Hello and welcome to a new section in this section, we are going to learn how to create Trojans by
embedding sharks in site B, executable files, B, excludable files.
Windows programs.
What are Trojans, a Trojan is a fake program that pretends to be something it is not.
Inside.
There is some hidden court that does something else.
For example, listening bot or connecting to a server, or alternatively, the reverse connection you
share.
Capturing keystrokes, a key logger, stealing usernames and passwords, spying on screen.
The additional malicious tools spreading to other machines.
Escalating privileges to become gaming user and gift files, as are in some way, and even become a
remote, he says.
Tool techniques to create trillions in malicious code site court case.
These are the taxation of the executable file.
Second, these by creating new sections to put malicious code and waste by extending existing sections
to put malicious code.
Yeah, I was going to look ahead the practical on how to create trillions.
The court case.
So the objective of the next project and we are going to do is to progenies correct me to run Microsoft
pin.
So this is a crime scene and I written.
And many ranny case opens a graphical user interface.
Can you go into the theater key then you can check to see.
That is correct.
So I'm going to show you how to and that Chalco inside this cracked me one so that when you run it,
it also runs and then a program called Microsoft Paint, which is available in Windows computers.
The next thing we need to look at is how to choose a suitable EIC to treat you nice.
And this is in respect to the court case method for court case, you need taxation.
So that is bigger than your sherkat, the rosacea, which is size different.
So that's something you should be careful.
You should be more concerned.
And the Ross ice Ross ice is far ice.
What you're saying is memory size.
When a fire is run, a failure refers to the program.
The European system would not be to what your memory and most memory space for optimization purposes.
So that would be a your memory size.
So you need to check the raw size.
You can use Beeban and excited to see how chocolate would be slightly smaller than 200 bytes.
So we need about 300 bytes of cookie so called Kathie's to part of the taxation of a P file that has
no instructions in it.
They're denoted by zero base numbers.
If you cannot find enough cookie, then you cannot use D cookie method.
You need to use T admitted.
So it is how you can check for cookie sizes.
You use eBay to open your crimi.
The target program you wanted to reunite and look at the session hit us.
So here you can see to the time that we want to insert our Chako resti taxation.
So taxation contains the instructions and this action is readable and executable by default.
That's why we put our Chako in this session.
So over here, you can see that the row address starts at 400 offset and runs all the way to be a hundred
bandra.
Easy to read only the transaction.
So if you want to know whether there is cookie, if you go to hex editor and open your Kimie edit,
scroll down to the radiator session.
In this case, the offset is via hundred over here and then just be above it will be your quote key
for your tax section.
So the region just above it will be the next section.
And you can see the code key is all null base, all zero.
So this is where you can inject your Chako in here.
So if you want to know whether this number or by seeing concave is enough for your shellcode, you need
to perform some calculation.
So here go down to the last byte here.
This last by here is B seven F F.
So you take these seven F F minus to start off with give.
This is B six eight zero the first by here.
So after my meeting, you find it, you have hex one seven F, which is 383 by decimal.
So it's already three bases more than enough for our shortcut because how Chakotay stressed into our
base.
Now, you have to bear in mind that Sherkat alone is not enough to execute.
You need to also put additional instructions in before and after initial court.
That is why you need extra base in addition to the shell.
So this is the anatomy of the execution floor.
Take, for example, on the left here, normal P executable file.
He has got an entry point and then followed by all the regular code.
And then below is a key feature C from the Hex editor here.
A quick if.
Now the cookie consists of zero base, no vice.
So what we do is we will put a jump at the top of the entry point here, a jump instruction, and cause
it to jump to our case.
The first address, the court gave you the address to jump to.
Now, because we are we are inserting Jume instructions inside the entry point.
We will be overwriting some instructions.
So those instructions, if you overwrite if you have to replace it back over here, is equally key.
So remember to take note of those instructions which you overwrite.
And then when the execution of these be fast start, you should we jump to the record key.
And the first thing it does is safety registers in a place.
The reason why you need to do this is because later on you are going to come back to the entry point
to continue running your original fire.
So that's why you need.
Save the original state of the registers and the Fleck's.
So after a severe recession inflects by pushing them to the stack, then you put your shellcode.
So you were running.
And after Chako complete stronie, in our case, I was shocked is going to run Microsoft being program.
So the Microsoft Pentagrams should open because of the Shaqra.
And then you go on to the next instructions, which is to restore flags and then the registers.
So the restart of pressingly registers, you just pop the values from the stack back to the registers.
So the order of pupping would be reversed from the order pushing here.
You push the registers first and then you push the flags.
Here you rest, you pop the flags first, and then you pop the register.
So once you're restored the registers back to his original state, then you are ready to run your code,
which you have overwritten here.
So Paravel could get overwritten here by the Gemmy thrashing.
You have to replace it here so that now you will go and run those code which has been overwritten by
a jam.
So when he has finished executing those instructions, you're supposed to jump back to the entry point
just after the jump to Recook Give.
So then you will continue from here, run like the regular code that your regular program there is supposed
to run.
In our case, it is a new one.
Now is something else you need to take our.
You, after you have injected all of this instruction in, say, a care, you also need to make sure
that your shell does not cost a whole program to exit the shackley by.
So it's called the exit instruction.
So you need to take care of that here to find where is the exit instruction.
You're doing one, the shortcut to exit.
So the whole program does not sit with it.
So in order to we had to find the address and then the address of the instruction and come back to continue
here.
So they said, lastI, you need to take care.
Now, this is the step by step instructions for creating a cookie, Georgian forces.
You need to use Metasploit in Kali Linux to Jan Schakowsky.
So in our project for Trojan's, we are going to create that.
It would be Trojans.
That means Drogin, ESAF.
He said that it would be a program.
We are going to use Metasploit, as he did before.
By this time to January 30 to be Sherkat and Ashoka, we are going to use it to launch Microsoft, Bing,
EMC and this Microsoft Bing is far in C Windows system three to four years and is presenting all Windows
operating system.
Next, we are going to test a Chako using our Schuckert runner, which we have used before.
And then we need to use Xty digitally duby version to identify address Ildiko key.
Then we need to copy the first few lines on the entry point because we are going to overwrite if a jump.
Then he said, I would jump to the quick if it is at the start of the entry point.
We need to use fear not so that we know how much of the instructions we have written.
So now we notice how many instructions were written.
You will need to insert them in the cookie.
Then you need to see instructions to safety registers using push aid.
And instead of flexing push F.D. for a rainy day, you will put Sherkat.
Then after that Sherkat, you put your wrist either flex using top heavy and restore the registers using
Prop 80, then, you know, insert the instructions usif overeaten in the entry point using a jump instructions.
So now you have to put it back in the cookie.
Next, you insert a jam instruction to jam back to the beginning of the entry point just after the jump
to the cookie.
Next step is to batch and see this far.
Then you need to test and debug to see where the shackle coarsest a program to exit.
Then you need to assemble the jam to bypass the exit and instead continue on with the rest of the cookie.
Finally, you push and save to a final offer at this point.
Your project is complete.
So that is all for the theoretical aspect of creating Georgian's.
I'll see you in the next video.