OK, so in this video, we're going to be using vill to create a backdoor, so the first thing I'm going
to do is I'm going to do list.
To list the available tools and I'm going to use number one, because we want to use evasion and then
I'm going to list my payloads.
And like I said in the previous lecture, I want to use go interpreter reverse https, so that's number
15.
So I'm going to do use 15.
And that's going to list the first of all is going to show me information about this particular payload
and then it'll show me the options that I can set for this payload.
So the main option that you want to set and the most important one is the IP address.
So this is the IP address, which you're going to be receiving the connections on.
As we said, we're going to have a reverse connection and we need to set the IP address, which the
payload or the backdoor will try to connect back to.
And in our case, we want to receive the connection back to this Caleigh machine.
So we're going to set the IPL host to the IP address of the current Calli machine now to get the IP
of Mitali machine.
I have to run if config, so I'm going to split the screen by doing right.
Click and click on Split Horizontally.
And I'm just going to bring this down a bit.
And we're going to run if config.
Now, you can see the IP address in here is 10, 20, 14 to 13.
This is the IP of my candy machine.
This is the IP of the machine that I'm using as the attacking machine.
So this is where I want the connection to come back to so I can hack the target computer once the backdoor
is executed.
So I'm going to set.
Host.
210, 2014 213.
So you can set any of these options using the set command, so all you have to do is write said, followed
by the option that you want to change.
So in this case, we want to change the host and we want to change that to 10, 2014 to 13.
Now the airport is set to 80, which is really good, because that's the port that's used by observers.
So as I said, the connection will look as if the target person is connecting to a website and it's
not going to be suspicious.
But I don't want to use that port because I'll have a Web server running on this and we'll talk about
that later.
So I'm going to change that to AT&T.
AT&T is another port that's used by Web servers, so it's still not suspicious and it should still bypass
firewalls.
So I'm just going to do said.
Same way that we did it before with the alehouse, we're going to do Bellport.
To the value that we want to set this option to and we're going to sell it to AT&T.
Now, if I do options again.
To list all the options.
You'll see that the alehouse changed to 10, 2014 to 13 and the airport changed to 80 80.
Now, if you generate the back door like this, you will bypass all antivirus programs except Avgi.
I've already tried this.
That's how I know this, and that's not good enough because we want to bypass everything.
Now, the way antivirus programs work is they have a very large database of signatures.
These signatures correspond to files that contain harmful code.
So what they do is they compare the signature of your file, of your backdoor to all the files in this
huge database.
If your file matches any of these files, then they'll flag it as a virus or as malware.
If it doesn't, then they'll think that it's a normal file and it's not malware.
So the main point in here is we're going to try to modify the file our backdoor as much as possible
to make it more unique so that it bypasses the signature database and will be able to bypass antivirus
programs.
Now, as I said, Vill is already doing that for us.
It's encrypted, the backdoor.
It's obfuscating it.
It's injecting it in the memory so that it doesn't get detected and it's doing a good job at it.
It's bypassing pretty much everything except for only one antivirus program.
So just to bypass this last antivirus program, I'm going to set some optional options that really won't
do much of a difference.
They'll just make the backdoor look a bit different.
So the first thing that I'm going to modify is processers.
And that's the minimum number of processors to be used by the back door.
I'm not going to set a huge number because that'll just make my back or not work.
I'm just going to set it to one, which is pretty much nothing, really.
But I'm just going to set this option to make the code look a bit different.
So I'm going to do it again.
The same way that we are setting the airport and the alehouse.
We're just going to put the option name, which is processers.
And we're going to set that to number one.
And I'm also going to set another option, which is the sleep option, and that basically lets the back
door sleep for a number of seconds that you set before it executes the evil code that you have in there
before it executes the payload.
So I'm going to set this to six.
Again, no real reason for this.
I'm only doing this to make the backdoor look a bit different.
So I'm going to do said sleep.
To six, so I'm going to hit enter and I'm going to do options again to make sure that all the options
are set the way I want them to be.
So I have my IP address set properly.
I have my airport, I have my processors and I have my sleep.
So I'm going to generate the backdoor.
Now it's asking me to name this Back-Door something, so I'm going to name the specter of.
He stops AT&T just so that we can remember which payload and which power to use for this back door in
the future.
Now the back door is generated and you can see it's telling us the module that's used and it's telling
us where the back door is stored.
So the back door is stored in this path right here.
So I'm going to copy that.
Let's go ahead and check to see if the back door is detected by any antivirus programs.
Now you can use the built in feature by using the check V.T. Command, but this feature only uses the
signature of the file, and it's not 100 percent accurate.
Sometimes it tells you that the file will bypass all antivirus, but it'll actually be detected.
You can also use virus total, but I don't recommend that.
And please don't do that because if you do that, your backdoor will become less effective because virus
total share the results of their scans with antivirus programs.
What we're going to do is we're going to use a website called Nor Distribute.
So we're going to go to it now.
So I'm just going to Google for nor distribute.
And what this is going to do, it's similar to what is total, the only difference is it's not going
to share this kind of results with antivirus programs, so it won't affect your backdoor.
So I'm going to click on Browse to navigate to my file, and I'm just going to copy where the file is
stored.
So tell me now it's stored in this location and user share will output comp..
So I'm going to copy this.
And I'm going to come here, I'm going to click on the pen and I'm going to paste the location.
I'm going to click on Open.
And scanned the file.
I'm going to include a link to this website in the resources of this lecture, along with an alternative
in case it didn't work for you.
And as you can see, the file is bypassing all antivirus programs so we can use this backdoor against
any device and will be sure that the device or the computer will not be able to detect this file as
a virus.
Now, please keep in mind that you won't always get perfect results like this.
Antivirus programs always update their database and will also always update the way they generate vectors.
So it's pretty much like a full cycle.
Will is always trying to bypass antivirus and anti viruses are always trying to detect the latest vectors.
So first of all, you want to make sure that you're using the latest version of Bill and you'll have
to experiment with the different payloads and different options until you get it to work.
This is the most basic method of generating undetectable vectors.
I actually cover more advanced methods in my social engineering course and in my python course where
I actually show you how to write your own backdoor, which is the best method.
But these methods are more complex, and this course is designed to be a general course that will introduce
you to most hacking fields without diving deep in any.
So if you want to learn more advanced methods of bypassing antivirus programs, then check out these
courses in the bonus lecture, the last lecture of the course.
But anyway, you don't need to worry about this for now, if you can't get it to bypass a lot of anti
viruses, you can simply turn off Windows Defender or the antivirus in the target Windows machine for
now for testing, just to get an idea on how to generate back doors and how to interact with them.
And then if you want to learn more, you can check out these other courses because these other courses
will build on what you're going to learn here.
So you'll have to learn these skills in here anyway.
Also, check out the YouTube video in the resources of this lecture to get a taste on what these methods
look like and how effective they are.