Hello and welcome back in the last lap pratico, we already built the password for the L-l file.
Now we are going to convert this into four hex string and then put it in our Trojan.
So in order to convert this into a formatted screen.
We put it in open air in House Ed Thanks, Ed..
And then you can see it is be executable.
It's called the magic by Ms Z and B Magic by here.
Also the string.
And so this is a complete P executable.
So we are going to explore this as a.
So go too far, export.
So let's see.
And then select the folder that you want to export it to.
Our Dear Inject Trojan, so you can export it as persuasively a Ferdowsi sea safe.
And you can now close this, so now you go and look at your audio injector Trojan folder.
There is a new file of passive sniffer dogs see.
So we open this year, if not that plus plus.
And you should have your your file here, bassist sniffer Ferdowsi, and you can see the he is a very
long file copy formatted, so all we need to do is to copy everything from here right down to the end
of this this file.
The last line copy all of this and then open your the injector trojan.
We've got that plus plus and then.
Basically in here to override this, to override all of this territory, everything and then rename
it to this name, that's it.
So once you've done that, you've already got your password sniffer dial in hex string format inside
your gear injector.
So next thing to do is to compile it so that the now go to this location.
We don't need this anymore.
So if you do?
Yesterday's.
You can also close this.
And now we can go to this location.
Copy here to go to your x64 native to his command from.
Change to correct directory and compile.
By using the composite hit enter.
Now he has finished compiling and building it, you can see a new five year deal injector so we can
now manually test this.
So let us run the program directly.
Yeah, Injector EIC hit enter
and it is running now.
You can see it is a great day and then we can open a debate with you.
Live view, search for DBG View and open.
You can also open process, hacker.
Yes.
We are going to monitor it using Prozac and debug view.
So now we are ready to.
Open our barracks so openly, I agree.
And Sylvia, you will see this output process to inject the IDs one six, two four and injecting done
allocated memory to two, followed by four zeros.
This must be the region of memory in sight.
There are three which has been allocated for the injection, so you can.
You can confirm that by going to this memory address, that means you use process hacker open very screen
and then go through the memory.
Before that, let's go to my news first and see your process any further.
These are the injected.
And I know if you head over to memory and this address two two four five zero, you should be able to
see the.
The string containing the path to the yeah.
Which is over here.
Peter Boyle, right, about two two, followed by four zeros, if you double click on this.
You will see the injected puff over here.
So this is viewed by Highbury to look your e-mail into the process.
So their concern has been loaded.
Now you can see here so successfully home and then unable to drink, that's OK.
So now you can try to mount and see if you can capture the password.
So we go here and select the drive letter, why selective file and you want to mount?
Reducing a key driver, actually, and this is a one click open.
And then he announced.
Check this display passport so that you can see what you're typing.
Sally Sharp, I want to add on to your passport.
That's the SWG.
OK.
OK, and I can see the UAW shows the VW output without of it.
And then if you head over to your seat right there, actually for although you can see new file has
been created.
If you open it, you can see your password has been saved.
That's password.
So it's successful.
So our menu testing is successful.
Now we are going to put it in, say, the startup folder.
So let's clear the screen.
We just found this.
We close a city in Iraq now we are going to put our.
Just close this.
And this again, we are going to put this in sight.
I I for there to make it persistent.
So we open our for the we copy this file and then we are going to put it in the starter for the.
To assess the staff for the we use the.
Constrained environment variable call have data.
Percentage Ed percentage, then you take you to the editor for which is here and then you go to Microsoft.
Go to Windows.
Go to the stock menu, go to programs and go to start up.
Now you going to copy it?
Put your Trojan here in this folder.
Staff order now.
Every time the machinery reboots, this Trojan is going to run and he's going to recite in memory and
looping all the time waiting for that kid to look.
So they are going to reboot this virtual machine and see if he works.
Meanwhile, you also delete the All Blacks that far.
So let's delete this.
Closed.
And I'm going to reboot my Witcher machine.
We start our quality video and come back once it has rebooted.
And he has.
And he has it has a rebuttal, and you can see this console has popped up, meaning that our Trojan
is running.
Tesco to full screen.
So now it is raining, and you can see the title by a shows.
Yeah, injector Trojan.
I see it is running.
So now you open that screen and see what happens.
And you can see process to inject the ID two three zero eight injecting injection down and a Trojan
horse exited.
So the injection is now successful.
Let's try to mount our fire.
Go to your C drive, select the vaccine.
My data.
Adding Mount.
Hate on display, password, select select, I won't do and then keeping your password.
Is he OK?
And you can see he has mounted not us, go to our.
There are three four there, and check out the password file and here is your password file opening.
And you can see your password has been captured here, so it works.
So that's it.
It really works.
So there are a few things you can improve on.
First is you doing one, the Trojan to pop up a black screen when it runs, right?
So there is a first improvement you can make.
And in order to prevent the Trojan from putting out on black screen, you have to change this into a
winning executable.
OK, so to change to win executable.
You need to.
Change this to women.
Women.
So if you want to know how to change the women, all you need to do is search for the signature for
women by going to MSD and Microsoft.