Instructor: Welcome back.
Time to write the code that will execute our commands
inside of our payload.
So as I already mentioned
for this we're going to need an additional library.
So go to your backdoor program and import subprocess.
This library will allow us to execute any command
that the server sends.
Let's go down here,
where we added the comment for the command execution.
We can delete it right now,
and to execute the command we can do something like this.
We can initiate execute
and we are going to equal that to the sub process.Popen
and this stands for process Open.
This process open takes a few parameters
and the first one will be what we want to execute.
In our case, we want to execute our command.
The second parameter we can select to be shell equals true
and there are some additional parameters
such as stdout equals subprocess.pipe.
And make sure that you type this pipe
in the capital letters.
Another parameter stderr equals subprocess.PIPE
and the last one will be stdin equals subprocess.pipe.
These are all the parameters
that we need to specify right here.
The most important one is
that you specify this command as a first argument.
Once we initiate the process open onto the execute
we can create a variable called result
that will be equal to executestdout.read.
So we want to read the output.
We're also going to con at to this the execute stderr.read.
So these are the two things
that will give us an output of the command.
Then we will store them inside of the result variable.
And this line that I'm going to write right now
could be a little bit tricky.
Let me write it first.
Result.decode.
You might be wondering why are we decoding this?
Well, if I go up here in the reliable send
we are going to encode our data
and this result is something that we're going to send
in the next line.
And once we perform these two lines
we already get an encoded data.
So if we don't decode it first
and we try to send it straight away,
it'll throw us an error.
It'll not be able to do that
because it is going to try to encode an encoded data.
That's why first we must decode it right here,
and then in the next line we're going to type reliable_send
and we are going to send our result.
Great, now that we did this let us test our program.
And to test this program,
you're going to need a Windows environment to compile it
and you are going to need any version of Python 3.
Now in my case, I'm using Python 3.7
so I would advise you to use the same version.
So just download the Python 3.7 because if it works for me
it'll most likely work for you.
After you do that,
what we must do is we must copy our back door
to our Windows 10 machine.
Why? Well we're going to compile it on a Windows machine
For this you can use a Windows virtual machine
if you'd like, just make sure you download Python 3.7
onto that Windows virtual machine.
Once you do that, you can copy the back door
I am first going to copy to my Kali Linux desktop.
So home Mr. Hacker and the desktop.
And from the desktop I'm going to copy it
onto the Windows 10 desktop.
Great.
Now that we copied it, we're going to need a few things
in order to compile this program.
So first of all,
open your command prompt on your Windows machine
navigate to the directory where your backdoor is
and to compile this program,
we are going to need a PyInstaller library.
You can install that library using PIP as usual.
Once you get the Pyinstall library
you want to go to the directory where your back door is
and type pyinstaller.
Then the name of the program in my case backdoor.py
and we're going to use two different arguments.
One of them is onefile and the other one is noconsole.
Once specify all of this, press enter
and this will compile our Python program for us.
Now one thing to keep in mind is
that you must have all the libraries
from this program installed using PIP
in order for the compiling of the program to be successful.
So in this case, our back door right here
if I edit it using Notepad
we only have these three libraries
and all of them are already by defaulting Python.
So there is no libraries that we must install yet.
But in future, if you keep adding onto this program
and you add additional libraries
that might not be by default installed in Python
you will need to install them first using PIP
and then you can compile the program successfully.
Okay, great.
Now that we compiled the program
we're going to have these four folders.
We're going to have the dist folder, this pycache folder
this backdoor.spec file and the build folder
these three right here, you can delete straight away.
We don't need them.
And this, dist folder will have our executable.
Here it is.
It is called Backdoor.exe.
And you know what is the cool part?
If I scan it using the latest version of Windows Defender
here it is.
Zero threats found.
So we created an undetectable back door that we coded.
Amazing, right?
Now to test it to see whether it works.
First thing that we must make sure is
that the IP addresses and the ports are set correctly
and that is something that we should have done
before actually compiling the program.
But in my case, I remember
that I said the 192.168.1.12
to be the IP address of Kali Linux machine
and the port 5555 to be the port to connect to,
which is in my case, correct.
So what I'm going to do,
is I'm going to use Python 3 to start my server.
It'll print out listening for the incoming connections
and if I go right here, execute the backdoor.exe
nothing seems to be happening, but that is good.
We don't want our program to open anything
but if we go back to here and we wait a couple of seconds
because remember that we set time.sleep command
to be 20 seconds before actually connecting
to our Kali Linux machine, and after 20 seconds here it is
we get the shell from our Windows 10 machine.
we get Shell written, and then the IP address
as well as the port
from which the connection is coming from.
Now if we try to execute some of the command prompt commands
such as for example, whoamI It seems to be stuck.
so there is something wrong with our code.
Let us go and check our server first
to see whether everything is good.
So we got our reliable send and reliable receive functions.
Everything seems to be good,
but right here we reliable receive the result
and then we print it out.
So this could be the problem.
Let's check it out inside of our backdoor code as well
just to make sure that everything is good here.
And after a few minutes of searching
I managed to find the error.
So the error was inside of the backdoor code.
The first thing that I didn't do is
I didn't import this json library
inside of my backdoor code.
I only copied these two functions from the server code
but I forgot to import the json Library.
So that is the first thing that we must do.
I already did it right here.
And the second thing is the typo right here in this line
we typed rstip and it should be rstrip.
We need to fix that both here and inside of the server code.
So go down here and change the rstip into r and then strip.
Save right here as well.
And we are going to copy the backdoor.py
to the home mrhacker and then desktop.
So we're going to recompile it once again.
All of these things we do not need anymore
so I'm to delete them.
If it tells you right this
that the file is currently in use, that is because we run it
and to close it, we can go to task manager
find the backdoor.exe that is running
and close it inside of our task manager.
Then we should be able to delete the dist folder.
Great.
Now that we did that, what I'm going to do is
I'm going to once again copy the backdoor.py onto my desktop
and I'm going to compile it once again
using the command prompt.
So pyinstaller backdoor.py--onefile--noconsole.
Press enter.
While this compiling, let us go to our Kali Linux machine
and let us start our server, python 3 server.py.
It will listen for the incoming connections
and right here we can go
to the dist directory and execute backdoor.exe.
Once again, these other files we do not need.
So you can delete them.
Only leave this directory with the backdoor.exe.
And in just a few seconds,
we should receive the connection
right here in our Kali Linux machine
due to the timeout of 20 seconds
that we coded inside of our program.
And if I type, whoamI right now it works.
I can execute commands on the target machine.
If I type DIR, it will tell me
that the only file in the directory is backdoor.exe.
And that is because we are currently inside
of this dist directory.
If I type IP config, it'll tell me my IP address.
I can type the netstat command to get the netstat output
for it'll tell me all of my current connections
on that target machine.
But if I, for example, tried to go one step back
this will not work.
I will still be in the dist directory.
So it seems that our program works
we can execute the commands, but for now we can't seem to
change the directories into a different directory
and that is something that we must see how to fix
in the next video.
But for now, it is good that it works.
We saw how we can compile the program to exe
using pyinstaller.
So once again, just install Python 3.7 on a Windows machine
install pyinstaller for the Python
and install all the libraries
that you're using inside of your program.
In our case, we are not using any additional libraries
outside of the standard Python libraries
so we didn't need to do that.
Only thing we needed to do is to install pyinstaller
and then use the command,
pyinstaller program name, onefile and noconsole as options.
And this should compile the program for you.
Once you execute it, it should connect to the server
that we are running from our Kali Linux machine
and let us test the quit command if I press enter,
it closes the program right here in our terminal
but does it also close the program in task manager?
Let us check it out.
And it indeed does.
So we also closed the program
on the target machine with the quit command.
Great.
In the next video we're going to see how
we can successfully change directories using our program.