This is lance a first time speaker. hes doing an intro to backdooring operating system
[ Applause ]
>> Thank you, my name is lance.  I'm DC801 one, we run a hackers space in Salt Lake City.  I wrote this presentation, kind of training material for new members of our hacker space and kind of to provide a basic introduction to do something kind of interesting with computer security and just kind of seeing, you know, what you can do with just basic tools.  Not using anything complicated like ‑‑ Metasploit, or you know, any complicated coding.  Or anything like this.  So this is super introductory, I hope that you enjoy it.
I like to give special thanks to Netedmac, metacortex, grifter, D3c4f and eveyone at DC801 here, and every one at this for helping me out with this presentation.  You guys have been great.  Just a little bit disclaimer, I'm not responsible for anything dumb that you do with this information.  So ‑‑ if you do something dumb, I learned this is from Nemus, here is his phone number.  No.  I'm not responsible.
So what this presentation does not cover, I'm not going to tell you how to hide your backdoor from skilled forensic investigators.  Most of the stuff you see here will probably be undetectable by regular users.  But anyone who knows what they are doing will see this stuff immediately.  So just be warned that ‑‑ you can get in trouble and you're not hiding your tracks very well.
Then the ‑‑ I thought it would be good to just kind of give you what I'm assuming your background is.  So I'm assuming you have a familiarity with linux, and networking and windows command line, um, administration.
So the goal of this talk is to take advantage of a user who has left their computer unlocked.  Right?  How many people here leave their computer unlocked to go to the bathroom.  Every one raised your hand, you have done it.  I do it, too.  Right?  So guess what happens.  What happens when you do that and your coworker sees it you get David Hasselhoff, right?  Sometimes you get this awesome picture of David Hasselhoff, right?  And a great reminder of why you need to lock your computer, right?
So I think was thinking we can get the David Hasselhoff in there by the time someone goes to the bathroom and comes back.  So what else can we do, right?  What other things can we do to the person who left their computer unlocked.  Let's see how fast we can install a backdoor.  Right?  We have five minutes we want to get the backdoor installed, everything setup, and walk away, let them set down and star missing with them.  So we're going to start using windows 7, setting up a Netcat backdoor.  Netcat is really good, like the hello world of backdoors.  Now, for this what we're using, we're using very basic tools we need a to set prebuilt.  You have to do a‑‑ setup of all of your tools and everything beforehand so you are ready for when the user walks away from their computer.  So you want to make sure that you have the files on a USB drive or on the Internet you can quickly download them and put them on your computer.  Another thing you want to look for is portable applications.  Portable applications are applications that don't require, DLLs, setup process, basically you put them on the computer and you can run them.
So this is kind of my basic toolkit for windows 7.  I'm using gViM, windows used to have edit, an awesome command line editor at 16 bit.  The new 64‑bit operating system doesn't have it.  I found gVim, a portable binary, you connect to your netCat backdoor, you can use gVim to edit files.  And Wget.  Once you get on there you probably want more things you need a way of downloading that to the command line.  This a great to I found that is compiled for windows 64‑bit.  There are 32‑bit out there.  And the next place to get NETCAT is from the kali linux image.  This is that.
So ‑‑ we want to set up Netcat.  So we get Netcat why we're going to grab it from and set up a backdoor.  Right?  Here in this command we're running Netcat with the listener on port 449 and execute the command line CMB.  As soon as I connect to that port through Netcat as a client I'm going to get a command prompt.  So before I can connect to it, I have to make the operating system allow me to connect to it.  So I have to put Netcat somewhere, right?  In the path, I have to do registry settings, and I have to disable that firewall, or add a rule to the firewall to allow me to get to that Netcat instance and also, I'm assuming that this point, the user log‑in has admin privileges.  You need that to modify the firewall.  This is an example I got exactly expanded from the offensive security stuff.  They have a great tutorial of setting up a Netcat backdoor.  I provided a link here and slides on their website, too.
This is the basic windows command, if you're just not familiar with them.  I thought I would put them in here just so you have something to reference on what their correlation to Linux commands are.  The key here, mainly you're going to add new directories and items to the path.  You're not constantly typing the full name path in there for the Netcat session.  This is just kind of an example of what it looks like.
So now that we have the firewalls disabled and Netcat running we now ‑‑ we have a persistent, we want to find the registration settings to allow Netcat to start, your computer reboots, but we want to get to it right now, we have the five minute window.  Here is the VBS scrypt, a visual basic scrypt ‑‑ scrypt that allows us to start Netcat and walkway.  This puts Netcat in the background, and starts listening and don't wait for the use to restart the computer.  We connect to the computer through Netcat here, you look at, this is probably ‑‑ it looks a little faded, I can't see.  Basically it is just Netcat, we do the mode, the IP address and the port number.  And we get connected and we have theCMD command prompt and access to the remote computers.  This works great.  Local LANs we will show you how to get to the firewall and connect that way.  In this point working in the same office or same place with the target you can now connect to that computer from your computer and start messing with them.
So if you're interested you can take care just to verify ‑‑ did it disconnect?  All right.  This is process explorer if you're not familiar with it.  Process explorer let's us look at all of the processing on the operating system.  So you're going through this process and look at how Netcat works and how the processes works.  You can use process explorer to see that Netcat is running thin background there, that is what is highlighted in the bottom.  You can download process explorer and take a look at it.  If you want to view connections to it, once you are connected the backdoor can, you can look at the Netcat has an executable coming to from another IP address.  And a good tool for windows as the TCP view to view that.
Now, so now we have connectivity to the box.  So the next question is, okay.  What can I do with the connectivity and the backdoor.  What fun things can I do to the person has just left their computer unlocked and now they have come back?  Right?  So ‑‑ we, we, I have a list of pranks here.  The one cool thing we can do, can have their keyboard time hello to them.  Right?  Every 100 seconds their keyboard is typing hello.  They are working on code, and it was a types hello, go on forever.  We can continuously cycle the cap lock button.  Every one hundred seconds cap lock on and off.  Can we can write a batch scrypt spread to spread all over the place on their file system.  Start notepad continuously.  It starts notepad up, closes it, there it is again.  Or you can have it start, this is really cool, you can have it start the website up, close it, there it is again.  Start it up, close it, there it is again.
You can make ‑‑ this is kind of cool, their keyboard, this makes a disco on the keyboard, it cycles the caps lock, scroll lock, it repeats the lights on the keyboard.  It is really annoying.  Because, I was testing these and trying to disable this one and it kept change everything when I was trying to turn it off.  You know, and this is one of my favorites.  You can continuously play the startup song, right?  The best part about it is your coworker is like why are you restarting your computer, I'm not.  It just keeps doing that.  You know, this is the classic, popping the CD‑ROM drive in and out, right?  Something weird is going on when your CD‑ROM just keeps going in and out in the old days.  You get control of your computer, what do you do, Pop the CD‑ROM drive.
So this is what the, this is what is called a fork bomb.  So basically what this does is a piece of code or instructions that continuously eat up resources of the operating system.  This is a fun thing.  You know, they are typing along doing their stuff.  You can start a fork bomb, and it will stop and halt, they have to reboot.
Sure.  They are just my control panel.
[ Laughter ]
[ Applause ]
[ Laughter ]
Now, just a drunk hazard.
[ Laughter ]
This is another cool little thing.  This is easy to get past if you know how to close a file, you know, control, kill a task.  You don't know how to do this, this is super frustrating.  Because it makes, like you hit the X, you minimize it, it just sits there in the desktop completely unable to do anything.  This one is my favorite, so if you remoted into their computer through Netcat you can start talking to them with windows 7 because it has a text to speak engine.  So you can start messing with them, start talking with them, saying hello.  Hi, what's going on.  You seem to be having trouble with your computer.
So we had our fun, we've done everything.  You know, and, so we might need, we might run into issues and might need to reboot their computer, because we feel like it, or happen after 30 seconds and walkout of the room saying it was not me, I'm not doing this, right?  These are the shutdown commands for windows and command lines.  This is another thing you can do to try to hide your code.  So if someone sees what you're doing and you want to just kind of hide it so they don't know what the scrypt is, and can't use it again, right?  Later in the office, you can use batch EXE and other ones here, these are sketchy backdoors that work really well.  The VBS ones worked pretty well.  Tried to power shell one, didn't have much luck with it.  You can take your scrypt and turn it into binary code, at that point they have to live look at the binary and do things with it.  Makes it a little bit more difficult to figure out how it works.  Also kind of useful to be able to control the firewall on windows 7.  These are all of the commands I thought were useful.  You know, you can turn off all of the traffic.  You can do all kinds of cool stuff with that.  If you write a rule, you can delete it.  You can control the windows firewall from the command line.
So we set our scrypts up and down a bunch of stuff, it is realtime.  A great tool, you can use the "at" command to have stuff run later.  You can setup your prank, do a bunch of stuff.  Walkway from your terminal, get a glass of water and watch the guy who is frustrated with things that are happening to him.  And this is a good command later on if you want your backdoor dial out, you can set it up with an at command and have it run at a certain time, or schedule it with a scheduler.  That creates a process with the operating system that they can look at later.  What is this program running every day at 3:00?  But with at it is kind of invisible.  You have to look at the at command and see all of the tasks set.
Another good tool is S delete.  This goes through and wipes all of the code, or basically what you tell it to it does a deep delete, better than normal delete, it doesn't leave as much fragmentation and remnants of the file.
So we have gone over windows.  Let's go to Linux so Linux admin.  He typing away and goes to the bathroom and leave the shell in.  Has the VPNN, the SSH, he is not going to close the session.  So ‑‑ what can we do to mess with the Linux user or just the Linux consul that is open?  At this point we're going to need a Linux tool kit, too.  So another crucial to is the autoSSH.  In this case, I went out and compiled a new Netcat.  I had a lot ‑‑ a little bit of trouble with it, shred and screen are useful tools.  The great thing about auto SSH it is a persistent the backdoor.  I took it from one machine to another and it worked just fine with that compiled version and just one file.
So the new Netcat doesn't have a persistent listener, like the windows Netcat did.  In this version I had to do a while loop on the Netcat listener.  The reason I did this, is because the listener would listen to one inbound connection.  So if you had a connection to it, it would do everything.  If you dropped the connection it would stop the process and exit.  So I set in a do while loop so I could continue to connect to it.  Here we can see that Netcat listen on port 445, anytime you want to connect execute and then bash.
Then again ‑‑ then again here is the Netcat backdoor on Linux.  You can use Wget and copy it, copy it into the user bin so its in path, setup the Ip first tables.  The critical thing you want to know about the listener, we want to disconnect the command line user from the process.  So when they exit their terminal and go and do something else, and log into a different machine, we still get to that process and that process is not owned by that user.
So I was trying to think of a good way to hide the Netcat to start on boot.  I think the best place I could find was the D process.  There is a bunch of scrypts ‑‑ scrypts in there, the start up scrypts.  I look at my RC files.  If you put it in there it is more than likely to be discovered.  Yet again, use Netcat the version IP address, port, and you connect to it.  With the Linux version it is a little different than the windows version.  You're not going to get the actual command prompt that you're used to.  You're going to get a blank screen that will have a cursor in it.  You do have a connection to the batch shell, if you type LS or something like that.  You will see the command output, but not the standard Linux terminal.  This is critical, because you connect to it and think that something is wrong with it because I'm not seeing the batch prompt.  In this version of Netcat, when I was connected it, I did not see a batch prompt, so something to look out for.
So if we want, so now that we have everything installed and setup, we kind of what to verify it is working.  We have everything that we need.  So I use net stat‑LPTUN.  That matches processes to listening ports.  So here I can see that Netcat is listening on 445 and accepting connections from any IP address.  Or it is listening on all available ‑‑ IP addresses.
So now we've got connectivity, and same thing with it windows box.  Now our Linux pranks, right, this is the cool pro scrypt that I found.  If they are using Linux as their main desktop and they browse, you can put this in line, basically it takes every image that they brows to and turns it up side down.  Pretty awesome.  We have a Linux fork bomb.  We can take the system to a crawl.  We can write to the user terminal.  If the system is local.  This is annoying.  You can cat random data to the computer bell sound.  Right?  So they are connected, everything is going fine, and just a bunch of garbage and noise comes coming out of their computer.  Pretty funny.
Then, so this is a cool little prank.  This turns everything in the terminal to ‑‑ bork bork.  It is all formatted the way it is supposed to do, but everything is just bork, bork, bork, bork, bork.
So okay.  This has been a classic prank at my work.  My boss did this to me on my first day.  So you send star wars to their terminal.  They are typing along and configure the system.  You log‑in and tell them towel blinking lights .NL and find the process, their PTS instance that they're connected to and they cannot do anything with that terminal except watch "Star Wars."  It is really annoying.  Because you don't own the process either.  It is constantly sending stuff to your terminal.  Pretty funny.  Another cool thing you can do, you can said fortunes to the user terminal and use C matrix, which is a matrix screen to their Linux terminal.  They are supposed to be able to type and do stuff.  But you can still see the output.  but its just clears and refreshes everything.  It is pretty funny.
This is kind of cool.  You can play with the man bell, you know that annoying bell that goes off all of the time when you hit mistake or try to tab something that is not there.  Put that in a loop and have the go off randomly.  That is pretty bad.
This, again, going over nohup so ‑‑ it is kind of what you want to do, if you forget he nohup, this is easily, you start the command and like, crap, I didn't know it is still used, the process is still being ran by the user, you can then do a control Z, background the process and the percent disown one, is kind of the equivalent of nohup, but nohup will work better.  I stop the process and it will run in the background and my terminal session can die.
These are PHP compilers.  If you write great pranks in PHP you can compile it.  Hide the the code from users and the other stuff.
Now, Netcat.  So at this point we built a backdoor into both windows and Linux.  We've got ways to get into it, but this is kind of, it is kind of rough, right?  We can only connect to it if we're on a local area network, it is not encrypted.  It is kind of dangerous to leave it open to everyone.  I don't want to open a firewall port on my firewall and access into it remotely.  That would be bad.  It is not encrypted.  So what else can we do with this?  Get past the firewall easily and get back to this Netcat?  So what we're going to do, we're going to hit up a persistent SSH tunnel.  So what we're going to do with the SSH tunnel we're going to have the go out ‑‑ to the target system and connect back to a server that we have somewhere on there, the virtual private server or whatever and then map a port locally, just kind of picture of how it works.  It will map a port locally on that machine to a port locally on a remote machine.  If they allow SSH out or a port out it will maintain the session connection outside to the firewall or past their firewall to your server and then you can log into your server and connect to that port on your server and it tunnels through the SSH connection and back to that user's ‑‑ the, the ‑‑ machine.  This is reverse SSH tunneling.  Here we use SSH F cap N dash R.  The R is the remote port.  And then we're saying hey we want to loop back on his machine 22 and then so what that is going to do, on my remote Linux service, is my VPS somewhere out in the internet it will put port 10,000 as listening port and then come back and map to SSH on this local machine here.  Here is a more detailed example.  I don't have to use 22.  So I have my Netcat port listening.  Right?  So I can just take this SSH instance and map it to my Netcat backdoor.  So at this point it is now bypassing their firewall I can connect to a Linux remote machine.  If I'm at my friend's house I can go home and mess with them.  Right?  I go home and log into my Linux VPS.  I connect to the port, come back and have access to the SSH instances.  You're probably wondering about passwords.  They have to enter the password and everything.  If you generate SSH keys, you can take the SSH key and put it on your remote server and allow it to come, allow that remote connection to just automatically authenticate itself.  So you can use SSH key gen and then do the SSH copy I D‑back to your remote server.  So now we can set up like a job, a scheduled task and have this ‑‑ SSH remote instance run automatically while we're not there.
So on Linux you can use autoSSH to make it persistent.  After they disconnect, the Internet is kind of buggy at times, it disconnects and auto reauthenticate the connection back to your server.  That's great in Linux.  You can do the same thing in windows.  There is a command line utility called plink, part of the putty library you can use to do remote reverse shells back to Linux systems.  You can use this to set up an SSH to reverse shell to your linux instances to your netcat persistence intance. i was trying to find the equivalent of auto-ssh for windows 7, My encrypted tunnel came close. but it has a setup, and a gooey and a system trace it is obvious it is installed.  You can make it portable, but go through a bunch of stuff.  That's on my list to do, to expand my presentation.
At that point we set up a backdoor using basic tools.  We have not done binary manipulation, we just have remote access to the system through, just basic admin tools.  Right?  So now I'm going to talk a little bit about Metasploit.  So it takes all of this, we had to do the prep work and get the tools in place.  It takes less of that and makes it a little bit more easy to manage.  So one of the key to Metasploit you need to understand vulnerabilities, exploits and payloads.  Vulnerabilities are places in which you can take advantage of something.  There is something wrong with something, or something not right.  So in this case, the kind of venerability they usually left their computer unlocked.  The exploit is what you do.  The exploiting is you installing stuff on their computer because you have access to it.  It payload in this case would be Netcat, which is on the system to gain access to it later.
So using it we're going to do the same thing, and set up a reverse shell.  So we startup the Metasploit consul, a great way to get metasploit training is through offensive.security- metasploit unleash, unfortunately I don't have time to develop over that.  Basically just getting the MSF console and then run the MS update and get all of the updates and stuff.  So now let's generate a binary payload instead of using Netcat.  So basically what we're going to do is create a binary that we can e‑mail and sent to somebody, when they execute it, it will start a reverse shell that we can connect to, like Netcat.  Here we're using MS payload with the windows reverse shell.  So that is the payload.  We're basically just going to use Metasploit payload library to generate our binary.  Here are the commands to do that.  The L command just shows all of the options available here.  In this case, I need to set up a listening port and a listening host.  So the IP address it will listen to, listen on, on our target machine and the port I want to connect to.  Here you can use MS payload is pretty cool.  You can use to it create raw payloads and payloads in C.  So you can kind of see how it works.
So here is the command that we're going to run.  MS payload, with use a windows shell, reverse TCP. we set the L-host we set the remote port .  So we created our David Hasselhoff EXE and e‑mail it to our victim, have it available other put it on their system.  I have this great Hasselhoff program you need to check out.  A cool command is file, file  lets you verify what type of file is on a Linux system.  So I run files to verify, yes this is a windows executable.  So we're going to hit this reverse shell to connect, we're going to give the user, we're going to have the come back and listen to our instance, right?  So at this point we need to set up a listener on Metasploit to listen to this instance.  We are going to start the MSF console and use the exploit multi handler, and set the L host and had L port.  At this point you're ready to listen for the connection, you send the binary to the user.  They execute it.  Here, you is the PS example they execute the binary and then here in metasploit, you sit here and listen for it to come in, now you have CMB command shell on their system.  Pretty cool.
This is a great way.  If you want to get into this stuff, this kind of like the best way to get the most out of your, your time and energy.  You can learn something cool really quickly and then move on to more advance things.
So ‑‑ I want to thank everybody for coming to my talk.  This is our code library that I'm building.  It has all of the codes that I have in the presentation, minus some stuff that I need to put in there.  Any time you have a great prank or something you want to, you know, share with the world, we're going to keep track with a bunch of Linux and windows pranks to send out to people.  If you build something or expand, I would love to have you contribute.  And then I also have intros to backdoors.com, which has the slide presentation, code library, and we'll ‑‑ do some other cool stuff with that.  This is another cool thing you can get to ‑‑ these are one line reverse shells.  If you setup your metasploit listener, you can run the command and have a connection come back to your listener.  If you are interested in VPSs and remote systems there are great places you can look for VPS.  The problem is, there is no one good VPS provider.  They are good for three or four months and then Peter out and then move onto another one.  So I kind of keep up on which ones are new, and what they allow me to do and what they don't.
Some interesting projects with the raspberry pie that is based on the remote SSH reserve tunnel and using python to create a backdoor.  All right.  Any questions?  Thank you.
[ Applause ]

"This text is being provided in a rough draft format.  Communication Access Realtime Translation (CART) is provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings."