Hello everybody and welcome back to our final actual attack with our key logger on back door.
So right now what we want to actually do is before we run the attack let us first of all delete the
backdoor from our persistence and also delete the registry key for our persistence.
So if I just type here there at this directory right here so there and you delete the backdoor that
the AKC so we can actually fully run the actual.
Let me just see the night.
It could be because it's open already.
So I didn't quote the reversal previously so let us see.
I have multiple revolver shells opened patient cannot be completed sometimes it causes properly and
sometimes it doesn't close properly but it could be something with my window stand it could also be
something with the reverse shell.
But we saw in the previous video everything works perfectly we can execute commands we can take screenshots
and so on so on.
So we want to delete now the backdoor we check once again there nothing is here so we do not have the
backdoor.
Now let's also delete the registry so go to direct added administrator password.
We want to go to the actual not this part.
We want to go to the
current user then the software we find Microsoft right here we find Windows current version and then
run which is right here we do beat our backdoor delete it.
Are you sure you want to permanently delete this value.
Yes.
And right now before we actually run our backdoor we want to actually make a few changes.
So this actually doesn't look so suspicious.
For example we do not want to change our will.
We do not want to create a persistence with a name called backdoor not the AKC let's call it windows
32 not the AKC for example something that doesn't doesn't get to much of the attention even if it is
seen in a folder.
So we change the location of the backdoor to be windows 32 not the AKC.
But this also means that we have to change a few other things such as or we do not actually have to
change right here since it specifies it as a variable.
But what we do have the changes right here key logger that the external let's call it for example Windows
not the 60 or I don't even know let's call it process manager not the 60 doesn't even matter you can
call it whatever you want just don't call it kill loggers since if someone sees that it will know that
basically they have a kill logging on their system and then they will delete that folder.
So we change these too but you need to know that if we change the process manager right here or basically
the key logger that you see right here we also have to change it in our key logger so nano kilogram
of pie.
And right here we have to change it to be process manager.
So they have to be the same so let's see if anything else right here.
Nothing really.
Here we have on along already our reverse shovel ready.
Now let's run a full compilation command with our image so blind road not mine.
Then drive C Python 27 then scripts by installing the AKC add data and then we specify here route windows
or not despite by the main road python programs reverse.
And then the name of our image we add to the image I have to add the DOT and the comma and then dot.
So let me zoom in in case you don't see it.
But you should already be familiar with all of these commands.
We ran it a thousand times.
And after that we had to specify the regular options.
One file.
No console.
And we want to add the icon which we downloaded in previous videos which is Route downloads drag on
dot IKO and then all we have to do after this is specify the name of the file we want to compile which
is the reverse shall be why and press here enter.
So right now what we need to do is go on our UCB import this
then once we import that we all we have to do is copy the reverse shell into that folder and we will
be good to go.
So let us see how all of this will work we'll try out all of our available options in order to check
out every option if it works correctly at the final project.
So go to this more reverse shell to media route.
Kelly live We cope the shell there.
Everything is copied.
We delete all of the unnecessary files and we run our server so server listens for incoming connection.
We now unplug our view as we drive
we can paste it on our desktop right here.
Woops bunch of programs opened for some reason right here.
It doesn't really have the icon but it doesn't matter.
We can see before we actually run it.
If I just type your deal once again there is no back door to see there is no key logger that the extreme
right here in our in our registry.
Right here we do not have the backdoor registry so let's run this in order to see what actually happens.
We run the program we can see everything works perfectly.
It opens the image so it looks diligent.
It really does open the image that the icon specifies and right now if I in a few seconds we should
be getting the show back and in a few seconds we should all also have the registry right here.
So let's close the image since we do not need it now if I just go right here and there once again you
can see right now if I just go down here we have something.
Windows 32 that the AKC which looks like a normal windows program and it will not get any attention
by the users now by anyone detection knows all of this stuff.
This will actually still be suspicious but that is something we can't change.
So we have deep in those 32 that the AKC has our backdoor with persistence in our AP data roaming folder.
And we also have in the our registry key if we refresh with a five.
We have once again something called backdoor which we need in which we forgot to actually change.
I will show you later on how you can change the name of this as well in the command but the backdoor
actually runs our persistence with these windows 32 that the AKC program.
So right now all we have to actually do since we got the show back is execute commands.
So who am I.
Ah minus sake let's try something else that doesn't really work.
So if you just type EPR minus say personal tracking so we get the error we type your IP config for example
that stat so we can type here.
Basically anything and we will receive all these system functions back.
But right now let's see what our available options.
So we can see help.
We can download pass download the file from Target B C so let's say people there see what we can actually
download.
We can go to some directory in order to download some other filer files so let us see right here.
If we have anything to download if we don't it doesn't really matter.
We already checked it out and it worked.
So let us open this back.
Let's see our other available options.
With help we can upload so upload a file to target b c we can do that right away so let us just create
a simple file.
Now let's try to upload it just to see if it still works so C Python and then reverse nano upload that
key step or let's call it as the U.S. doesn't matter.
Hello.
Save it then we go right here and I would try to upload desktop t we see if we successfully upload the
file we can see test out the axes right here says hello so upload a novel function's work so we delete
it to stop the extensions we do not need it and you can see right now it doesn't exist anymore on target
P.S. let's see what else we can do get you URL so we can download a file from any page so let's see
how we can actually do that let's go for example to our Firefox
then go to some for example get some repository and see if we can download the file to the target B.C.
from the gate repository.
So let's try to download some some actual start new session so that some actual password lists to the
target we see in order to check.
So ten thousand password lists will go to some a directory this should exist somewhere or basically
we can download any passwords we want but let's just try with this.
Scroll down let's see 10000 password listed at GitHub.
So we go to the loops to the raw file right here in order to see the password list themselves so just
keep it raw and specify this path right here.
So copy.
Let's see if this will work.
So all we have to do is actually specify get and then the URLs so get or let's actually see in which
director we are we are a desktop let's make directory just for this file so M.K. dear to me directory
testing download C to testing download we can see right now we are in this directory right here that
we created.
Now let's get and then specify the path.
So we press you enter.
We wait for it to finish it says download the file for unspecified your URL.
If we go to our testing download we can see 10 million possibilities not the extreme which has the 10
million passwords or 10.
I'm not really sure.
Apparently there's 10 million but it doesn't even matter.
This.
We saw that this actually works I'm pretty sure there are ten thousand here not a million but doesn't
really matter.
So our guest function works.
We can download any file from the Internet to target B.C. let us delete the file that's not deleted.
We don't really care so let's take your help.
We can see Star program on target B.C. if we just type your start notepad start calculator apps
start explore.
We can see it starts all of these basically windows right here so we can see start in Explorer started
notepad
start calculator.
Basically we can start files on all programs that target B.C. let us check the screenshot function so
screenshot we just press the screenshot and then would check if we successfully downloaded it in our
directory so just go to places.
Computer
in order to see if we download the screenshot
we go to the root
and just find its python programs so programs reverse.
And here we have our screenshots so we can see we took a screenshot of our we understand b c which is
basically just our clinic's machine since we are running continuous machine of understand.
You can see it is when you stand by these icons down here.
So its creation function also works.
Let us check out what else we have on the next one.
Check function so check user privileges so we can see that we are running as user privileges and not
as administrator then after that if we just type your key logger start on the score start so we can
see before we started right here.
There is no windows not the exterior for our key logger file we just type your key log start with type
your day and once again we now have the loops.
What was it called.
What did I name it.
Oh I went naming process manager at the D.
So it created that folder right here and now whatever we type of no windows 10 machine shell a world
standard as always and we just type your kilo dump on the score dump everywhere well basically 5 seconds
in and parcel it eat only type here.
Kilo or just health which is type here.
Kilo down once again.
So kilo on the school dump we can see Hello World printed out right here so everything works perfectly
all of our code functions work and you can actually continue adding some of the other functions you
might need also in your program or also in your back door.
We will finish it right here so this is our final project.
We tested out every function and it actually works.
So I hope you enjoy this tutorial of coding backdoor and I hope I see you in the next one where we will
actually see how we can code.
Advanced brute force for example for alters no mark for my right for basic authentication.
Now I will show you what basic authentication is and how we can actually code it.
So I hope you enjoyed this video and I hope I see you in the next one.
But.