Lower from No.
Welcome back to Part 12 of my Lin ethical hacking course in this poll.
We're going to listen for a connection.
So essentially this is the most important part.
After creating the payload this listening for a connection will allow us to receive a connection when
the user double clicks on this payload.
So say they're on a separate laptop which I've set up I don't have a separate laptop or I've got a separate
virtual machine which is when there's 10.
Imagine this like a laptop.
This is still a standalone computer so the Kelly Linux and the windows machine and my host machine are
all separate they're essentially different laptops or computers.
We are going to be able to listen for a connection.
So when this person for example I'll give some context say you are talking to someone you say I'll go
and download my new game they download this payload.
I mean backdoor you.
They run it then essentially the connection will send a connection to your color machine or send a signal
to your color machine that killing machine will pick up the.
Because we're listening for it.
And then you'll be able to do whatever you wish with their computer.
So in the killing machine we create a backdoor Don't you see I'm going to try and keep this as short
sweet as possible so I'm not going to ramble on lot.
So we've got packed order.
You see we need a local server this server will allow us to upload and download files from the server
will be local to the Kelly Linux machine.
However anybody any computer that is connected to the same my first vote will be able to access this.
It's an Apache server.
It comes pre installed with Kali Linux.
So you need to locate this directory.
Essentially what you can do is if you don't know how to access this here you can just right click on
this one which is inside the comp. So to open the compiler you can do that which will open this and
then you can right click on this and type and click open a new window once you're inside this I'll close
this out so I can choose this new window here and get rid of the because we need that terminal in a
second.
Go inside var which is here.
Then go inside.
W W W then go inside Well if you're not familiar with web development you'll know that what index or
hatred malice is essentially this is just the default Apache home page and every file like you want
to be accessed or be able to access and upload and download.
We'll go inside this.
This is the root directory of the web server.
So all you need to do is copy your back to the Excel or whatever you call it and paste it inside here.
So now we've uploaded it says on the web server and what you can imagine what we're going to do so we're
going to go on the I'll say laptop in quotes which is just this virtual machine and download it.
It's just a method of transferring it.
I've got to say now that this port at this point the cause doesn't or it doesn't go into much detail
with how to deliver it properly in ways of encrypting it and ways of blending it in like attaching it
to j peg files et cetera.
I will talk about all that stuff.
It's just an introduction into it.
So this is not a realistic approach on how to make people download or trick people into downloading
it.
It's a lot of cybersecurity is your own due diligence.
So it's your own thinking and being smart with things just for the purpose of this video.
We're going to create a web server and then go to the separate computer which we're acting as the victim
which is this one and then download it.
It's not a traditional way of actually trying to transfer this payload.
So it got back to the taxi We've uploaded it.
Now we need to start the service.
So we need to start the web server so to do this type of service.
Apache too.
So APAC Haiti to space start click enter that will start the server.
Now when you type local hosts into your browser you will appear on the web server with start the web
server.
So now we need to go to the victim computer.
Now imagine contacts this person you're talking to this person you say can download my new game.
You could have they've could have connected to a fake access point then you could talk to them get to
know them sort of social engineer.
And that is a keyword that is very important for this course.
So go and research shows you social engineering and they agree to download your game.
It looks innocence and because you seem friendly do you think oh yeah I'll go and download it.
You direct them to 1 9 2 1 6 8 don't 1 10 1 2 8.
Now this will be different for you to find this.
It's basically just the IP of your calling machine.
So I I have config and it's the 88 0 I which is this.
It's because it's a local server will run off the IP address of the candy machine so they type part
in click enter and it'll send you to the Apache it's to default page scene it works.
So it lets you know that it's working.
Essentially we are connecting to the Kali machine now or the server on the Kali machine not the actual
Kali machine itself I shouldn't say the
now we uploaded the backdoor axes.
So like I was saying as a little story the game you could have called that game you XY so they type
game dot Jackson download.
But in this case it's backdoor Don't you see.
So I click enter and because it's inside the root directory it's going to ask if you want to download
it click enter and as you can see down here it says what do you want to do with backdoor XY you can
run or say if you want to save it there's no point running it because we haven't actually listened for
the connection to click save and it's finished downloading open folder and there's the backdoor what
are you saying.
So this person might be thinking oh this game looks good.
And then they're gonna actually run this but it's not a good idea.
I promise I do have better delivery methods.
Encryption is just in the future just wait.
I'm trying to get them all out but with life in the way it's quite difficult so bear with me.
But this is just a demonstration.
So how on how to listen for a connection.
So we'll leave or left for the future.
So this business download today we can go back to the Kali machine no one actually start listening for
connection so I'm going to clear this
then what we can do is we can start listening for connection and we have to use MSF consoles you type
M S F console click.
And so this doesn't miss a split.
So let us just roll it'll I'll take a while for it to actually open so give it a few seconds and explain
what this is in a second.
So this is starting them to slowly frame my console ignore failed connect to the database ignore that
doesn't matter we're just waiting for the actual meter split to start means exploit is a community type
thing where people upload the vulnerabilities it's a cyber security computer security meter split so
essentially exploits get uploaded people use payloads there's loads of different things for me to split
I may have to use meta splits to be able to listen to a connection through a payload so we're using
the MSF console you can tell because it says down here MSF.
So what we want to do is when I type use exploit and don't worry in the future if this cause to do go
into more detail with me to spoil it your first ever time seeing a ball just follow along and you'll
start to understand it's so multi and then handler so just copy this down everything will be in the
description I have to follow anyway so you could just copy that from description or type in search use
exploit multi and add handler click enter and now we're using the multi handler this multi handler allows
us to listen for connections essentially what we need to set the payload.
This needs to correspond to the payload that we created.
So remember we I created anyway.
It doesn't have to be this I use rebase TTP s so I need to do set payload in capitals windows let's
say a present and then reverse underscore TTP yes click enter then it sets the payload to the correct
one this corresponds to backdoor to XY which we generated in the previous video I can type show options
now click enter and this will show the options as you can see it's set to l pt. 8 443 we set to support
1881 so we need to change that and we also need to set the L host so we'll set the L hosted fares because
it's blank so set l host and we need to set the L host to the IP address of the column machine so it's
1 9 2 dot 1 6 8 dot 1 10 and then dot 1 2 8.
So this is like a set to finish it just type I have config and it's your 88 0 I net so set up to the
L host and then we need to set the port so set output to eighty eighty one click enter that sets the
L port then all we need to do now is in fact are contextual options I believe again let me just try
that there we go that will just shows the changes that have been made so output is now 80 81 on the
L host is the IP address of our copy machine
so we've got the L hosted the port then all we need to do now is actually listen for a connection so
make sure you still in multi handler and then type exploit
click enter it's gonna run it's going to start the TTP has reverse handler on the same port on the same
IP address as you can see here then it opens the port and now it's listening.
So essentially what we can do is I can't do this in the same window for go to the Windows 10 machine
on a room there's no
now it's saying it's this window is protected Don't worry this is an actual antivirus I haven't showed
you encrypting this and making it undetectable just yet.
However this isn't a antivirus.
This is just Windows Defender it always happens when you download applications with unknown publishers
so this isn't detected by the windows machine so you can just run anyway.
It's asking for the admin privileges so you just click yes on the box appears.
You don't have to run as admin I'm going to.
Then it starts loading and then if we go back to the killing machine as you can see this is session
opened so much separates this session one opened.
So essentially we've got full access to this computer
so if you type CIS info click enter you can see the type of computer that we have connected to.
So this person thinks that they've downloaded your game but they haven't clearly you can't access the
info the system info what type of Windows 10 Machina is what type of language.
I was gonna do this for separate video and go through all of the commands that you can do and different
methods of attacking this computer now and getting as much information from as possible such as passwords
info see what to do and see the webcam.
I'll show you one command and I'll type screenshot.
Click enter
the screenshots and save two routes and then give it a random name so if we go back to our file manager
we can get out of this one now and just go to the route as you can see here there's a screenshot.
We open this we can actually see a screenshot of the desktop.
So like I said imagine if this is a in a Wi-Fi hotspot you can see what they're viewing and just to
prove this if we go back to the Windows machine and then we type Facebook click answer and go on Facebook
dot com and then we go back to the color machine and we ask for another screenshot of their desktop
they'll save it.
Go back to this directorial file manager and there's some new screenshots if you open it you can see
that they're on Facebook now.
This is very basic and it's it's it's in from it's useful information if information gathering anyway
but there's much much much more things you can do with this much more useful things anyway.
It's getting really interesting now so I'm going to start participating tomorrow so subscribe to keep
up with all of the episodes.
And that's essentially it.
We've got access to this computer.
We can cause a lot of damage.
So yeah that's it for the video.
If it did help please leave a light comments if you stick with anything I'll be happy to help subscribe
for future content and I will see you in the next video.