Hello everybody and welcome back.
And in the previous video we actually tested out our reverse shell in order to see if all the current
functions and all the current and current responsibilities of our commercial work on our windows 10
machine.
So we managed to compile it successfully with our PI installer not to exceed in our clinics and we ran
it on our windows 10 machine.
Now there are a few things that you might have noticed that actually didn't work.
For example let me just go to my to my directory with the reverse show and let me enlarge this a little
bit.
So we will zoom in and define an on the reverse shell.
You will see that we didn't code anywhere for example that the diverse shells should try to connect
back to us every 30 seconds for example.
So let's say we were a little bit late on with our listener.
So we didn't set a place in the wrong time.
And let's say Target click the the virus or our reverse shell or backdoor however you want to call it
before we actually set up a listener.
That would make us not be able to connect to them or them to connect to us since we didn't listen on
our local host on our local board.
So we want to actually change that.
We do not want the target to actually run the code and run our backdoor and for them to not continue
to connect back to our server just because we didn't set the police now.
So let's say our function right here will put it right here.
So let's add our little bit of space and let's call it connection their function will not take.
I will not take any arguments or just type here the connection and empty brackets and what we want to
do right now is basically try to perform the connection every 20 or 30 seconds or for example however
what you want to be.
Or for example at any period of time you want to make it.
So first of all let us go to the part where we actually perform the connection for now on which is this
part right here.
So the first thing that our code does is basically it sets up a socket with the IP before and DCP and
then it performs the connection after it performs the connection it brings connection establish the
server.
Now first thing we want to do is we want to delete the connection establish the server since we are
running this on a target and there really shouldn't be anything to be printed out on the target system
so let's delete this print connection to server.
And if you notice right here right after we connect we go into our shell function which is a while True
loop which basically performs actions forever until we specify Q And then we actually break out the
while loop and break out of our program so we can actually try to make something similar for our connection
just without the breaking part.
So what we want to do is basically as soon as the target click double clicks our code we want to make
it try to connect to our server every 30 seconds for example.
So what we want to do is this function right here which is so-called connect we want to paste it in
our connection function.
So we want to delete this.
And basically what we want to do right here is at the third button and then so we added a table.
And so it actually belongs to the connection function and then we want to trap type while true which
means the same as in the shell function.
Where that this will perform forever.
And while true we want to actually use.
Try and accept rule.
So we will just type your try and accept and indeed try we will try to perform the connection so SOC
not connect.
We want to connect to the our IP address which I need to check out what it is.
So let me just open up another terminal.
Now I could just type your I config and we can see my IP address is that on the 9.
Good.
So we will try to perform the connection on our 1 92 that 168 at 1 the 9 which is our clinic's machine
we need to put this under the double codes and we need to specify a port the same port from our server
as well the same port.
We're listening out.
So five four three two one.
We closed the double brackets and thus this is basically it for the connection want to type in the try
and acceptable.
And after that for the accept what we want to do is we basically want to call our connection function
inside the connection function.
Now I will explain what this means.
Basically if I just type here connection this will mean that the function where once someone once the
function is called down here it will go through this code it will go to do all true loop it will try
to connect and if it can't connect it will call itself then it will go back to the connection it will
try to connect and it will go back it will try to connect and it will perform the connection function
forever until we are able to connect back to our server.
So what we want to do is not actually perform this right away we want to add a timeout for the connection
function so we will just import a library called time.
So just type here.
Import time and time allows us to basically pause our program or put our program to sleep for a certain
amount of time.
In our case we will specify that time to be for example 20 seconds.
So let's go to our connection after the while True loop.
We want to type here before we try and accept.
Let's take your time.
Dot sleep which is basically referring to this library and not sleep is just sleep is a function that
is specified in the time library and all we have to do is specify in the open brackets the time that
we want to put our program to sleep.
If you just specify like this 20 this will mean our program or our backdoor we sleep for 20 seconds
and then it will perform the next step of the program.
So one more thing we want to do is what happens if we manage to connect.
So if this manages to connect we want to perform the shell function.
So we want to enter shell.
And this means two things.
One of them is that we want to delete the shell function right here and we want to specify instead of
the shell function connection function.
So I believe this should be it.
I believe this will work.
So let's see what actually will happen.
So we create our socket.
We perform we call the connection function which will go to this code right here.
It will enter the wild True loop.
It will sleep for 20 seconds then it will try to connect to our server.
If it manages to connect it will call the shell function which will enter us in our command execution
part which is right here.
If it doesn't connect it will call the function again and it will go back to the beginning and it will
again sleep 20 seconds.
Try to connect if it can connect at that time as well.
It will call the function again.
So this will perform forever until the target manages to connect back to our server.
So we want to save this.
So control.
Oh I believe this will work.
We will test it out right now.
So everything is good.
We call the connection function and we call the shell function from the connection.
Okay so say once again control X to exit.
Now let us actually try to compile this and see if this works.
So what we will do is we will compile it.
Then we will actually run our reverse Shell first instead of the listener and then after.
For example 20 to 30 seconds we will run our listener to see if this works.
So let's see what.
Let's first compile the program.
So what we want to do is type your wine slash route.
Now we perform the same compilation as in the previous video.
So drive see item 27.
And then what we want to use is the scripts library and by installer not EMC.
After that we want to specify the name or file which is reverse.
That is why and we want to also specify it to be one file.
And without counsel we do that with this two commands which that each one file and that there is no
console then we press enter and let this compile
this will perform the compilation with our paint store and then we will be able to transfer it to our
target with our USP drive or however you want it.
So I will just plug in my USP drive
and right now what I will do is first of all I will put it to be on our virtual machine so King data
traveller now where it is black then I will copy the file to offer you with me drive.
So first of all we go to the this directory is in the previous video released and we move the reverse
shall not accede to media road.
And then Mike Kelly live.
You will be right.
Once we move it I can now eject you as you drive right here.
And I can call my function from here or pardon me my backdoor so I'll paste it on my terminal on my
desktop and I will double click it so it will run once it runs I will wait for a few seconds and then
I will actually try to run my server and see if it will connect back to us after we actually run it
on target system.
So first of all while we do that let us delete the unnecessary directory which is the gist we do not
need it anymore.
The build and the reverse shall dots back we can delete all of those and right now if we check out if
everything is okay with the server so we didn't change anything.
It listens on the correct IP address and on the correct court.
And now if we try to run the server we run it.
It says listening for income and connections and we can see our target has connected.
Even after we run and get on target b c if we type your code my we can see we get the account if we
type here dear we get all the files on our desktop.
So now we got a way that we can actually connect to our target whenever we want.
If they run the backdoor for example three hours ago and we run our listener three hours later we will
still be able to connect to the target system since they are constantly performing the connection function
from socket library every 20 seconds.
So that will be about it for this video.
What we will do in the next video is we will see how we can also make this program run even after the
target reboot their system.
So right now for example we can connect at any point after the target runs the program but if they shut
down the APC and they restarted the program will not be running anymore.
So what we can do is if they reboot the APC we will not be able to connect anymore to the target until
they run the program once again.
So we want to bypass that as well and we will do that in the next video.
So you enjoyed this one and I hope I see you in the next one by.