-: Previously, we learned how to create
an undetectable backdoor, which is great,
but we delivered this backdoor by simply downloading it
at the target computer.
Now, this will probably not work in real life.
Your target will never just download an executable
and run it if you ask them to do that.
Therefore, in this lecture, I wanna show you
a smarter delivery method where we will spoof an update.
So when a specific program at the target computer
checks for updates, it will say that there is an update.
And when they install that update,
they will actually be installing a backdoor.
The only limitation to this method
is you need to be the man in the middle.
It doesn't matter how,
but you need to be able to intercept the connections.
So you can do this use in ARP spoofing,
or using a fake access point as I showed you before,
or using any other method that'll allow you
to intercept the connections.
So usually, programs have a specific domain that they use
to check for updates.
So let's say, we have the user here
that has a specific program that wants to update something,
it'll send a request to a specific domain.
And let's say this domain, in this case,
it's updateserver.com.
This will be sent to the DNS server.
The DNS server will respond
with the IP of the update server, which we have right here.
And then the user will send a direct request
to the update server, looking for updates.
If there are updates, then the update server
will respond with the updates.
Now, if we are the man in the middle,
if we're able to intercept all the requests
and the responses, then when we get a request
for updateserver.com,
instead of giving the IP of the update server,
we can actually give the IP of a hacker server.
This server is running a special program called Evil Grade.
And Evil Grade will tell the user
that, "Yes, there is an update."
And instead of serving them an actual update,
it'll serve them a backdoor.
So when the user agrees to install this update,
they'll actually be installing a backdoor on their system.
Let's do this practically, and it will become even clearer.
Right here, I have my Kali machine.
This is the custom image that I made for this course.
Therefore it has Evil Grade pre-installed in it.
So first, we'll need to navigate to the location
where it's installed.
We're gonna use the cd command to do that.
And it is installed in /opt/evilgrade#.
And then to run the binary, the program itself,
we're gonna do ./evilgrade.
Now, using Evil Grade is very simple
and very similar to Metasploit.
So, to get a list of all the programs
that we can hijack their updates,
we're gonna do show modules.
And as you can see,
you have lots of famous programs such as WinZip, VMware,
Skype, Safari, and so on.
Now, we're gonna be doing this
on a program called DAP, Download Accelerator Plus.
So, we have it here.
So to configure a specific module,
all we have to do
is just type configure module name,
which is DAP.
So you can replace DAP
with any module that you want to configure
with any program that you want to hijack.
So I'm gonna hit Enter.
And as you can see it's saying now I'm inside the DAP module
and I'm gonna do show options
to see all of the options that I can set.
So as you can see, we get a list of all the options
that we can set and the main option that we wanna change
is the Agent.
This is the path to the program
that will be installed as an update.
So in our case, we're gonna be replacing this
with the backdoor that we created in the previous lecture.
So to change this option,
we're gonna do set agent the option name to the location
where I have my backdoor.
And my backdoor
is in /var/www/html/
backdoor.exe.
So, as you can see, the format of changing options
is very similar to Bettercap And Metasploit.
We do set, followed by the options that we want to change,
followed by the value.
So I'm gonna hit Enter and that's done.
The next thing that I wanna modify is the Endsite,
which is the website that will be loaded
once the update is successful.
Now, I know this will return a not found error
that's why I'm gonna change it.
You don't have to change it with every module.
So again, to change this,
we're just gonna do set endsite,
and I'm just gon set it to just the basic domain,
which is speedbit.com.
And finally, before we run everything,
I'm gonna do show options one last time
to make sure that everything is set as I want it.
So I have the agent
set to /var/www/html/backdoor.exe.
That's perfect.
And I have the Endsite set to the way I want it.
So I'm ready to go.
And all we need to do now is just type, start,
to start Evil Grade.
So right now, if Evil Grade gets a request for an update,
it will say, "Yes, there is an update,"
and it will serve the backdoor.exe as the update.
The only problem is it will never get any requests right now
because I am not intercepting connections.
I'm still not the man in the middle.
Therefore, we're gonna become the man in the middle
using Bettercap.
Like I said, you can use any method you want
to become the man in the middle,
but we're just gonna do it using ARP spoofing right now.
So I'm gonna use Bettercap using the exact same command
that we've been using before.
So we're just doing Bettercap,
given that the interface connected to the network
and giving it this spoof caplet
so that it runs an ARP spoofing attack,
putting me in the middle of the connections.
I'm gonna hit Enter, and this will run with no errors.
So that's perfect.
We also need to use Bettercap to run a DNS spoofing attack
and spoof any request to update.speedbit.com.
This is the domain that the target program uses
to check for updates,
and we want to spoof DNS requests to this,
so they return the IP of the Kali machine right here,
which is running Evil Grade.
So Evil Grade gives them the fake update.
Now, I covered how to do DNS spoofing in details
in a full lecture before.
So if you don't remember how this works,
please go back and revise this lecture
because I'm gonna do it a little bit quickly right now.
So I'm gonna copy this domain
and I'm gonna clear this screen here.
And we're gonna set the DNS spoof all too true.
And we'll also set the DNS spoof, the domains,
to the domain that we want to spoof.
Finally, we're gonna start the DNS spoofer
by doing DNS spoof on, perfect.
Now, it's working and it's still know
that it's gonna spoof any request
to update.speedbit.com
to the IP of my Kali machine.
The IP of my Kali machine is running Evil Grade.
Evil Grade will say, "Yes, there is a new update,"
and it'll serve them the backdoor that we have right here.
And that way the backdoor will be automatically executed
on the target computer.
The only problem is the backdoor will get executed,
but we're not listening for incoming connections here.
So, we want really get access.
Therefore, we need to listen for incoming connections
using Metasploit as I showed you before.
Now, I've already configured my multi/handler.
Again, I covered this in detail.
So if you don't remember how to do it,
please go back to that lecture.
Right now, I'm just gonna do show options
to show you the options that I set right here.
And you can see that
I am using a windows/meterpreter/reverse http here,
because I'm actually using a different backdoor
in my Evil Grade, this backdoor right here.
It's not a reverse HTTPS as shown in previous lectures.
It's actually a reverse HTTP backdoor
because for some reason I noticed the HTTPS backdoors
are not working with Evil Grade.
That's why I created a reverse HTTP backdoor
specifically for this lecture.
So I'm setting my payload to the same payload
that's used in my backdoor.
I'm setting my IP in here.
I'm setting the LPORT to 8080.
So everything is perfect.
I'm gonna run exploit to listen for incoming connections.
And now, we're ready to go.
So now let's go over this one more time
when we go to the target computer and check for updates.
Right now, this computer is intercepting connections
because of Bettercap.
And it's also gonna spoof any request
for updates.speedbit.com to this IP.
This is the IP where Evil Grade is working.
Evil Grade is gonna say, "Yes, there is a new update."
The update is this executable.
The target computer will take this executable.
It'll run it because it thinks it's an update.
When this gets executed, it'll send a connection to us
in here in our multi/handler.
So let's go to the target computer
and see if this'll actually work as we expected.
So I've already downloaded Download Accelerator Plus,
the program that we're trying to hijack its updates
and installed it.
So I'm just gonna double-click it to start the program.
Now, it's just asking me
to set it as the default download manager,
I'm gonna say no.
And I'm gonna go to Help
and I'm gonna click on Update Now.
We're gonna say yes, check for updates please.
I'm just gonna uncheck this, click on Next.
It's checking for updates now.
And it's telling us that there is a new update.
So we're gonna say Next.
And it's telling us right here, it's a critical update.
So I'll be like, yeah, I wanna install this.
This will download the update for me and install it.
And it's still not that it's done.
Everything is done.
We're gonna say next, thank you very much.
And Finish.
Now, if we go back to the Kali machine,
you can see we got a reverse connection here
from the target.
Just to confirm this, we can do sysinfo
to see more information.
And perfect.
As you can see, we're inside the target computer.
And now we have full access to that computer
and can do whatever the normal user can do on their system.
Now, I will talk more about post exploitation
and how to control the computer
using this meterpreter access
in the post exploitation section.
But right now, we managed to hack into a computer
using a fake update.