Hi and welcome back to Section five Blackhead Tricks with Net Cat.
In this video we are going to talk about Backdoors and Shell to maintain
access to a system that was compromised. A backdoor is the best solution,
and Net CAT is very useful for this task.
We saw that net CAT can be used in listener mode and can be
connected when we need to do this connection.
It's important to remember that when we connect remotely,
we have the same permissions as the user who launch the net cat in the
listening mode. If we need a different type of permissions,
we have to launch net CAT in the appropriate user or try to
elevate one time connection.
When we have a connection between two systems and something breaks this
connection, we need retain this connection and to do this,
there are some techniques for this.
In the case of something in the network that can be caused problems for this
connection,
we can use another set of techniques to force the Compromise system to
initiate the communication. This technique is calling shelf Shing.
Shelf shoveling refers to the act of redirecting the input and output of
a shell to a service so that it can be remotely accessed.
In this case,
we force the Compromise System to communicate back to the attack system.
And to do this we'll use a composition of Net Cat Commons.
It's a different flow of connections because it's the compromise system that
communicates with the attack system.
The reason is that if the Compromise system change its IP address,
the attack system will not be able to maintain a connection in this way.
So for this operation, we have this combination of Net Cat Commons.
So first of all, we have two configuration in the compromised system.
We have this composition of net cat, the host is the attack system,
and a part number. We have a pipe.
That's mean that what we have in the the left will be input that
what we have in the right.
So the second common will be path to the Bash and a second
pipe operation. That's net.
All we have in the left will be input to the right and the third common will be
uh, net Cat. The host will be the same attack system,
but now we have a different port. Okay? So we have in this option here,
this example below net Cat, the host,
the access that ends with 11 a port number 5, 5 6, 6 0
pipe common a path to the bash,
another pipe common and a second instance of net cat with the same
host that aims with 11, but in a different port, 5, 5, 6, 1. Okay?
And in the attack system we run instance of net cat running and listen on
the port that we had specified in the compromise system.
Here we have two environments on the left Microsoft Windows
and the right, our Carol Linux environment.
And let's do example of shell shoveling.
So lemme configure and check the
IP for my Microsoft Windows environment. So IP config
in here, I can see that MYP ends in 11. Okay? So
this will be our attack system and here will be our
compromise system.
So let me check the IP for this machine here.
The IP here is the number ends with the number
12. Okay?
So we saw that we have two system, a attack system and a compromised system.
And we have a combination of comments in our compromised system,
okay? To avoid any interrupter of, for example,
IP address could change or firewall or any interrupter.
So we will in reverse a flow of communication.
So in our attack system,
we run a net cat within the instance to listen
a port. Okay? So here I will create an instance, uh,
in the Microsoft environment is we are using a
net. Cat is a,
it's like a net cat instance for Microsoft Windows environment.
So let's use Z L P,
okay? To get more details, listen in a specify port,
in this case we create a port, open a port for 5, 5, 6, 0.
Okay? So here I have, uh,
netcat running in the listener mode.
Listen for an port 5, 5, 6, 0 and I will run a second
instance of netcat, but in a different port.
So it will be LP
5 5 6 61. Okay?
In our system attack,
we have two netcat systems running in lesser mode
and in a different port. And in our compromise system here,
I will run the combination of commands that we saw before. Okay? So I,
the common is like this.
So the first common is a net cat instance
in the specify host 11, this is the host of our attack system.
In this net catan view, we connect in the port 5, 5, 6, 0.
Okay?
The input here will be put redirect for my
second common after the pipe. So
this is an instance of, uh, a bash.
And then the common here will be redirect for another command.
In this case a net cat run connected to the same attack system
11, but in a different port. Okay?
So what we use and
start or do, uh, common in this terminal here,
the command will arrive in the compromised system and then we'll be redirection
for the this distance here, okay?
We have a redirection of flow to our uh,
shell command. Okay? So now we have both listeners here,
let bind a connection. Okay?
So now I have a connection here. Okay?
We have a connection from this host.
12 is the IP address of our compromise system.
And now I will check if everything's okay, is this connector is done.
So I you for example, use a common
to show k o version,
you name dash A for example, and C,
we don't have nothing here in our compromise system. Shell,
but we have a right direction from here.
So this is our result in this terminal here.
Okay? So, okay,
so all the common here,
the common part start from this terminal here in the attack, okay?
The common arrive in the comite system from this uh,
connection here. Imagine that there's a connection here.
The mouse here, the common, for example,
you name dash a for example, arrive in this terminal,
but will be redirect for this host and this port.
So the common will redirect and come back to the
attack system. So nothing is shown in the compromise system.
So this is very hidden common, for example, hidden results or tips.
Okay? The common is here,
this is very interesting because this is attack
is very, uh, interesting.
There's no common result showing in this terminal here.
And we have a redirection. So it's very interesting attack.
In this video,
we saw how to redirect the input and output of a shell to have a
compromised system remotely accessed. The next video,
we'll take a look at net cheat sheet. I hope.