Welcome to Hacking Windows, Tim Command and control phase.
Before we get into commanding, controlling or taking over control of Windows 10 machine through the
malware that we created in the previous section, let's do a quick recap of that attack phase, because
that's what we're going to need to do every time we want to create a new virus from a new IP address.
So what we did in the last section was we created an executable file using MSF venom to create a reverse
TCAP Materne critter virus.
So we created what we call a remote access Trojan, a piece of malware that when the person runs it
on their machine because we named it something like some cool name a fortnight, all skins or important
PDAF Daddy XY.
As soon as they run that file on their P.C., they're going to do a reverse TCAP or a call back to my
Kelly Linux box and my Kelly Linux box will be able to take control of a Materne critter, a Metis Boit
interpreter, remote shell that will give me full access to that Windows computer.
So we did that with these four commands.
Go back to the previous section if you need to create this Trojan.
Then on our Kelly Linux box, we needed to listen for the exploit to call back.
So our Windows Mateparae to reverse TCAP needs a handler, a listener running on this Caleigh Linux
box to listen for incoming connections.
And we can use just three or four commands to make that possible.
The use exploit multi handler set the payload and then set the local host to your Caleigh IP address.
You just have to tell it what IP address to listen for and then run the exploit with the command exploit
dash jazy.
So we're going to check in here.
I have let it sit between lessons for just a few minutes.
So my interpreter session closed.
That means my Windows computer is no longer communicating.
And in fact, you can see in my downloads folder.
Windows Defender started back up.
So I'd need to reinfect this machine, but I'm going to run those four steps just so that you can see
them one more time.
So if I press enter and I'll use control l to clear the screen, you can see that I'm already using
the exploit multi handler.
So if I just fuse my up arrow, you can see these four important commands use exploit multi handler
anytime.
This is a great thing to point out.
Anytime we want to reuse this same remote access Trojan.
So I created it in the last section and I'm going to use it right now.
But I'm still might lose a connection with that Windows box every now and then, or I might send it
to a new host machine on the network that I'm doing penetration testing for.
And so I need to run this part.
The the virus itself can stay the same as long as your IP address stays the same on Kalli.
But you need to run these four commands inside Materne Critter inside our midst boy framework.
In fact, let's go ahead and show how we would reconnect if you're coming back to this fresh or if you're
infecting a new machine on your network.
First we run the Metis Play Framework console.
So that's M.
S F console.
Or you can come up to your Kalli box here, come down to exploitation tools and find the midpoint framework.
MSF console takes just a moment to get up and running.
Once Miss Boyd opens up, we just need to say use, exploit, slash, multi slash handler.
And we can put back to our screen here.
There we go.
We can say use, exploit, multi handler.
We need to set the payload to match that maternal or reverse TCAP Trojan that we have on our other machine.
I'll control L.
So we did the use exploit multi handler.
It remembers our last few commands from the last time we logged in.
So that's a really nice thing to be able to just scroll back through those, set the payload to windows,
slash mature operator slash reverse TCAP.
And then we need to set the L host the local host parameter so I can double check with IPA that my address
is still tendo dot nine dot seven on this Caleigh box.
You need to make sure you set your local host to the correct one.
And the last command that we need is just exploit.
So you can run, exploit, dash J, dash Z, exploit X.
Those are options to background multiple sessions.
If we want to we can just say exploit and we are listening.
At that point actively for connections from windows.
So over here on our Windows box, we probably want to do two quick things will turn off that virus protection.
I'm sure it started back up.
Virus and threat protection settings, we can open that every now and then it will automatically start
back up.
Go to our Manege settings.
We'll make sure that Real-Time protection is turned off.
And we might want to add an exclusion.
And I've added our documents folder.
So this time when I get into that Windows machine, I'm actually going to upload another copy of this
virus to that documents folder.
And Windows shouldn't close it out.
And I'm going to double check here that my Windows firewall is off.
This command net S.H. Advance firewall set.
All profiles stayed off.
Now, there are ways that we can get around antivirus using a veil of Asian or some of the other tools
to encode our exploit.
And there are ways that you can mess with the Windows firewall or get packets out using a commonly open
port like secure shell.
So it makes it look like you're just surfing for a Web page.
But what we're doing right now is just to make it a little easier for this first command and control
experience.
With those few things in place, I should be able to download my fortnight all skins one more time.
Save it.
Open the folder.
And then double click to run that executable.
And it says, hey, this may be an unrecognized app, but if you click more info, you can run anyway.
And you can see we have started a Turtur session.
And if I say help, interpreter will give me dozens of commands that I can run on this Windows host
that is infected.
When we come back in the next section, we're going to add the next lesson.
We're going to see how to take command and control.
We'll be able to do everything from upload and download files, look for Web cameras, webcams attached
to the computer.
We'll be able to sniff keystrokes.
Just about everything that you've ever feared or seen in a movie.
We'll show you that most of it is real.
You're going to see why you never want to download and run a file from a suspicious source.
We'll see you in the next lesson.