Hello everybody and welcome back.
And right now let's actually start off by coding that part of persistence of our back door.
So first thing we want to do is import two libraries into our reverse show.
The were the first library is actually
the OS library.
So we already used it before.
As I showed you in the python basics if you want to clear your screen for example you need to import
the OS library.
So just go to the upper part of your reverse shall the P Y program and import os.
The next thing you want to import is import shuttle.
Now this is the library where we believe the function which allows us to self copy the file that we
are running into a different directory.
So that is also something that we want to import.
And the third thing you want to import is the space library.
So import says now we will need.
This is part of this this library in order to use the shuttle.
That copy people function in.
And in order to copy our file into the different executable.
Now I'll show you what I mean.
So just for now on import these three libraries and let's scroll down to the beginning of our program.
Now what you want where you want to call this is right at the beginning of it.
So we want to perform this type of the self copying file and creating registry key even before we actually
perform the connection function.
So what we want to do is make a variable called location for now.
So location equals what we will do right now is we will set up a location where two cells copy or two
basically make a copy of our backdoor to which directory.
So we will use the HP data directory.
The reason why we are using the app data or how we want to call it directory is because it is a hidden
directory that most of the users can't even find.
So in order for you to go to it you just basically open your command prompt.
Make sure you're on your on your account not be on desktop or somewhere like that.
Back out to your account directory and then you can just see these two AP data.
And there you have three other directories which is local Okello and roaming.
Now we will be copying our file into the roaming directory which is also a hidden directory.
So see these roaming and right here we will have our file.
So this is the directory that can just show you a little bit better where we will be hoping to file.
So this will be our location of our copied backdoor.
So let us start coding that.
Now the OS library allows us to actually specify this path on and on any P.C. we run this.
So this means that for example you will not know how you how your target account is called.
So you will not be able to actually specify the path itself into your code you will need to specify
the function which allows us to actually change that part of the account in on an APC that we run this
on.
Now what I mean by that is that whoever runs this on their windows P.C. we will be able to execute this
function since the OS not environ and then open brackets BPP data will itself bring us back the path
to that folder to that roaming folder.
So what all we have to do right now for the location is we want to add the name of our file.
Now you do not need to name the file the same as the file that you will compile.
Let me just find the the this type of slash so not the backwards slash you want to slash the forward.
You want to use the forward slash type 2 slashes and then you will type the name of your file.
You can name it anything you want so we can name it backdoor so we know that it is our backdoor.
Of course if you're running this on the real target do not name it backdoor it will be too obvious and
all you have to do is add dot EMC.
Now this file right here once you close the the double quotes will create a location or basically will
pass path to the location of roaming with our backdoor to the AKC.
So after we copy in if we type they're in the same directory that we type there before we will have
backdoor that you see in this directory right here and you will also have the backdoor the senior directory
right here.
Just this path right here will be different.
This will be the name of your window stand account but everything else will be this.
So right now that we created the location we want to actually perform the coping the coping of our file.
So how we do that we actually do that with the shuttle.
So shuttle not copy file and let's just make a space so you can actually separate this part of code
from this.
So shut up that copy follows the function that we will use and what we will use is this dot executable
comma location.
This function right here will perform the coping of our executable which is our reverse shell to the
location that we specified under this name.
So for example if our executable after we compile it is called reverse dot EMC and they run it put it
on desktop and run it.
It will make a copy right away of that same program to the TPP data roaming folder with the name tag
or not the AKC and only after that it will perform the connection.
So what we want to do right after this is basically perform the creation of the registry key for our
file so it can actually be run every time the user starts their computer and logs into the we heard
to the two and logs into their windows user account.
So we will use some process library that we already imported says we can see right here that we use
the same process library for a different type of thing.
Right now we want to type your sub process not call and we want to call the command that will actually
make a registry key.
Now this is the command that you can run in the command prompt so it will specify the same command to
the same path where we want to store our registry key.
So we want to type your rank add now rather than typing right.
Here is best just the syntax for adding the registry keys so just follow up with me.
So req at age K see you now a this HK Siu basically stands for this HK current user.
So we are specifying the path right now so we want to type forward slash and then software.
I believe first of all it is software right.
So each key software and then Microsoft so slash Microsoft forward slash ups micro soft and then forward
slash once again.
And let's see what's next.
So after the Microsoft.
The next thing is Windows.
And then after the windows we want to specify the current version so slash windows and then forward
slash current version and then I believe the next one will be run.
So while they have to specify as one more which is the run folder right here where we will store our
registry key so slash run.
And right after that what we want to do is perform the backwards slash so V.
This will be the name of our registry key we can name it backdoor as well so.
So let's name it backdoor.
This is a type so rag underscore easy as we can see right here.
This is this is what we specify with the name of the registry keys so we will have a backdoor name right
here.
And the type would be the same as other types as well.
So registry underscore as Z.
And right now what we want to specify afterwards if that is the data part or basically the part where
we specify the path to our backdoor that we s copied into the AP data roaming folder.
So let us do that as well.
We have to do it with DB Sledge team command and then what.
Want to specify is actually the double quotes why we are specifying the double quotes is because right
now we will add a string to this command if we specify just a single quote It will make already our
string it will already close up our first apostrophe right here.
So we do not want to do that we want to add the double quotes right now and then a single quote which
of course this apostrophe then we want to add a plus location which is the location now of our path.
So location and then plus single code double quoted and single port.
What we did with this is basically right here as you can see we had to mix to use a mixture of the single
and double quotes in order to specify the command correctly.
So all we have to do right now is type your comma and then Shell equals true close our brackets and
that should be it.
Now shall they go through is the same as in this part right here so we can see we also use the same
sports library.
And right now if we run this on target b c it should create a registry key called backdoor we did type
Greg underscore a C with the location to the backdoor dot the AKC file that we copied in our AP Data
folder.
So there is another thing that we need to do before we actually compile this and run it.
What we want to do is actually test if this location already exists.
So for example let's say you run this a first time on target b c and they create and then all of this
part all part of this code happens so we copy the file to the AP data.
Then we add the registry key.
But let's say that restart the P.C. once again and they will perform the same function once again.
So they will add another registry key they will perform the same path right here with copying the file.
We do not want to do that.
We want to only do that.
This the first time they run the program there is really no point in doing this.
Once again after every reboot and after every time they run the program.
So what we want to do is after these specifying of the location since this is a variable we do not need
to put it right here.
We will use something called if not not.
If not is basically same as if just right now we will specify if the path if this path right here doesn't
exist.
This means that the program is being run for the first time since if this path exists that means that
the program has already been run before and the program has executed these two functions since this
path does exist.
But if it doesn't exists which we will check we do function always dot path not exists and then we want
to specify what path which is the location path.
And then we put the two dots right here and then if the path doesn't exist it means we are running it
for the first time.
So we want to perform the copying to the AP data folder and we want to perform the adding of our registry
key.
If it does exist it will just keep this code red here and it will go straight to the creation of socket
and then performing the connection.
So let's see how this will work if we just save this right now.
Controller to save and control X to exit now let's perform the compilation once again could just find
the command from the previous video.
Here it is.
So wine route.
And then the path to the solar river shall not be by one file and no console.
I click here enter so we can compile our program
we wait for the compilation to finish and then after it finishes we will cooperate once again.
So let's add our USP drive
I first have to delete the previous reverse shell from this folder.
So let me just delete this right here so I have to open a terminal and I will remove the riggers shall
not exceed from the previous video.
Good.
So right now I can close this as well.
Right now we want to go over this directory right here.
And we want to move as usual our reverse shall that easy media route.
And then the name of your USP drive.
We compete there then then we can delete all of the unnecessary things such as test build and spec so
what we want to do right now is same as before so unplug the USB drive.
Open it on your windows machine.
Face the reverse shell onto the desktop and then run the reverse shell now.
Right now you can see that it is running the reverse shell so everything went good.
Now we can start up our server and listen for the incoming connections now since we know that our reverse
shell tries to connect every 20 seconds we should be good to go in about 20 seconds or less as we can
see we already perform the connection and everything looks the same.
But right now what we want to check is if the the s coping of the file worked and also if we successfully
created the registry key for that file.
So right now if I go to the command prompt we can see I'm still in the same directory.
There is no back door to see right here since we did since I ran this their command before actually
running the program.
And if we type there once again right here right now you will see we have our new file in here called
backdoor dot the XY which is the same size as our reverse shell since it is the same file we just copied
it into this directory but also we want to make sure that the registry keys successfully created for
this path right here.
So if we go right here.
Press F5 to refresh we can see our new registry key has been added which is called backdoor which is
points to the path of C a user's HP Data roaming and then backdoor that the see.
So right now we know that this works successfully now every time the user reboots their machine their
backdoor will run at the startup or at the log in of their account and they will perform the connection
every 20 seconds.
So this means that we can successfully connect to their P.C. whenever we want after as many times as
they reboot the the file.
So right now if they for example let's quit this and if they for example even delete this reversal right
here which for some reason once again doesn't want to delete.
So we will have to fix that as well.
So let's close it in our task manager day for example notice that this reverse Shell didn't open anything
and they think this is a broken program.
They deleted right here and then they think they're going to go.
So but we know that we still have the backdoor that the in our roaming folder and that we also have
the registry key for it to run at the start up.
So now we will be able to connect even after they reboot and delete the file so that we about it for
this video.
I hope you enjoyed it and I hope I see you in the next one.
Bye.