Hi, and welcome back to section four Netcat Penetration Test.
In this video,
we are going to talk in more details about persistence with netcat.
For instance,
means to use a mechanism to guarantee that one component will be always
available. In our case,
persistence with Net CAT means to put an instance of Net CAT that will be
available for connection. In this scenario,
there are some steps and options to follow and use.
We're gonna see here how we can use some configurations to put the Netcat in
an instance in the Microsoft Windows Register. But before this,
some steps will be out for our scope. For example,
to start some operations Windows has register,
we need to scarlet our privilege and to do this,
we need to have vulnerability in the target machine. Turn, run exploit.
There are some tools available. For example, meta Exploit. It's uh,
able to run our Windows user account control u i c exploit
to gain administrator access and is execute dis operations on the
Microsoft Windows header.
To explore a person's net cat backdoor,
we have some options. We,
we need to install a net cat backdoor in the victim machine when a copy from
a net cat available in our Linux, for example.
So we have a Linux tool and we can use a copy
of this net cat or we can use a net cat installer in the operations system.
In the, in the target. In our case,
we use a net CAT version from any map project already installer in the Microsoft
Windows machine target.
So we're gonna reuse this net cat there.
To open a remote backdoor connection,
we can use the Microsoft Windows header key to execute the net cat on
the startup of the remote host and listen to the desire port the party
current version and they run is the place for application that will be execute
on the start at the Microsoft Windows, for example, on screen we have this path,
the software Microsoft Windows current version run.
So this is the place when we have, uh,
programs that is running always in the startup,
so automatically run this operation.
So this is a good place to put our net cat instance running in
a lesson mode. That's mean net Cat.
We run as a server mode.
And this is very interesting place because every time that Windows start up,
the net cat will be available. Listen some connection,
meaning this specific port and on screen we have the common to
interact with the reg registry. So we have the reg query
verify. You pass a path,
verify a list of keys or sub folders that we have in this
path, or we have the re add to add a new,
a new value and a key. So we have, uh, a list of,
uh, operations of options that we have. For example,
on screen we have dash V to specify the name of the value dash
D to specify its value dash t to specify the value
data type and dash vi is used to write
keys. The full value, for example, in the key that we have the reg add,
we have a path to software, Microsoft Windows current version run.
That's mean that this path,
this key will be put in this path.
And we have dash v netcat is is the name of the key,
okay, dash T to
form the type of value and dash D is
to specify the, the value. So the, the value B, uh, there's a cushion,
there's a path to acceptable file net cat in this case dash
lp d the port dash e md dash
dot exact. That's mean that the value of this key,
I will create a key called NCA
the ad and this value will be this path here.
This be this exact ball. So this common here,
netcat LP 4 4 4 4 dash a
will be acceptable every time that that, uh, windows view start up.
So this is a,
a very u useful way to persistent
net cat backdoor, for example. Okay,
for this backdoor runs and works without problem,
we have to interact with the firewall too.
So a remote firewall can interrupt the net cat con connection.
So the firewall settings can be modified.
In onscreen we have a common net sh
as net H is a constant utility which allows changing
a lot of network related parameters. So for example,
we have common to, to add a new rule,
it's mean that onscreen,
we have the net s h and we are putting a new
rule. We have a name, for example, for this rule,
the local port 4, 4, 4 4,
and the type of protocol T C P and the action that's
allow, so this comment on screen say, hey firewall,
you have to add a new rule. This is the name of the, of the new rule. Uh,
this action is to allow or deny in this case is allow, have,
be using this protocol and use this local port, okay?
That this is a common to open a rule exception to
add a rule in the firewall.
So this is a way to open the path.
The way for our net cat backdoor
runs without problem. So let's run example here.
I have my KA Linux environment and I have another machine running
Microsoft Windows. So I will connect my Ka Linux environment,
meaning this Microsoft machine, okay?
In this example of precedence, we are putting some comments.
We are use, uh, a comment to add a key in the register.
And we use a command to add a new rule in the firewall.
And for this operation,
we have to be administrator or a hold in Microsoft to windows.
Okay? So for this example works exactly, we have,
for example, in the scenario of penetration test,
we have two river run ice exploit.
So we have a run exploit in the Microsoft to user account control,
u a C. So for, to escalate of privilege.
So our, with this, all the stuff that we,
we gonna do will be in the root level. Okay? So this is our requisite,
this is out of this course. So let's run the,
the, the example. And now that connection is on,
we are able to execute some comments to check if the
connection is okay, for example, there.
So this is a result of the version of their Microsoft windows that,
that I'm connected. So this is example here.
Let's take a look in the register key.
So for this, we we gonna use the, the, the command rag
query. So we start
the query in the path to software
Microsoft. So this is the, the list, what,
what we have in the Microsoft.
So here we are able to connect and access and get a list of the all
the, uh, options. Okay?
Another common to add a key is like this rag
add. In this case, for example,
as I said before,
we have to scale it up our privilege to get access
as a route. So in this example here, we,
I will access for add a er, I will add a header,
a key header value in another path,
in another version of the register.
So the register that that I use will be each
key cu for example, dash, dash software,
and I will create a new folder. So,
and this folder will be, for example,
test zero one. So look at,
I'm able to create folders, okay? So re query.
Now I'll verify for example,
so this is, okay, my folder exists in the, the default value, for example,
and I'll put a key in this folder, in this heer. Okay?
So I use egged HK c u
software SS zero one.
I put a key in this heer, I'll use
the options that we saw in the, in the previous slide presentation.
So we'll be dash v slash V. Okay?
My key, for example, I would specify the type of the register. So will be
like this and the value there will be dash
slash D 25, for example.
So I was able to put value there and I use acute, again,
the reg query,
each kcu
slash software slash zero one.
So this is my, my key.
So I'm able to get access to
make a kiri to execute the common, for example.
So I have access to the head stream.
Okay? So now let's try to put, uh,
a value in another region of the register.
So let's put a comma, for example, a key in the reg l
h key at m software,
Microsoft Windows.
Use this here. For example, I would like to add a new,
in this example here we have folder and
there was not any result.
But if I use my terminal here in Windows, look,
access is denied. That's mean that the, this connection here,
the user,
I don't have the connect privilege to access this version,
this specific version here of the register.
So this is the privilege that I told before, before this,
we have to run some exploit to escalate all our privilege,
okay? To have access in the privilege mode.
For, for, for our example here. Example. Now, the,
the last phase is to, for example,
to get a list of information of firewall and to put a rule
over there, okay? So for, for check out the,
the options that we have in a firewall, we have a common neth
firewall show up mode
was a, a typo here, firewall
show up mode. Okay?
So this is the result, okay?
We are seeing that we have some options and some modes
enabled here. So the firewall is,
it's on and we have to put a new rule over there. Okay?
So let me open the clear the terminal and
let's add a rule in this firewall. So the command would be
neth a v firewall
firewall. Again, add rule.
We have to put a name for this new rule.
So we'll be DCP or for four.
For four we have specify a deer in,
in the action to be allow,
we have to specify a protocol that will be P C P
and we help specify a port that will be a local port.
4, 4 4. Okay? So this is the comment to add any new rule and open,
uh, a specific port, meaning a specific protocol. And our connection,
our remote desktop, uh, will be persistent.
So as I said before,
this operation request elevation run as administrator.
That's mean that we have before run exploit to bypass
this verification of authority.
The Microsoft user account control, UAC C. Okay?
But these are the steps that we have to
as execute a persistent net CAT backdoor. Okay?
First of all,
we have to run and exploit to bypass these U A C,
the user control, the user account control,
the user account control.
And then when this connection we use execute a remote connection,
then we add this common to always
run a net cat with this specific port in the register.
And then open a rule in the firewall in the machine that will
run. So in this case,
every time that by the Microsoft windows, you start up, we have
a net CAT distance running in the register.
The register have a ference there that will be able to run
and the firewall will not block the connection because we, uh,
added a rule over there.
In this video we saw about precedence in net cat. In next session,
we'll take a look about blackhead tricks with cat. I hope.