OK so in this video we're going to be used unveil to create a backdoor.
So the first thing I'm going to do is I'm going to do list to list the available tools and I'm going
to use number one because we want to use evasion.
And then I'm going to list my payloads and like I said in the previous lecture I want to use go metric
better reverse DTP.
So that's number 50 and so I'm going to do use 15.
And that's going to list the first of all it's going to show me information about this particular payload
and then it will show me the options that I can set for this payload.
So the main option that you want to set and the most important one is the IP address.
So this is the IP address which you're going to be receiving the connections on.
As we said we're going to have a reverse connection and we need to set the IP address which the payload
or the back door will try to connect back to and in our case we want to receive the connection back
to this Kalli machine.
So we're going to set the IP host to the IP address of the current Callimachi.
Now to get the IP of my tally machine I have to run ifconfig.
So I'm going to split the screen by doing right like and click on splits horizontally and I'm just going
to bring this down a bit.
And we're going to run it.
Now you can see the IP address in here is 10 20 14 to 13.
This is the IP of my Callimachi and this is the IP of the machine that I'm using as the attack machine.
So this is where I want the connection to come back to.
So I can hide the target computer once the backdoor is executed.
So I'm going to set L. host to 10 2014 into 13 so you can set any of these options using the set command.
So all you have to do is write set followed by the option that you want to change.
So in this case we want to change the host and we want to change that to 10 20 2014 to 13.
Now the airport is set to 80 which is really good because that's the port that's used by web servers.
So as I said the connection will look as if the target person is connecting to a website and it's not
going to be suspicious.
But I don't want to use that port because I'll have a web server running on this and we'll talk about
that later.
So I'm going to change that to 80 80 88 is another port that used by web servers.
So it's still not suspicious and it should still bypass firewalls.
So I'm just going to do set same way that we did it before with the host.
We're going to do airport to the value that we want to set this option to and we're going to set it
to 80 80.
Now if I do options again to list all the options you'll see that the host change to 10 2014 to 13 and
the Allport changed to 80 80.
Now if you generate the back door like this you will bypass all antivirus programs except EVGA.
I've already tried this.
That's how I know this.
And that's not good enough because we want to bypass everything.
Now the way anti-virus programs work is they have a very large database of signatures these signatures
correspond to files that contain harmful code.
So what they do is they compare the signature of your file of your backdoor to all the files in this
huge database.
If your file matches any of these files then they'll flag it as a virus or as malware if it doesn't
then they'll think that it's a normal file and it's not malware So the main point in here is we're going
to try to modify the file our backdoor as much as possible to make it more unique so that it bypasses
the signature database and we'll be able to bypass antivirus programs now as I said Bill is already
doing that for us.
It's encrypting the backdoor.
It's obfuscating it it's injecting it into memory so that it doesn't get detected and it's doing a good
job at it.
It's bypassing pretty much everything except for only one antivirus program.
So just to bypass this last antivirus program I'm going to set some optional options that really won't
do much of a difference they'll just make the backdoor look a bit different.
So the first thing that I'm going to modify is processor's and that's the minimum number of processors
to be used by the back door.
I'm not going to set a huge number because that will just make my backdoor not work.
I'm just going to set it to one which is pretty much nothing really.
But I'm just going to set this option to make the code look a bit different.
So I'm going to do set again the same way that you are setting the airport and the host were just going
to put the option name which is processor's and we're going to set that to number one.
And I'm also going to set another option which is the sleep option and that basically lets the backdoor
sleep for a number of seconds that you set before it executes the evil code that you have in there before
it executes the payload.
So I'm going to set this to six.
Again no real reason for this.
I'm only doing this to make the backdoor look a bit different.
So I'm going to do set sleep to six.
So I'm going to hit enter and I'm going to do options again to make sure that all the options are set
the way I want them to be.
So I have my IP address set properly.
I have my airport I have my processors and I have my sleep.
So I'm going to generate the back door.
Now it's asking me to name this back door or something.
So I'm going to name the specter of Heyse TTP as 80 80 just so that we can remember which payload and
which port to use for this back door in the future.
Now the back door is generated and you can see it's telling us the module that's used and it's telling
us where the back door is stored.
So the back door is stored in this path right here.
So I'm going to copy that.
Let's go ahead and check to see if the back door is detected by any antivirus programs.
Now you can use the built in feature by using the check Vittie command but this feature only uses the
signature of the file and it's not 100 percent accurate.
Sometimes it tells you that the file will bypass all any viruses but it'll actually be detected.
You can also use Virus Total But I don't recommend that.
And please don't do that because if you do that your backdoor will become less effective because Virus
Total share the results of their scans with antivirus programs.
What we're going to do is we're going to use a Web site called not distribute.
So we're going to go to it now
so I'm just going to Google for not distribute.
And what this is going to do it's similar to Virus Total.
The only difference is it's not going to share these kind of results with antivirus programs.
So it won't affect your back.
So I'm going to click on browse to navigate to my file and I'm just going to copy where the file is
stored.
So Bill is telling me now it's stored in this location and user share will output comp..
So I'm going to copy this and I'm going to come here.
I'm going to click on the pen and I'm going to paste the location I'm going to click on open and scanned
the file.
Now as you can see I've already scanned this file and it's telling me that this file has been scanned
before.
So I'm just going to click on View previous results and as you can see the file is actually scanned
on the same day as today which is the 29th of March 2017.
And as you can see the file is bypassing all antivirus programs so we can use this backdoor against
any device and we'll be sure that the device or the computer will not be able to detect this file as
a virus.
Now there's a few things to keep in mind.
Antivirus programs always update their database and will always update their code as well.
So you want to always make this all up to date.
Also sometimes with the same exact backdoor it might get detected and it might not get detected because
depending on the way the backdoor is getting encrypted and it's getting generated I've actually generated
this backdoor before with sleep of with no sleep.
And as I said it got it got detected by one antivirus program generated within seconds and it still
got detected and then was six.
It was able to bypass it.
So you want to keep playing around with the options.
You want to keep playing around with the payloads until you managed to achieve the best results so that
you can bypass as much anti-virus programs as possible.