Hello everybody and welcome back.
And right now let us continue on fixing and adding a different functions to our back door.
So first thing you might have noticed in the previous videos or in the first video where we tried to
actually run our our backdoor.
You might have noticed that we can't really change our directories so we can go on directly back or
forward or basically change to any other directory instead of the instead of the directory that we ran
the program in.
So we want to be able to change that and how we do that.
Well basically first of all let us know the reverse Sheldon UI
so let's see what we have to do in order to get this to work.
So first of all we want to go to our show function right here so let us tap this a little bit down and
we can see right now we have these two options right here.
Q for breaking and try and accept rule with basically executing the system commands on target system.
We want to add another option right here and we also covered in the python basics that we can run and
if else command with multiple statements with using l If so we will after the Q specify the L if command.
And right now we want to specify basically what to do if the if we try to change the directory.
So in our reverse show Let's think first what the target or what the reverse shall we receive.
Once we try to change the directory we know that in Windows if I go my command prompt it is same as
in the Linux.
We can change the directory with the C D or CB desktop will change the directory to desktop we can see
that we have three spaces right here first to take the D two characters which is C D and then the third
space right here is the empty space.
So we know that first we specify the C D command which is two letters and then we add space and then
specify the path to the directory we want to change.
So we need to keep that in mind the ones we write this.
So the target machine or the reverse shall we receive a command that will always start with C D empty
space and then the path.
So what we want to do is basically just select here.
Else if command equals so double quote equals to the C E code the quotes and right here we cannot specify
the command equals two that we need to specify if two letters of the command equal to C D first two
letters or first two characters.
Now we know that we actually covered in Python basically a string manipulation so we know that we can
select the first letters we're typing two dots and then two this will all select the first two characters
from zero or basically the character labeled is number zero and character labeled as number one.
So all the characters up to the second one and we know that it starts from 0 0 0 and 1 are actually
first two characters.
So here we specified if the command if the first two characters of the command equal C D.
We also want to specify and the length of the command is bigger than one.
Now this means that if the length of the command is a is a larger than two letters so for example if
I just type your C DB You can see that the C D command in windows actually print my current working
directory it is same as P W Dean Linux in Windows it is just silly.
So we want to differentiate these two comments so C D which prints the working directory and c d to
another directory which is for example desktop.
So that's why it specified right here.
If the command is the first to collect the letters of the command equal C D and the left the command
is weaker than one.
This means that we want to change our directory to some other path since we specified an empty space
after the after the C D.
And we want to add the two dots right here and all we want to do is write to try and accept rule right
here.
So we actually if for example we run this on target and we have wrongly specified did depart that want
to change our directory to this program will break.
If we do not have a tried and acceptable.
So we want to try to change our directory and we will try it.
We always dot c h there and then we were did we will be actually the command just or the command after
the first three letters and what the path to the directory will be is the command.
Just after the first three characters so command then we specify these brackets right here and then
three and then two dots after the three we closed these brackets and we closed the second bracket.
This means that the path that this function right here will try to change its path to the remaining
of the command right after the first three characters and we know that the first three characters are
C D and then and this base.
So after that we'll be the part.
So we know that we will change the path to that part of the command and we want to accept in the case
that directory doesn't exist.
We want to send something back.
So we will use a reliable send or actually let's just continue right here.
We do not want to use a reliable census.
There is no point so continue which will actually just continue with our while True loop.
So we specified right here to change our directory if the first two letters are C D and the length of
the command is bigger than one.
And we also specified if that directory can be changed to We want to specify the code to continue executing.
So this should be about it for this reverse shall not be y side part of code or deed C D.
Now we will also want to specify the what the server should do once the reverse shall basically execute
the change we call directory command.
So if you notice right here and right after we execute this command we do not sign.
We do not send anything to the server.
So what the reliable shall we do.
Or pardon me what the reverse shall we do after we execute the general directory to go back to the beginning
of our true loop and it will try to receive the commands.
And this will create the problem if we do not code the server part of the C D command as well.
C is the server will wait for the reply and disable the server and both call both backdoor.
We'll both be waiting for the replies at the same time and that will terminate our connection and it
will bug out.
So we want to change the part of the server code as well so save the river shall see your city URL ex
to exit can we want to nano our server not be why we want to go to the same part right here which is
the true true and we want to add right here elusive and we're basically what we want to are the same
as in the previous code so elusive command first two letters equal C D and the length of the command
is bigger than one.
Basically same as in the reverse shell comment but right here we do not want to perform anything we
just want to continue.
Now why do we want to continue.
But we are the server.
We are not really performing anything on our target.
We just wanted to send a command for the changing over directory to the target and we want to go back
to beginning of our work while the true low point we can send the next command.
So this is the entire part of the server code for DC D.
So just say this can let us compile our reverse shall we use the same commands before I will just go
backwards until I find it.
So here it is we have the same command.
So just run it.
This is something that we did already three times so you should be already familiar with it and all
we want to do is just run and try to change our directory with our code in order to see if it works
properly so see these tests.
We have our reverse shell right here.
Want to open our B drive first of all we want to change the directory to the units we drive.
Not really sure why he doesn't want to change the rectory there OK.
Want to delete the previous reverse shell.
Let this go back to the
2 hour this folder and copy the reverse dot shell to be our USP drive.
So just copy it there and then you can do as usual by deleting all of these previous files that we created
in the compilation.
Right now if we unplug our B drive and we confront the server
and we copy this desktop we double click and try to run it.
Right now we should be able to actually change our directory so let's see if we receive the connection
back on our target or from our server.
We still didn't receive anything.
That is because we need to wait 20 seconds before reprice first time to connect.
So we should be getting the connection back any second.
Here it is.
And right now.
First of all we want to check out two commands one of them is just C D.
Which doesn't.
Which actually allows us if I just type your point I.
You can see it doesn't bug out.
We get DCD and the shell back and the next thing we want to check out is the changing of our directory
so we know that we are in the desktop directory.
Since we are actually running the pile from there and if I type there you can see we are in this directory.
So what happens if we go on directory back.
We want to type your data once again and you can see we managed to go one directory back and actually
go to the users directory so let's go back to the desktop there.
So we are on desktop make directory called test as we can see we successfully made it it's right here.
And if we just change in directory to test and take you there you can see we are currently in the test
directory and there is nothing there since we didn't create any file there so that would be about it
for this tutorial.
We managed to make our reverse shell or backdoor basically to be able to actually change the directory
and not create an error while doing that.
So right now we have almost a fully functioning rebel shell what we want to do is basically also add
the download and upload function so we can actually download and upload files from the target system
and also upload it and also upload them to the target system and that will do in the next videos.
So I hope I see you there and take care.
Bye.