Hello everyone and welcome back to Part 13 of my land.
Ethical Hacking course in this part we're going to look at binding an image to our payload our payload
here.
We created using a reverse TTP as it's called backdoor XY.
So if you come from the previous video then you should be up to date with everything.
We've got our server which is right here and we've uploaded it to our server.
What we're going to do is we're going to use a script which is this right here and I'll explain this
in a second and bind it to an image.
So I've gone to Google and just got a random image.
This image could be absolutely anything.
I've got this car right here.
You could also use a different file type so it doesn't have to be an image could be a PSG which is still
the image but it could be a Word document it could be a PDA.
So there's many different types of files you could potentially use here.
I'm just going to use an image for this demonstration.
There's two things you also need.
You need this script I just showed you before and you need an image icon sorry an ICAO.
So if you look up here which I just highlighted we got an image search API because I've saved this image
and I've also got an image that Iko.
I've used an online converter service just go to Google and can type image to ICAO click enter and use
this first one you just click on this Web site all the links for everything will be done description
then you can just browse and select the image and then once you've done that you can set pixels if you
know the size you want and then just click convert file and save it.
It will prompt you and just save it to stop.
So once you're about an image and an icon and the reason for the icon is because typically on machines
or operating systems when you have an image file you also get a preview of that image.
So if you look at this image file here it's image dot JPEG but this a preview just above it because
our payload is you know an application format it's a dot e actually which is an executable.
They only have icons executable with our icons for example.
Think of an installation.
So for winds up if you have ever heard of Windsor up or wind rather than them our applications will
have icons similar to the calculator on XY et cetera.
I think you get the point.
So think of the browser icon we want to mimic something like that.
So if we want to attach this image to our back door we need our back door to have an icon of the image
because then it looks like it's a preview of the image when in fact we've attached an icon to the back
door.
You've got to get your head around the ball essentially all we have is are back to the XY.
We set an icon to it.
So we change its icon to the image and then in the next part we'll spoof the extension the reason we
at the icon is because it looks like or it looks more realistic and it looks more like an image file
because we're getting a preview of the image when in fact it's just an icon they're not actually getting
a preview of the actual image.
So once you've got the image icon and the image dot JPEG we can start to bind these together.
This script here is used to compile and bind the image dot J pack to the back door.
So this will be in the description like everything else.
There's only two things we need to change on this.
So when you go to Google typically when you click on an image you can right click and copy the link
location the link location is the image you are all of the image that saved on the host website server.
So in this case this image is hosted on Lamborghini dot com.
So if we right click again and just copy the image location will open a new tab and paste it we can
see that it's a direct link to the image.
And this is where the image is stored on the Lamborghini Web sites database or directory
so you can either just copy this which I'll do straight into this script.
So where is this image in said local your files.
We can remove image and make sure there's still a comma and then paste.
So if we just make this a little bit bigger let's just extend this out she'd say we've got a direct
link to the image demagogue comment and backdoor.
I'll explain what backdoor is in the second.
There's other ways of getting this direct link to the image you could upload it to a Web site like this.
Files dot AFM.
So if you just get the image that JPEG that's on your desktop.
If you have saved it and you can just upload it.
So if we drag and drop this in and click staff file upload it start.
Then we can view it at this are here says access the files so there's the file which is right here to
get a direct link to it.
You just go over download download this file right click and copy link location.
So if we copy the link location and paste and go then we get a direct link so as you can see it went
to down but because this is an image.
It's not going to actually start to download it.
So if we go back to this right click what we'll do is we'll open it in a new tab then we got the actual
download image.
So depending on which way you do it sometimes it will prompt you sometimes it won't just make sure you
get the one with the prompt.
So in this case the direct download link for the image is this now.
So there's two ways of doing it.
I've just showed you both so you can decide I think just right clicking on the Google image one is better
it's just more convenient.
So we've got that next is backdoor so we need to direct blame the script to our payload or payload needs
to be accessible online.
So you could either do it the same method as we just done with the image and our backdoor access so
you could upload it to files to them.
I think it was cold.
Yeah.
Faster than the drag and drop back door into and get a direct link for that.
So I'll just quickly show you go back on here.
Go back to the start and will drag and drop back dota XY into a them all star file upload completed
and then we'll go to this Web site we'll go to the link you gave us and as you can see backdoor exit
is uploaded.
You can go to download right click on downloads file open Lincoln new tab and it'll prompt us.
So this is a direct link.
You could then close this copy Diamond direct download link for this payload and paste it inside here.
Or because we have uploaded it to our Apache server which is in w w w hated him Al file or folder.
We can just use that.
So if you type your IP address at the copy machine which is 10
I think it was or was it 1 9 2.
I think it is 1 9 2 1 6 8.
There we go 1 9 2 1 6 8 0 1 10 dot 1 2 8.
Click enter.
Then we get the Apache to the Libyan Defoe page.
So if you remember from the previous video we created this server to upload our payload and then download
it on the windows machine.
Since this is uploaded now on its live online and accessible we can just get the direct download link
for this by type in sports us back door to see if we click and so it gives us the prompt to download.
So that's exactly the same as what just done so I'm going to copy this and paste it where this says
backdoor thoughts achieved both method methods for each thing so it's more in detail I'll just paste
this.
There we go.
So I got the script.
Nothing else needs to be changed by ending this image which is this one here with our payload.
The payload is created with reverse AHCCCS and it's on port 80 81.
So we can go files save us.
You need to save this file as script dot a you three she changed a text t t to a 3 click save.
Make sure it's on the desktop.
So there we go.
Next we need to actually open an application that will allow us to convert this script which is an EU
3 script into a separate application so to view this it's pre installed with Kali Linux.
So you need to do a show all applications and type compile.
Then it's this one here with the logo that looks like an a click on this one and it will open an application
and close out of the script now and close out of that.
You don't need any of this.
No close out of the hole browser in fact don't need that and you should see an application like this.
So this application will convert this script into a separate dot XY application so we'll no longer use
backdoor that you see so what we'll do is we'll click browse and will browse for this script.
As you can see the destination is on the desktop as well.
But we're going to have a new application called script out.
Actually this is for the image icon.
So you could browse here.
Sometimes this might start in a different location but all you have to do is click up here go to the
dropdown list and find your desktop.
So be route desktop and its image to icon for me because we converted this image into an icon files.
So click on that and everything is set.
So we've got this is the image of the applications icon in this case.
It's the icon of script out actually.
So you need to do is click convert.
That's going to convert a conversion complete we can close out of that and now we have our new payload.
So we will no longer use back to XY.
We'll use script that's upload this to the server go to the windows machine so we'll open the browser
and we'll go to our servers IP address which is the IP address of the killing machine.
Remember this Windows machine even though it's running on the same system or host machine it's a completely
different system.
Picture is a separate laptop.
So we go back to this Debian Apache server and we'll download the script.
So we called it script out XY.
We're no longer using backdoor so we need script script or EFC.
And although no changes it looks like no changes have happened on the killing machine.
Excuse me.
You'll see some now.
So if you try and download this we'll save it because we don't know Ronnie the reason for that is we're
not listening for a connection.
So we'll just save it's going to run the security scan that's going to finish.
Now if your security scan does fail then just disable Windows Defender.
I'm going to show you how to bypass most energy security and the windows defender later on in the course
because there's much more or there's a few more steps that you need to take.
But I will go through everything as much as possible in detail.
So we've downloaded a script.
It's come up as one because I've already got an application script out XY but we can open the folder
and it's this one here.
You can say I've already got one called scripts I'll just get rid of the average just testing the icon
because it was coming up a little bit strange but we'll just leave it because if you can get rid of
this why am I looking at delete spend too much time on a copy machine.
I don't know where anything is on windows anymore.
Well as you can see here I'm going to rename this because I hate that one it's quite OCD so I'm going
to read it.
There we go.
Yes the icon looks a little bit stupid.
The data.
It's so pixilated and it doesn't fit the actual window but it passes and although it looks stupid you
get the idea.
This application that EMC has got an icon image or a preview of the actual image even though it's just
an icon.
If you look at this image here which is an actual JPEG image you can see the preview of the image of
me click on there.
We got the actual image reopening and photos.
This is the image even a black that's not a good example.
It should load any second though Please load.
There we go.
So you sort of get the idea for specific icons.
I would recommend going on and Google and just search and icons.
Yoga perfect icons that fit the dimensions.
I just one converting the image to an icon.
I didn't set any pixels you can set the width and height.
But obviously the image was not created for the papers of being an icon so that's why it looks a bit
stupid.
Anyway it works.
You get the idea.
So now it looks like an image that's being displayed although it says Dot you actually at the end.
We're going to spoof the bench expansion extension in the next part to make it even easier to make even
more realistic.
But we've got a script out XY so we'll go back to the Kelly machine will almost complete it here.
So we'll open up Terminator
and we need to listen for a connection so MSF console click ends a if you can't remember this part then
you'll have to go back to listening for a connection.
I'm just gonna go through it really quick though.
You make a error appear right now.
There we go.
That is cannot a could not connect or failed to connect to the database.
Just ignore that.
It's fine.
It still starts a meter split from the console anyway.
It just take a few seconds to actually start off.
So just be patient with it.
I'll zoom in so you can actually see the text.
There we go.
It started to split.
So what we need to do is we need to use the exploit multi handlers to exploit.
Use exponent multi and the handler.
So we're using the multi handler module we'll show options because we need to actually change the some
of these settings so what we'll do is we'll set the payload.
The reason for this is because we need to match everything up to our specific payload that we created
with Vale.
So we'll type Seth's payload windows.
I would say I prefer can't spell so it's M E P M E T E R P R E tr.
There we go.
And we used to reverse each G.P.S..
So it's reverse on the score page G.P.S. click Enzo.
So we set the payload there minutes to set the Al host to our Kelly Linux machine that also corresponds
to the payloads our host.
So that's 1 9 2 dot 1 1 6 8 don't want 10 I believe dot 1 2 8.
I always forget this.
Let's go back to the windows machine still I have an update we go so 1 9 2 don't want 6 I don't want
and don't want to.
Let's check on 6 8.
No one 160 changed up to 1 6 8.
There we go.
So we'll set the Allah host and then we need to set the output so our ports 80 to 1.
Because that's the ports.
That is the port that the payload is you're using sort of set the reverse which says everything now
we need you just type exploit and click enter so it started to reverse its GDP asked handler on this
then if we go to the Windows 10 machine and we'll run this as Armin
it's protected.
This isn't an unsafe virus one ball.
You just need to click more info on click on it anyway and then it's gonna ask for admin privileges.
Just click yes and it's gonna run the payload.
The payload is gonna run but if you noticed something else happened an image opened.
So this is why it's quite dangerous because it looks and acts as a real image.
I say looks the the icon was a complete fail but you get the idea.
But they will go and images actually open so it looks like an innocent image file.
Go back to the copy machine we've actually got a tape of the session.
So if we type CIS info we can take a screenshot so you just type of screenshot of the desktop.
Now imagine this.
This person is connected to your Wi-Fi.
They could be in a local public Wi-Fi spot.
And you just took a screenshot of the desktop.
So if we go into the let's go places home we'll see where the screenshot is saved.
So it's in route and it's this one here.
So if we run this open I should say then we see a screenshot of their desktop which is the image that
they opened that has been it to a payload.
So in the next video to show you how to spoof the extension of the payload because if you remember it's
just called script or XY.
But what we'll do is we'll spoof it.
So it says script JPEG.
So that's it for the video we did help please leave.
I can't even speak today if it did help please leave a like comments if you stuck with anything.
I'll be happy to help subscribe for future content and I will see you in the next video.