So my interpreter has some very useful functions for registry interaction.
You can read, write, create and delete remotely any registry entry.
So these can be used for, well, any number of actions, including remote information gathering.
So by using the registry, one can find what files have been used, websites visited, programs, USB
devices used and so on and so forth.
So basically, the Windows Registry is a magical place, and if you're planning on doing more.
And yes, it is my job to help you do more.
So let's plan for it by creating a persistent net cat back door.
So in this example, instead of looking up information on the remote system.
You will be installing a net cat back door.
And it's going to include changes to the system of registry and firewall and send back to you a persistent
shell.
So let me show you the conter.
After gaining an interpreter, Cheryl.
You can use the Regg command to interact with the Windows Remote Registry, and here's a help menu for
this command.
And you can do many, many things with these parameters.
But my point here is to create a persistent back door on the target.
And to accomplish that, I will upload Net Cat, which is a legitimate Doddy file.
So upload user share windows binaries NCDC.
To see.
Windows.
System 32.
And sure enough, uploading the OK.
So now I need to run that cat on behalf of the current user by manipulating the registry to do that
first.
I'm going to enumerate the key.
HK Elim.
Windows current version.
Run.
Now, this guy is special because it defines the applications, it will run automatically when the system
starts.
Key will bring the values and KEH to specify the key name.
And here are the entries of the key.
So now I'm going to add a value to this key so that I can run the Netcare.
So type Regg, set Val K.
The key name and.
The back door.
And then.
D..
See Windows System 32 and see that Yangzi.
LDP.
Four four four four E samed exi.
OK, it's a long line, but it's kind of simple to explain.
So let's break it down.
Said Val, Well said, the value of an entry for the registry key.
V gives a name to the entry.
And finally, the D.
Adds the data to the entry.
Yeah, so banning the entry is OK.
Reg.
Query Val Kay.
The key name.
And the back door.
So query Val will display the data for a specific entry as it is.
OK, now that cat will be run with these parameters and it will start a Windows command line on PT.
four four four four if Métis voidable three restarts.
OK, so let me quickly show you the registry as well.
All right, so here is the value that you just added.
And now I'll quickly restart Miss Boiko three.
When a split starts again.
And see, my session naturally died.
But now I don't need this anymore.
So I'll open a new tab.
Type N.C., they tend tend to tend and PT. four four four four.
Purrfect.
We connect the Windows command line that gets started for us on board four four four four.
So that way you can use any Windows commands here, for example, IP config.
Congratulations, you have your first system back door.
And you can come back any time you need to use it.
And let me tell you, additionally, in a real world situation, you would not be using such a simple
back door like this because, you know, there's no authentication or encryption.
However, the principles of the process remain the same for other changes to the system and other sorts
of programs you might want to execute on startup.
I'm going to tell you about MSM venom in the next section so that you can create later on your custom
data file to use for this process.