Hello everyone and welcome back to Part 14 of my land.
Ethical Hacking course in this part.
We're going to actually spoof the extension of our script on AMC since the previous video we created
this payload and buying to date with an image.
So when you double click on this an image will show up which was the Lamborghini.
However if you notice down here it's a script or XY.
Now if you know computers then an image will not have the extension that XY.
That way you know it's an application and it looks just totally fake and dodgy.
So that's not a good example.
However we can spoof this extension to make it look like dot JPEG peg as you can see this is a real
image and it's got the extension dot dot J P G.
So we're going to spoof stripped out sexy with that extension to make it look like an image file type.
I'm going to go to the Kelly machine.
I'm I've got script are XY here.
Now on Linux will not show the changes that we made so it will not show the icon that we've created.
But as you can see on the Windows 10 machine it shows the icon.
And like I said the icon is not a good example.
Well if you used a image that you know the dimensions or the correct icons full then you can go and
do the if you used a PDA f or a documents then and I'll show you that in a separate video changing the
eye comes to them both for now I've just got this image and we'll just spoof the extension with the
image.
The same principle with the way documents or PDA If so I've got to leave Pat open here and I've typed
a new name for this payload as you can see it's called script but we're going to change it to car image
G P G E XY so it's basically dot J Peck both backwards search DP J instead of J P G so whatever you
name your payload for example lines called Car image then what you want to do before the dot actually
but after the last bit of the name you want to pull the extension that you want to put backwards.
So if you wanted to speak for weight documents and say this was a car documents so called Doc probably
not a good example because dot dot is an extension so car filed just a car a file a document file has
a car in it or something I dunno just make this up but then if he wanted to spoof the Doc you'd have
to do c o d and then it it to be like don't e XY so when you reverse this it will say D O C and that's
for sure for doc which is documents so dependent on PDA.
So for example if this was a car file put it in a PDA form then you'd have to do f DP PD f backwards
as f DP so hopefully you got the idea but we'll get started with this.
So on Linux we need to show all applications and then type characters we open characters and I could
think about this tutorial is that there's no applications required no downloads required so it's all
up to you.
So it's it gives you reassurance that you're not downloading anything and will search for something.
So what you need to search for is right to left override.
It's this one here right to left override.
So when you're searching for it it's a bright and hyphen two and then hyphen left.
Exactly.
I carved on here and it's this one so you on a double click on this and we need the character to Unicode
character to right to left override so if we copy this character we go here and we paste it so paste
and as you can see it swaps them round because it's done a right to left overwrite and because we typed
j peg backwards we now have JP G so you can see the extensions now dot j peg what we've spoofed it's
still an application the same thing for a document cell type car file again I'll put C0 d e XY because
obviously the XY will still be there on the original file but if you use the word document when binding
it and an image then you could do it this way we'll just copy the character again go before the last
before the C An and paste and as you can see now it looks like a doc file it just got a little bit restarted
when copying highlighting so just be careful you just have to highlight it like that and so that is
basically do the same with PD F but I don't need to do all of them so I got rid of that because we're
using J packet and all you need to do now is copy this rename your script are you XY I forgot to mention
a previous video as well.
This script actually does not need to be called script out you actually can be opposite it could be
called anything in the world as long as you've got an extension so I'm just going to highlight all of
this remove it and paste the new one take rename and now we got a completely different file in color
looks it does look a bit stupid it looks away it like it is here and it doesn't look like it's work
because now we've got XY dot don't worry about it we it to do is you need to right click compress click
Create and now we've got caught image JP We've got a zip and so we can rename this click rename.
We can remove the J.
Dot J.
Extension and just have car image dots zip.
Make sure you go a backspace enough so it doesn't do the character.
So you got color image dots.
Click rename it still zip file on it just looks like a normal zip file now so can't image that zip inside
of here.
We have car image e XY dot J Heck now you can't get rid of the e XY so it can be annoying because obviously
if you have the file names just called car you have car e XY dot J packet there's nothing you can do
about it but it can be easily missed by people.
So you just have to live with it.
So now we've got this zip.
We can upload it to our server which is it's already done.
I mean var WW had you and w w w HDL and said hey I've got the zip so let's open it on the windows 10
machine.
Let's go back to this server here and we called a car image.
Don't zip click into that car image zip.
In fact go back to this.
Oh sorry.
Yeah.
The safe is not started to wondered why it was acting a bit strange it just stopped to save us to save
a start and sorry save us Apache to start click enter.
It's just going to start the Apache to service.
There we go.
Quick answer.
Give it a few seconds to actually restart.
There we go.
So it says what do you want to do with car image that zip.
We want to save it.
So just save the zip file.
It's compressed and the security scan will just pass it.
There we go.
Open the folder.
We have a zip.
So if you have one zip installed or window on your system then you can decompress and extract it usually
as it's known us.
So what we can do here we can just extract all will extract it to here so extract it's extracting guests
to have a separate folder.
Now this is with the basic Windows 10 extraction.
But there we go.
Finally transferred the file over.
I'll recommend downloading when zip a window in your system just to do this with ease but we still get
the job done.
And now we have car image EFC dot J.
So if I just drag this inside here and I move this one over.
I'm not much into.
Just leave it there.
So this was our original file.
So we've done three things now to our original payloads we've painted it to an image attached an icon
name we've renamed it and spoof the extension because if you look at that now we've got a preview of
an image on it says Dot JPEG at the end of it.
So people who are not really familiar with computer systems will look at that and think I'm gone it's
just the JPEG file it looks innocent enough.
And then when you click on it.
Obviously I'm not listening for connection so this isn't gonna show up.
But if we just run it we run anyway
it's going to open up to look like an image because the image of the Lamborghini will open up as well
as the payload will execute now it's not going to open here because I'm not listen for a connection.
Well if we could I suppose it could but let's see how long we're on nine minutes here.
I think that'll be it for this video.
And there's no need to actually show you've run this as an admin.
Oh there we go.
Wondered why the image wasn't shown up.
I thought something was wrong with it but we got the image.
I apologize for this winter storm machine being really slow.
I need to add another call to me.
Let's go back to the culling machine a second so I think that should be and that with just 10 machines
having a panic attack it's too hot to do.
There we go come back to life breathe.
It's a it's only a virtual machine so that's why it's a bit slow.
But as you can see the image did open up then let's try one more time.
I apologize a bit.
I've also been really slow.
Let's run this as admin this time to see if we actually get the image.
David go to opened up a bit quicker.
It is quite a large image to render.
There we go.
We got the image opened anyway and it looks like an image now because it's got the JPEG extension.
So that was a for the video if it did help please give light comments if you stick with anything.
I'll be happy to help subscribe for future content and I will see you in the next video.