Well exploiting a computer is a really great work.
However our goal as penetration testers is to maintain access to this compromised computer and to reduce
the time we already consumed and all the efforts we put in attacking the same machine over and over
again.
So for this purpose we need to install a backdoor upon our first access or compromise to do this.
We will use nets catch for this purpose and as we saw earlier in the previous video the net CAD can
act as a simple backdoor.
So suppose that you have a metal prayer session on a compromised computer.
In this case my computer is a Windows ten machine and I have a metal practice session.
So the first thing I need to do is to upload this net program for this purpose.
I will issue the upload comment from my mentor presser session and I will refer to the next program
on my desktop and then I will point to the location where I need to upload it on the windows machine.
It will be under sis Well 64.
So as you know on the Windows 10 machine which is a 64 bit machine you have system 32 and 64 diabetes.
Windows automatically handles a file placement of your 32 bit file or 64 bit files and this case this
NCD of the AKC is a 32 bit file.
So even if you put it in system 32 it will automatically appear insists while 64.
So just to make it easier I'm writing this here.
We'll just press enter and you will see that the file has been uploaded to this therapy.
Let's go to a Windows machine here and tried to search for this file this b c Windows since this will
then our search for N C E XY as you can see 5 4 2.
So yeah this is the time I have uploaded this file.
Going back to my column machine.
Now we have the file placed on the victim the machine.
OK so we need to have a mechanism that this file is booted or loaded up on the boot of the machine each
time.
So each time the user restarts or which the machine this network that file will starts and starts listening
by itself.
So for this purpose we need to create a registry key called net cut that will boot up the service every
time.
As you said the system as it started.
So this will give us actually the permanent access to the victim's machine so unlimited bits session
as well just write the a name.
He would just want to see the list of services that are automatically run currently on this target machine.
Okay.
So key for a key and right this registry entry edge K L M software my gross soft
windows current version and here we go there are no entries in this key so now we need to create the
key in order to set this process to run upon the boot of the computer so use the command of the egg
set Val key and use the same value for the key then use the V parameter for you new value I would call
it that cat and then we use the D for the data so the data in this registry entry will be will be C
windows and so will 64 then and c dot e x e and we will make it a listen.
So the listener daemon on Port 6 6 6 6 okay.
And then we will execute command e XY so just hit enter and you'll get a message that I successfully
set then a key.
Now if we go to the Windows machine let's try to locate this registry entry let's search for that from
the start
stronger press find and search for the net cat value and you'll see that the registry entry card has
been created and this is the value that we've just passed from the metacritic I'll go back to my calendar
machine and I will reboot the stream lock computer if you go here you'll see that it has started the
reboot sequence if I go back to my color machine I'll see that the Metro practice session has died again
to the windows machine after the reboot and let me access that machine now go directly to my colleague
and open a new terminal.
Now if I issued the net cat command pointing to this compromise victim I should have a quick remodel
check.
So let's see V for verbose and to enter the host address 1 and 2 1 6 8 0 2 1 1 but the remote address
was off the machine is 1 2 9 and the port is quad 6 just hit enter and here we go.
Now we have full remote access we have a shell for Windows and you can do anything so sky is the limit
now and you back to where this is installed and you can access the remote target anytime even if the
target machine has been patched or upgraded or etc.