[Codger69]

So I have network file access to a Win7 machine so I can browse files etc over the network. I can access areas such as c:\users\username\appdata and so on.

I've copied over ncat.exe to set up a reverse shell and I want this to run, with the relevant IP address and port when a user logs in or boots up.

I tried creating a bat file and adding a shortcut to the startup folder pointing to a bat file in a folder containing netcat.exe, with the correct netcat command. This works however I get two problems:

1. The user gets a warning asking if the want to run this file when they logon
2. The command prompt it spawns is visible, along with the netcat "connected" text, which not much good.

Am I going about this the right way? Can I supress the warning, hide the cmd prompt?

Thanks

[HangMansheart]

I think what you may want to do is try adding ncat to the startup programs through registry editor. I made an Arduino payload for ncat and reverse shell where it also adds ncat to the startup programs (renames it and hides it), making it start silently every time the user starts the computer. I'll try to dig up my code and see what I can give. Hope this goes well.

[MesutÖzil]

U can use eternalblue to exploit win7

[Zixem]

you can infect one of the files that are running on startup(PE file infection)
or just write a back-connect file yourself w/ stealth function, if you familiar with WinAPI it's easy - just open a new process with CreateProcess() and use a CREATE_NO_WINDOW flag.

[Codger69]

I think what you may want to do is try adding ncat to the startup programs through registry editor. I made an Arduino payload for ncat and reverse shell where it also adds ncat to the startup programs (renames it and hides it), making it start silently every time the user starts the computer. I'll try to dig up my code and see what I can give. Hope this goes well.

I'd defo be interested in seeing your Arduino payload. However not sure how that's going to help in this case since I don't have control of the computer. I only have network access to shares which, in this case, is C:\users

So i don't know how I would edit the registry.

---

I did it by using Window's own iexpress.exe - used it to create an exe file which runs netcat with arguments. I created a shortcut the startup folder pointing to the exe which I hid in a subfolder somewhere else. What I didn't account for is that when you create the shortcut you have to create the same file structure (c:\users\username\appdata etc. on your own machine as you're using your computer's File Explorer which checks the path against your own machine's file structure.

But it works nicely and now I have a reverse shell which fires up with the user logon.

---

* you can infect one of the files that are running on startup(PE file infection)
* or just write a backdoor connect yourself w/ stealth function, if you familiar with WinAPI it's easy - just open a new process with CreateProcess() and use a CREATE_NO_WINDOW flag.

Those are two things I need to learn more about. Thanks for the pointers.