Hello everybody and welcome back.
And in the previous video we fixed some of our code bugs that we had and we also added some of the functions
in order to perform the action of receiving and sending packets a little bit more efficient.
So right now as we saw in the previous video right now we can send out packets of any size and we can
receive packets of any size.
So right now since we finished the first part of our beginner show basically we just finished the executing
commands part.
We can actually try to test out the shell itself on the target system.
If all works well that means we can continue to add our different types of functions to our shell and
we can add some of the things such as running at at system boards for example putting the file in the
registry key self scoping the file and basically screen shotting target running key loggers and so on
and so on.
But before we do all of that we actually have to make sure that our shell works properly.
So let me enlarge this terminal so you zoom in.
Now let's go to the Python where my reverse directories where we have our reverse shell so you finance
it.
We can see everything that we did.
Now we have these two functions for receiving and sending we have the shell function which we're now
on only basically quit the main function or the program itself.
Once we specify Q As a message or as a command or in any other case it will try to execute the command
on the target system.
If the command can be executed it will send this string can't execute that command.
So right now what we want to do is actually run this program on our windows machine but we all know
in order for a program to be an executable and to be able to run it to the Windows machine we have to
make the dot EMC file with this reverse Shell.
For that we will use the wine and the pie installer that we installed in the system packing section.
If you didn't go over that section make sure to check out the video wine installation scenes there.
I showed how we can install the wine program which allows us to use Windows programs on Linux systems.
There we installed the python 27 version and there we also installed the PI installer which we will
use to compile this program into dot EMC version.
But before we do all of that we need to change a few things right here.
So you might notice that basically we cannot connect to the 127 0 0 0 1.
Once we run this on a target system we actually have to specify the IP address of our clinic's machine.
So let us close this and check out our I.P. address.
So it is not one dot nine.
We take this IP address right here.
We can copy it.
And right now we need to go to our reverse shell find the connect connect function.
So here it is connect and instead of the local host IP address we specify our own IP address.
This is because the reverse Shell will run on the target system.
So we need to specify to which IP address the reverse Shell should connect to.
We specify the IP address of the Linux machine.
So our target will connect to our calisthenics machine.
Now keep in mind that this IP address will only work on local code.
So if you were to run this over the Internet this attack you would need to specify either a port forward
either to port forward this IP address on your alter or to use for example and grok in order to run
the attack over the Internet.
Here you will specify the IP address of Anglo oxide.
And here you would specify the IP address or part of them in the port.
That anger shock has given to you.
Now we will do all of that even later on.
But for now not to the attack on a local host I will leave the port to be five four three two one so
also another thing to make sure is that the port isn't in use on the system on your clinic system.
So keep that in mind as well.
And this should be good to go.
Now we need to change these things also in our server.
So nano server the UI in our server we can see we have similar functions.
So for sending and receiving data these shall function which sends the commands to the target's system
and the server function which actually performs that connection or basically performs the listening
part of our server.
Here we can see that we bind it the IP address of local hosts in five four three two one we need to
change the local host to the IP address of Oracle UNIX machine so just copy paste it right here.
Now if you don't have any programming knowledge you might be asking why are we pasting the same IP address
in both of our programs.
Well basically the server program is the program that we will run as a listener on our Cal Linux machine.
So that is the program that we don't send to anyone.
We run it ourselves and the reversal program that we saw previously is the program that we send to the
target and that the target executes.
And basically that program will perform a connection back to our server.
So we need to specify on our server the IP address and local port on which to listen to which is our
IP address and our local port that we choose.
And on target we need to specify the Connect function to the IP address of our clinic's machine which
is the same as here and to the same local that we chose.
So that should be it.
We need to save this as well.
And all we have to do right now is make sure that we have the route not waiting for the right here if
you click here unless you should make sure to have dry see as well in the drive see if we go there you
should go to the Python 27 right here and in Python 27 you will see a directory called scripts in that
directory there is where we installed our PI installer at the AKC so change our directory took scripts
tell us.
And here we should be able to find a PI installer which is right here.
So if you do not have this python right here as I said previously make sure to check out the wine installation
video that I did in system hacking section but right now since we have it we can compile our program
with no problem.
So let's go back to our reverse shall directory.
So rude item files reverse and all they have to do is compile our reverse shall not be why we do not
need to compile the server the p why since the server is something that will run our clinic's machine
and it is already executable file in existence we only need to make an E XY version of this shell right
here in order to run it on Windows systems.
So how we do that we need to specify defined right here since as we said before the wine is a program
that we use to run the the windows programs on Linux.
So we need to specify wine since we will be running the python for Windows that we downloaded in our
wine folder and we need to specify the path to the by installer which we will use to compile the program.
So the path is rude not wine drive seed Python 27 scripts and then by installer dot EMC you need to
specify this path.
It should be the same for you if it is not a new actually install the program into some other directory
make sure to find a directory have all of this in there.
So have installed Python 27 under the scripts and make sure to specify that directory.
Now after that we want to specify the name of our file that we want to compile which in our case is
reverse shall that be why.
And basically this could be it.
But we want to specify a few other options that we will use in order to make our program more appropriate
for this task.
So for example we if you were to run this it would give you our full of full of files and libraries
that need to be used in order to run the dot the AKC version of our reverse shell.
But we only want to make the entire program to be one file.
So we need to make to compile the reverse shell into one file and not a bunch of files.
So we will specify the option right here so as to specify dash dash.
And then one file just type here would work.
So one file and also when we run the program we want to not be able to see the console.
Now the console is basically the command prompt.
So sometimes when you open programs the command prompt to pump pop up in waiting for some task to finish.
We do not want to prompt the user with this window right here since that would be suspicious.
What we want to do is basically user to double click the file and to think that nothing happens.
So and it nothing will be opened once the users runs and runs our reverse shell.
So that's what we want to achieve in order to achieve that.
We need to specify dash dash no console.
So that console doesn't pop up and this should be good and right now if you click your enter this should
start compiling our our rivers shall the P Y into the reverse shell dot EMC so this will take a few
seconds.
All should be done well.
And you might notice that at the end of this compile our program will be significantly bigger.
That is because this adds a bunch of other programs as well to it a bunch of other libraries and all
the things it needs in order to make this an executable.
And right now we see that our compiling has finished so it says right here building EMC completed successfully.
So let us just Alas once again and you will see we get a bunch of different takes added to our directory.
We get a directory called Build a directory called this and also something called reverse on the Scrolls
shall dots back now where we want to go if you want to go to the this directory so change our directory
to this.
Let's just clear our screen a little bit and type here.
L S and in our this directory we have our compile program.
This is what we have to deliver to our target.
So what you want to do right now is deliver this however you want.
I will use my USP drive.
So I will just plug it in right here and go to devices.
You will be and to Jerry will be dry right here in my case.
This is the Kingston data traveller and I will plug it in.
Then it should pop up right here that the U.S. B Drive has been plugged in.
That's good.
So we owe the US b drive.
And I will copy the file with my terminal.
So we have the USB drive called Cal alive our closets is underneath it the that window open and I will
just copy or I can actually move not need two copies inside I need the reverse Shelly c on my system
move it to media route and then Carl alive.
Now if you do not know how to copy this to the or you do not know the name of your use be dry.
Most likely if you just have to the media slash route type tap you will it will prompt you with the
available options for the ending of that command.
Now I just tapped and since only I have one you will be dry plugged in it basically founded by itself
and its name did carry light.
So if I move it right here I move the program there and now my reverse shell that the AKC should be
on my you will be right.
So now what we can do if it is tap your left nothing in this directory now you can remove all of these
things that the compiler has made so we can remove the build minus sa we can remove the disk minus sign.
Now remember to use minus r for the directories and the reverse shall we can use without the minus r
so just make sure to delete the right one don't delete the reverse shall not be y delete the reverse
shell dot spec and now we should be left with both these programs that we had even before before the
compiling of our reverse shall not be Y.
So right now what we want to do is unplug our USP drive and run the file on our windows machine so continue
without scanning and we have my reverse shell right here our pasted on my desktop.
We can see it is not easy.
The size of that file is a little bit large.
So if I go right here you can see that the size of the file is three point forty five megabytes which
is kind of large not too much but it's still something.
So that could be the only problem with this thing since it adds the size to the file.
Once the installer composites to the EMC.
That's why the file becomes so big.
But that's something we can't change.
So let's not think about that.
Let's actually now run the server.
So make sure before you actually run the deep before the target runs this make sure to set up a listener
by running our server dot P Y as we can see listening for incoming connections.
And right now with you if you send this to the target and target runs it
you can see that nothing really happens right here.
There is no window popping up.
There is nothing.
It basically looks like the program didn't run at all.
But if we go to our killer Linux machine you can see the target connected shell from this IP address
which is the IP address of my vendor's stand machine which I can show you right now.
If I open my command prompt and just type your IP config we can see that the IP address of my windows
10 machine really is one eighty two that 168 that one the three this port Fred here is the port from
where the connection is coming from.
On the we understand machine the local port the traditional was five four three two one and this is
the port from we understand machine that is sending the packets to us.
So right now you will notice a fire for example type here.
There you can see that they actually get the least of all the files on my window stand desktop as we
can see they really are there so he can handbrake clinic's master ethical hacking the J PAC this potable
New Folder record though and all of these things that really are on my desktop currently.
If you were to for example run a R minus S. you would get all the ARP tables of our we understand machine
which currently only has the router and Michaela Linux machine in there.
If you were to find a tool for example shut down the P.C. it would shut down.
We understand ABC including our clinic's machine so we will not do that since there is no point to do
that.
So we can see that our shell works perfectly.
We can.
The one thing that we can do so for example BW doesn't work in the in the we understand environments.
Let's just type where and we can get the name of the account so we can see which account are we on.
And basically the one thing that doesn't work.
So if you notice if I just type your dear once again I am currently in this directory.
But for example let's say I wanted to go to the one directory back so I would do that with the dot dot
and you would see if I type there once again the time still in the desktop directory.
Now that is something that we have to fix since we are only for now on able to change and we are only
4 now able to execute commands in the current directory.
We are not able to change.
The directory to some other folder or change directory back one folder or two folders basically go to
anywhere we want.
So we want to make sure to fix that or not to fix that.
There is a command we need to import the OS library in order to be able to assist but we will do that
in the next videos.
For now it is good that we actually know that our shell is good and that is running on both Windows
and Linux even after compilation.
So that will be about it for this video.
Now let's see before we actually end this video let's see how the target can close this program.
So if they go right here and try to delete this they will get printed.
The action can be completed because the file is open so they can delete this file as long as we are
on P.C. or basically as long as we are performing the connection as soon as we close the connection
they will be able to delete this file and they will delete this file.
Now anyone who knows a little bit about computers knows that they can just go to the task manager find
the reverse shadow to see an end to the task right there which basically would terminate our connection
right here.
So what we want to do is basically copy the file itself and make it also persistent and make a registry
key for the file that we copied so it can run every time a target system puts up so we will be looking
at that as well because right now if the target knew how to open the task manager and found the reverse
shell they would just go to the end task and they would and the reverse shell itself.
So that is another thing we have to take a look at so we can actually have a usable shell and not something
that the target can close anytime they want.
So if I just type your queue we should be able to see that the target and the target communication connection
and the server connection has been terminated.
So right now if we just delete this We can delete the file since we closed the connection so we will
see how we can fix all of that and that will be about it for this material.
I hope you enjoyed it and I hope I see you in the next one.
Bye.