1 00:00:01,470 --> 00:00:09,120 Now let's see how we can create a Trojan using Kali and then we will use it to gain access to our target 2 00:00:09,120 --> 00:00:11,280 PC, which is Windows ten. 3 00:00:11,730 --> 00:00:13,530 So let's see how to do this. 4 00:00:13,950 --> 00:00:16,830 So I have typed some steps for you. 5 00:00:17,370 --> 00:00:19,080 You have to follow these steps. 6 00:00:21,210 --> 00:00:27,720 Now let's run as a toolkit as it stands for Social Engineering Toolkit. 7 00:00:29,850 --> 00:00:34,440 Now select the first option which says Social engineering attacks. 8 00:00:35,130 --> 00:00:39,330 Now we will going to use PowerShell attack. 9 00:00:44,480 --> 00:00:50,000 Now we will use PowerShell alphanumeric shell code injector. 10 00:00:50,810 --> 00:00:57,080 So one might ask for payload listener IP. 11 00:00:57,590 --> 00:01:04,780 So assign IP of our CLI, which is our local host and now the local port. 12 00:01:04,790 --> 00:01:06,920 So OC four, four, three. 13 00:01:08,930 --> 00:01:10,610 Do you want to start listener now? 14 00:01:10,640 --> 00:01:11,510 Yes. 15 00:01:16,900 --> 00:01:27,400 Now, once it complete this process, it will going to create a PowerShell dot text file and its path 16 00:01:27,400 --> 00:01:28,870 sum would be something like this. 17 00:01:33,190 --> 00:01:34,960 So let's wait for it. 18 00:01:38,260 --> 00:01:39,880 So the process is completed. 19 00:01:39,910 --> 00:01:41,620 Now let's copy this. 20 00:01:41,710 --> 00:01:52,870 First of all, let's open a new terminal and now copy and you will see part from here. 21 00:01:53,620 --> 00:01:59,710 See this one slash route slash dot said slash reports, slash PowerShell. 22 00:02:00,790 --> 00:02:02,200 So let's copy this. 23 00:02:02,200 --> 00:02:03,520 So route 24 00:02:05,650 --> 00:02:10,000 reports PowerShell and then. 25 00:02:12,100 --> 00:02:14,250 Done too well. 26 00:02:14,320 --> 00:02:16,750 W w w h html. 27 00:02:18,580 --> 00:02:28,260 And now let's say we rename this to fun dot text dot back then. 28 00:02:31,240 --> 00:02:32,200 See you guys. 29 00:02:32,470 --> 00:02:37,420 By default, we will going to generate a payload of architecture 86. 30 00:02:38,140 --> 00:02:41,050 But you can change it to 64 as well. 31 00:02:41,380 --> 00:02:43,060 64 bit as well. 32 00:02:43,540 --> 00:02:46,460 But for that you have to use an option hyphen. 33 00:02:46,480 --> 00:02:49,450 A a stands for architecture. 34 00:02:52,090 --> 00:02:59,290 But for now, see, it's up to you how you deliver this batch file to your target. 35 00:02:59,320 --> 00:03:01,030 Maybe you use USB. 36 00:03:01,060 --> 00:03:03,580 Maybe you send using email attachment. 37 00:03:03,610 --> 00:03:05,330 Maybe you use a web server. 38 00:03:05,350 --> 00:03:08,320 Or maybe you use a shared folder. 39 00:03:09,640 --> 00:03:12,670 So in my example, I used a shared folder. 40 00:03:12,670 --> 00:03:17,800 But let's not do that and let's use web server for this. 41 00:03:17,950 --> 00:03:29,500 So switch to Windows and now let's access the website that is web server and then the name of the file, 42 00:03:29,500 --> 00:03:30,880 which is fun. 43 00:03:31,210 --> 00:03:42,070 Dot text, dot page, hit enter and it has finished downloading. 44 00:03:42,610 --> 00:03:44,260 Simply click on run. 45 00:03:48,530 --> 00:03:49,790 So it's running. 46 00:03:54,500 --> 00:03:55,040 Then. 47 00:03:57,670 --> 00:03:58,790 There was this one. 48 00:04:01,340 --> 00:04:06,170 And now here we will get our session. 49 00:04:11,970 --> 00:04:14,940 So as you can see, the session has been opened. 50 00:04:14,970 --> 00:04:17,360 It says session one open. 51 00:04:18,450 --> 00:04:22,500 So let's hit enter and let's check it. 52 00:04:23,310 --> 00:04:24,960 Hyphen i0k. 53 00:04:24,990 --> 00:04:25,680 Hyphen I. 54 00:04:25,720 --> 00:04:28,230 One done. 55 00:04:31,080 --> 00:04:40,110 Now let's run, run some commands like help, help command will show all of the commands which are available 56 00:04:40,110 --> 00:04:42,630 to be used on this shell. 57 00:04:43,050 --> 00:04:43,640 Right. 58 00:04:43,770 --> 00:04:50,890 So we can use hash dump for dumps the content of the same database. 59 00:04:50,910 --> 00:04:51,570 Right. 60 00:04:52,860 --> 00:04:58,230 If you remember, we have done previously practical by using BW Dump seven for dumping hashes. 61 00:04:58,230 --> 00:04:58,670 Right. 62 00:04:58,680 --> 00:05:02,100 But you can use hash them command as well from here directly. 63 00:05:03,180 --> 00:05:06,930 And we can also use some of the commands like get system. 64 00:05:07,590 --> 00:05:10,440 We can use webcam record, Mike. 65 00:05:12,160 --> 00:05:12,680 Okay. 66 00:05:12,750 --> 00:05:16,050 We can also use keys can start this one. 67 00:05:17,460 --> 00:05:19,350 It starts capturing keystrokes. 68 00:05:19,590 --> 00:05:21,330 So it works like key logger. 69 00:05:22,050 --> 00:05:28,920 And then we will use key scan dump to see all the keystrokes used on your target PC. 70 00:05:29,730 --> 00:05:31,890 Okay, so let's run shell. 71 00:05:33,660 --> 00:05:44,910 See, it says we are in our target PC, which is Windows ten right now. 72 00:05:44,910 --> 00:05:55,080 We can also use the i r to list all of the available directories on your target PC on the system32 folder. 73 00:05:55,950 --> 00:05:58,800 We can navigate to different directories if we want. 74 00:05:59,730 --> 00:06:00,270 Right. 75 00:06:02,130 --> 00:06:07,350 We can also use this option which says key scan, underscore start. 76 00:06:07,680 --> 00:06:08,160 Right. 77 00:06:08,160 --> 00:06:09,920 And then keys. 78 00:06:09,930 --> 00:06:12,090 Uh, key scan dump. 79 00:06:17,230 --> 00:06:20,140 But as of now we are in a window. 80 00:06:21,820 --> 00:06:25,720 Windows terminal or command prompt. 81 00:06:25,720 --> 00:06:29,020 So let's run IP config. 82 00:06:30,160 --> 00:06:31,270 See it work. 83 00:06:31,360 --> 00:06:35,080 Now, from here you can use all of the Windows Command. 84 00:06:36,040 --> 00:06:43,510 So this is how we can use or we can generate a Trojan using Kali and then use it to gain access to our 85 00:06:43,510 --> 00:06:44,500 target PC.