a few minutes ago turned back to Carly.
‫You see that a Metro operator session is opened once again, the victory is ours.
‫But wait a second.
‫Windows Defender and Windows eight has detected our malware.
‫We should find another way to create an undetectable malware.
‫This time, I'd like to create a malware using P.W. and wins the option six, we are now in the main
‫menu of the fat rat to type six and hit Enter to use P.W. in Windows to create the malware at this time.
‫P.W. in module menu appears.
‫There are different options here to create an exact batch or PDF file.
‫I'd like to use the second option to create an executable malware.
‫Now, when I type two and hit enter, it gives the IP information of my system and asks for the listener
‫host.
‫And to the ELLE host, the IP of your Kauai and L port, this time I use double six, double six.
‫Use whatever you want.
‫Based name four output files.
‫I use the same format.
‫Oh, one Dash two three Dash O2 again, I choose the third payload reverse underscore TCP.
‫The back door is saved to the output folder.
‫Now let's go to the victim machine and transfer the file using Win ACP.
‫Cowley's side of win FCP, we're in the output folder of the fat rat application before transferring
‫the new malware into the victim machine.
‫Be sure that Windows Defender is running.
‫I opened the action center and turn on Windows Defender.
‫OK.
‫It's running, I can transfer our new malware now.
‫No, not again, defender detected our new malware as well.
‫We should try another method the fat rat is very powerful and I'm sure we can find a way to bypass the
‫defender.
‫I'll try another method of P.W. and wins the sixth option of the main menu.
‫This time, I choose the fourth option in P.W. Wins menu.
‫I'll again create a malicious executable with a different method.
‫Inputs are all the same AL host first, then L Port I choose double seven, double seven this time and
‫the base name of the output files.
‫I chose the reverse TCP as the payload, the third option.
‫And done, the output file is created.
‫Let's go back to the victim machine.
‫Refresh the Kali side of when CP and drag the newest malware and Astrup into Windows desktop.
‫As you see at the lower right hand corner, Windows Defender is running and it couldn't detect our malware
‫this time.
‫Well done.
‫We overcame it with the first problem.
‫Bypass the security system.
‫Now, the main question is, does the malware work?
‫I mean, do we have the back door?
‫So at this point, we go back to Carly and start a listener, start the MSFT console.
‫Use exploit, multi slash handler to use the handler.
‫Set the payload, the same one we used in the malware, to be sure.
‫I prefer to copy the payload from the fat rat terminal and paste it, said L host the IP address of
‫Carly.
‫And L Port, remember that was seven, seven, seven seven.
‫I want to look at the open ports using Netstat, Dash and LP Linux Command Double seven seven is not
‫in use at the moment.
‫Back we go to MSV consoles terminal and type execute to start the handler.
‫Go to the Windows machine and run the malware by double clicking on it.
‫Back to the Cowley machine and a new maturity session is open now, we can say.
‫Victory is ours.