Instructor: Okay, so if we look at the backdoor
or the trojan that we generated so far,
we can see that it's very cool.
First of all, it has an icon that represents a file
that the target person is interested in.
When it's executed, it shows a normal file
that, again, the target person is interested in.
It shows an image or a PDF,
or anything that we want, really.
At the same time,
it's gonna execute our evil code in the background,
which will allow us to hack the target computer
or do whatever that we want.
The only problem with this file is,
if you look here at the end of the file,
you can see that it's .exe.
Now, in most cases, you probably want to see the .exe
because Windows would be configured to hide it.
But if it's not hiding it,
then it's obvious that this file is an executable
because it ends with a .exe.
What I wanna show you today is how to spoof this
and change this to something that corresponds to the file.
If we're trying to make our backdoor look like a PDF,
then you can make this look like a .pdf,
if we're trying to make the file look like an image,
then you wanna make this look like a .jpg or a .png,
or an extension that represents the image.
In our case, we're trying to make it look like an image,
so I'm gonna try to make this end with a .jpg.
To do that, we're gonna use
a right to left override character.
Before I show you how to do that, I'm just gonna rename this
and just literally copy the name.
I'm just gonna go on Rename,
copy everything here,
and I'm just gonna paste it in my text editor
so that when I'm modifying things,
it's clear to you what I'm doing.
Now, the first thing that I'm gonna do is
I'm just gonna type the new filename that I wanna use.
For the new filename, I'm not gonna use GTR image,
I'm just gonna use GTR.
This is, obviously, gonna have to be .exe.
Now, instead of this exe,
I, actually, want to have a .jpg.
But that's not possible because if I do that,
the file is not gonna be an executable.
To do this, I'm gonna try to get the text
to be read from right to left
using a right to left override character.
Because the text is gonna be read from right to left,
we're gonna type this extension after the filename,
but we're gonna spell it from right to left.
We're gonna spell it as G-P-J in here.
So, we're gonna put GPJ.
Again, this is just the extension that we want to use,
but we're spelling it from right to left.
We're spelling it G-P-J instead of JPG.
Now what I wanna do is
I wanna put a right to left character in here.
Basically, when I put that character in here,
the text, anything that comes in after that character,
will be read from right to left.
All this is gonna be flipped,
and, basically, the filename is gonna be called gtrexe.,
and this is gonna be read from right to left,
so it's gonna be .jpg.
Let me do it, and you'll see what I mean by that.
To get that character,
we're gonna go on all applications here
and we're gonna look for characters.
You can see that it's already showing me
the right to left override here in the Recents,
but for you it won't show it.
So, you wanna go here on the search,
and you just wanna search for right to left override.
And you can see we have it in here.
If you click on it,
you'll just see a button
that'll allow you to copy that character.
I'm just gonna click on Copy,
and that'll, basically, just copy the character for me.
Now, I'm gonna come in here,
and, again, once I paste it in here,
anything that comes after that character
will be read from right to left.
So, we're gonna start in here,
and it's gonna be read as exe.jpg.
I'm gonna put the cursor here,
and I'm gonna paste,
and as you can see, now the filename is called gtrexe.jpg.
Now, again, I'm gonna remove the character.
Back to normal.
If I paste it,
everything is being read from right to left,
and the filename is gonna be called gtrexe.jpg.
Now, when you're using a filename like this,
in my case, it looks fine
because I'm already using a name of car which is called GTR.
If you send them to a person, they might think the exe
is just a special edition of this car.
If you are using this as a book or as something else,
you wanna think of a name that ends with ex.
For example, there's a lot of names,
so you can think of reflex, hex, sex, and so on.
Anything that ends up with an ex
will be a good name to use in here.
I have my name now.
I'm just gonna copy this.
Then I'm gonna rename this.
And that's it.
As you can see, now my file is called gtrexe.jpg.
Now, you can send this file the way it is to the target,
but I don't wanna send it like this
because some recent browsers
are removing the right to left override
when downloading the file.
What I'm gonna do is I'm gonna add this to an archive.
I'm gonna right-click it, and compress,
and we'll just add this to an archive called gtrjpg.
And we have our archive here.
This way, when the file is downloaded,
the browser will not replace the right to left override.
We're all done now.
I'm gonna copy this,
paste it in my evil files,
and then we're gonna go and download it
from the Windows machine.
Now, I'm, actually, already listening
for incoming connections here.
I've showed you how to do this before.
If you don't remember, please go back to that lecture.
I'm gonna go to the Windows machine,
I'm gonna go on my Firefox,
and we're gonna download the file,
which is at HTTP 10.20.14.213,
and the filename is gtrexe.zip.
I'm gonna save this.
And in here, in our downloads, we see the archive.
Now we're just gonna uncompress it here.
As you can see now, if you compare this file to this one,
you'll see that this one has an exe format,
this one has a .jpg format.
It has an image icon,
and if we double-click it,
it'll, actually, show us an image, as you can see.
But, at the same time,
it's gonna execute my backdoor in the background.
If I go to the Kali machine,
you'll see that I get a session from that computer.
And just to confirm this, I'm gonna do sysinfo.
As you can see, now I'm inside that computer
and I have full control over it.
We managed to do this using a file that looks
and functions exactly like an image.
And just like I said before,
this method can be used to make the file
look like any other file type,
so you don't have to make it look like an image.
You can use this method to make it look like a PDF,
a song, a video, or anything that you want at all.
You can use the download and execute payload
to combine the backdoor with any file,
and then use this method to change the file extension
to any file extension you want.