Hello everybody.
And I had to split the tutorial out of technical problems.
So right now let us just continue from where we stopped.
So I will just run my reverse shall once again or pardon me my server in order to listen the connection.
So let me just run it.
It prints out listening for incoming connections several enlarge this but it's not there it's here.
So zoom in and right now this is the file that we received after we compiled it.
And after we added the echo of that image and also once we run this this should actually run the image
first.
So we should be opening this image and also opening our a reversal in the background.
This should also also instill a persistence right away in the roaming folder and also the mayor registry
key in our Windows registry.
So let us go right here.
Go to the command prompt first before we run it.
In order to check everything worked well.
So it could be data roaming and we can enlarge this.
We can also go to the registry it's run and rag at it.
We click here.
Yes.
And we can see that there is nothing named backdoor right here so let us run this program.
We click on it and hopefully it will open the image and also it will create a registry key for us in
the registry.
So let us wait for this to open.
It doesn't seem to actually open anything.
So if that doesn't work we'll have to redo this.
But sometimes some images won't really open.
Let's see if at least our registry was added and we can see our registry is added right here.
So reverse shell that you see.
Let's see if we receive the connection we did.
But for some reason our our image didn't open.
So let us try something else.
Let me just uh go to my desk manager so I can delete the
or close the program and can just find it.
Here it is.
I am desk.
Now let's actually delete this as well and try to compile once again.
So let me just go right here.
You remember that we turned our image to be an icon.
So we should just be good to go right now so wine route to wine drive see python scripts by installer
that the AKC that we had the data for the image since we want to open it.
We go to the root python programs reverse and then this image right here but before we do that let's
see if we correctly specified the name of the image itself in the reverse shell.
So before we run this let me just close this and go to the reverse shall that be why.
Let's see if there is any problem right here for why our reverse Shell didn't really work.
And there seems to be the problem.
So we need to have a forward slash right here in order for it to be able to find our directory with
our image.
So right now we added the forward slash right here and the name of our image in our directory.
So let us save this.
And right now let us continue with these comments.
So remember after the specification of the image path you need to specify here dot and comma and then
dot after that what we want to do is we want to actually go and specify other things as well such as
one file and no council.
And we also want to add the icon that we converted in the previous tutorial so rude downloads I believe
and then drag on that Iko.
This is the path to where we saved our image icon.
And right now we want to specify the name of the file and we should be good to go so I will click here.
Enter and let it compile and in the meantime I look like in my use bead right
now let's plug in the SB driving to the clinics.
We should delete the previous reverse shall so we don't confuse these two.
This one should work now.
The previous one didn't open the image because we didn't specify the forward slash or the backwards
slash in our reverse shall not be Y.
So let us open this terminal and delete the reverse shall Dot.
See now we can close this close this as well we can open this we can see that the compilation has finished
that we just see by this terminal lead and close.
OK.
And right now we go to our this directory and move the reverse shell that the AKC into media route and
then Kelly like once we move it we can now delete all of these files
and we can start our server.
Now we can unplug our USP drive as usual
we open everything right here we paste it to desktop as we can see it looks exactly the same as in the
previous one.
Just this one should open the image now but before we actually do that we need to delete the previous
backdoor that the AKC since is for.
Since if we do not delete this and also the registry.
This will not open an image since it only opens the image once it is being run for the first time.
So let us delete the backdoor exit to the command prompt and also let us to leave the registry key so
quick here delete delete this value and right now if we run this right now we should actually open the
image itself as we can see it looks like a legit image.
It just takes a few seconds to load
so here it is.
It opened the image and this should look pretty normal for our user or our target they click on the
icon that actually has this image.
They also double click it and it also opens this image.
Now most of the users do not have their extensions on their P.C. so they will not be able to see that
you see here.
And even if they do see that they exceed most of the non technical people do not really know what executable
means and they will probably think it is some glitch that and that this is an actual image but let's
see did we receive the connection so we did receive the connection.
Right now if we just take your mind we can see that we can execute the commands and the good part right
here is that it actually doesn't open the image at the boot even though we got the registry right here
here.
We also install the registry and next time the system reports it will not open an image.
It will just open the reverse shell which is good.
So we got our fully working reversal right now which opens the image which also has the icon and which
can actually trick some users into running it.
Now the next thing we want to do in the next video is I will show you how you can actually check if
the user ran your program or your backdoor on the administrator account.
If they did run it on the administrator account we will we will we can actually put our registry key
inside inside the local machine which will allow us to actually have a persistence on every account
on that machine.
The key in the current user registry actually only gives us the persistence if the user logs into the
same account next time.
But if they lock in for example into administrator account they will not we will not be getting the
reverse shell back.
So we want to first check out if the user is admin and if they are admin we will actually install it
in the local machine.
If they are not admin we will install it in the HK current user.
So more about that in the next video.
This was about it for now I hope I see in the next video and take care by.