Narrator: In this lecture,
I wanna show you another backdoor delivery method.
In this method, we're going to wait for our target
to download an executable,
and we will backdoor this executable
as it's being downloaded.
So when they run their executable,
they will get the file that they're expecting,
but at the same time, a backdoor will run at the background,
giving us full access to their computer.
The only limitation to this,
is you need to be the man in the middle.
It doesn't matter how you manage to achieve this position,
but you need to be able to intercept connections,
so you can backdoor the downloads on the fly.
Now to do this, we're gonna be using a tool
called Backdoor Factory Proxy.
I already installed this tool for you
in the custom image that I made for this course,
so all we have to do is go to our Kali machine right here
and navigate to the location where I installed it.
To navigate to a specific location,
you can either just click in here
and press the forward slash from your keyboard
to open the path bar, or you can press Control and L
from your keyboard again, to open the path bar.
Once this is open,
we need to go to the path where this tool is installed
and it's installed in /opt/BDFProxy.
In here, you have the actual executable of the program
and you have the configuration file.
So I'm gonna double-click the configuration file
to change the config, and the main thing
that you wanna change in here is the proxyMode,
which we have it right here.
It will be set to regular by default,
and you wanna change that to transparent.
The next thing that we wanna modify is the IP
of my current computer, because like I said,
this tool will backdoor every file the target downloads.
So we need to tell this tool my IP,
so that when the backdoor gets executed
on the target computer, it knows where to connect to.
So you can get your IP by running ifconfig,
as I showed you before.
I've already done this and I know my IP is 10.0.2.15.
So I'm gonna look for where it says Windows in here.
This is the configuration for the Linux targets.
If you're targeting Linux,
then you also wanna modify the IP here,
but I'm only gonna be targeting Windows,
so I'm gonna look to where it says Windows,
as you can see in here,
and I'm gonna change the host to my IP, which is 10.0.2.15
and I'm also gonna scroll down to change it for Windows 64,
and again, in here, you wanna set it to 10.0.2.15
and we're good to go.
So I'm gonna Control+S to save, and Control+Q to quit,
and we are ready to use the tool.
So keep in mind, the tool is installed in /opt/BDFProxy,
and the program that runs the tool is this file right here,
bdfproxy.py.
Therefore, we're gonna go to our terminal,
we're gonna navigate to where the tool is installed,
so we're gonna do cd /opt/BDFProxy/.
I'm gonna hit Enter, and if I do a quick ls,
you'll see we have the program file in here.
And because you see this in green,
it means it's an executable,
so we can run it by doing dot forward slash,
followed by the file name, which is bdf_proxy.py.
I'm gonna hit enter and this'll run with no errors,
so it's perfect.
So this program right now is running on its own,
and as soon as it receives a request for an EXE,
it's going to backdoor that executable.
But the way it is right now,
it's not gonna receive any requests.
Therefore, we need to redirect requests to it.
To do that, we need to first become the man in the middle,
and like I said, you can do this using ARP spoofing,
you can do it by using a fake access point
and targeting the clients that connect to you,
or you can use this tool
whenever you manage to become the man in the middle,
regardless of how you manage to do this.
I'm gonna do it with ARP spoofing, because it's the easiest.
So we're gonna use bettercap,
exactly the same way that we've been using it before.
So we're giving it the interface, which is eth0,
and then I'm giving it my ARP spoofing caplet
so that it puts me in the middle of the connections,
allowing me to intercept data and modify it on the fly.
So I'm gonna hit Enter.
This'll run with no issues, so it's perfect.
So now I'm intercepting the data
anytime this Windows machine right here,
which is the target, tries to download something,
it's gonna be intercepted in here in bettercap,
but BDFProxy is still not able to see
that there is a download
because these are two separate programs.
So what we wanna do is we need to link all the data
that this program sees to this program right here.
And to do that, we're gonna use a firewall
that comes pre-installed in most Linux systems
called iptables, and using iptables,
we can specify rules that packets have to follow.
So I'm gonna clear my screen here,
and I'm gonna use iptables to modify a table called nat
and append a pre-routing rule that will apply
for TCP packets, that's going to a destination, port 80,
and we wanna redirect this to port 8080,
where we have BDFProxy running
and waiting to backdoor the downloads.
So, very simple command, we're using a program
called iptables to modify a table called nat.
We're gonna append a pre-routing rule
that'll apply for TCP packets
that's going to destination port 80,
and we're gonna redirect them to port 8080,
where we have this program, BDFProxy running,
waiting to backdoor files for me.
So I'm gonna hit Enter.
And I misspelled port in here, there's an "r."
And this runs with no errors, so that's perfect.
So now we're using bettercap to intercept data.
All this data is gonna be redirected using this rule
to BDFProxy, which will wait and see
if there is an EXE being downloaded,
it'll backdoor it, and then serve it back to the target.
When the target executes the EXE, will execute a backdoor
that'll send the connection back to me.
So all I have to do right now here
is to listen for incoming connections.
And you can do this using the multi/handler,
as I showed you before.
Or if you're lazy, you can actually use the resource file
that the backdoor factory creates for us.
So this file right here will automatically start
the multi/handler and listen for incoming connections
for all of the payloads that we sow
in the configuration file of BDFProxy.
To run this, all we have to do is first of all,
run MSFconsole as usual.
And we're gonna say,
"I wanna give you a resource file"
and then give it the full path for this resource file.
Now, keep in mind, this file was created by BDFProxy
that is stored in /opt/BDFProxy.
Therefore, the location of this file is gonna be
in /opt/BDFProxy, followed by the file name.
So if I hit Enter now,
MSFconsole will run and it'll load all the code
that is stored in the resource file,
which will automatically start the multi/handler
and configure it with the IPs
that we specified when we configured BDFProxy.
So now everything is running and we are ready to go.
So let's go to the target computer
and let's keep it simple when testing,
so I'm gonna to try to download something
from a HTTP website.
So we're gonna go to speedbit.com
and we're just gonna click on DOWNLOAD.
This'll actually download that,
which I showed you how to hijack its updates.
You will get a normal download,
we're gonna save it to our downloads,
this will automatically go to downloads,
so I have that already open in here.
As you can see, it has an actual proper icon
for the program, this is the normal icon
that you'll get if you download SpeedBit,
and if you double-click it and run it,
it's just an executable.
You will actually get the normal installer,
so if this was an actual person,
they won't really get suspicious
'cause they're installing the program that they wanted.
But what they don't know is this program got backdoored
on the fly as it was being downloaded.
So if we go back to our Kali machine,
you'll see that Metasploit is saying
that there is a new session opened.
So all I have to do now is press Enter on my keyboard.
Then I'm gonna do sessions -l
to list all of the available sessions.
And as you can see, we have a new session in here
and to enter into this session, to interact with it,
I'm gonna do sessions -i, followed by the ID of the session,
which is number one,
and I'm inside my meterpreter session right now
inside the target computer.
So to verify this, I'm gonna do sysinfo.
And as you can see, I'm inside the MS Edge right now,
and I can control this machine
and do anything the normal user can do on their computer.
And like I said, I will show you how to control
this computer remotely in the post-exploitation section.
But for now, we have full access to that computer
and we managed to do this by backdooring a file
that the normal user requested to download
as that file was being downloaded.