Previously we learned how to create an undetectable backdoor which is great but we delivered this backdoor
by simply downloading it at the target computer.
Now this will probably not work in real life.
Your target will never just download an executable and run it.
If you ask them to do that.
Therefore in this lecture I want to show you a smarter delivery method where we will spoof an update.
So when a specific program at the target computer checks for updates it will say that there is an update
and when they install that update they will actually be installing a backdoor.
The only limitation to this method is you need to be the man in the middle.
It doesn't matter how but you need to be able to intercept the connections so you can do this using
a piece spoofing or using a fake access point.
As I showed you before or using any other method that'll allow you to intercept the connections usually
programs have a specific domain that they use to check for updates.
So let's say we have the user here that has a specific program it wants to update something it'll send
a request to a specific domain and let's say this domain.
In this case it's update server dot com.
This will be sent to the DNS server.
The DNS server will respond with the IP of the Update server which we have right here and then the user
will send a direct request to the update server looking for updates.
If there are updates then the updates server will respond with the updates.
Now if we are the man in the middle if we're able to intercept all the requests and the responses then
when we get a request for updates server dot com instead of given the IP of the updates server we can
actually give the IP of a hacker server.
The server is running a special program called evil grade and evil great will tell the user that yes
there is an update and instead of serving them an actual update it'll serve them a backdoor so when
the user agrees to install this update we'll actually be installing a backdoor on their system let's
do this practically and it'll become even clearer.
Right here I have my Kelly machine.
This is the custom image that I made for this course.
Therefore it has evil grade pre installed in it.
So first we'll need to navigate to the location where it's installed.
We're going to use the C D command to do that and it is installed in o Petey evil grade and then to
run the binary the program itself.
We're going to do the forward slash eval grade
now using evil grade is very simple and very similar to me to exploit.
So to get a list of all the programs that we can hijack their updates we're gonna do show modules and
as you can see you have a lot of famous programs such as when zip VM where Skype safari and so on.
Now we're going to be doing this on a program called DAB download accelerator plus.
So we have it here so to configure a specific module all we have to do is just type configure module
name which is DAP so you can replace stuff with any module that you want to configure with any program
that you want to hijack.
So I'm going to hit enter.
And as you can see it's seen.
Now I'm inside the DART module and I'm going to do show options to see all of the options that I can
set.
So as you can see we get a list of all the options that we can set.
And the main option that we want to change is the agent.
This is the path to the program that will be installed as an update.
So in our case we're gonna be replacing this with the backdoor that we created in the previous lecture.
So to change this option we're going to do said agent the option name to the location where I have my
backdoor and my backdoor is in var w w w hasty M0 backdoor.
Do it.
E E so as you can see the format of change in options is very similar to Buttercup admits Floyd.
We do set followed by the option that we want to change followed by the value.
So I'm going to hit enter and that's done.
The next thing that I want to modify is the end site which is the Web site that will be loaded once
the update is successful.
Now I know this will return not found error.
That's why I'm going to change it.
You don't have to change it with every module.
So again to change this we're just going to do said and site and I'm just going to sell it to the.
Just the basic domain which is Pete with dot com and finally before we run everything I'm going to do
show options one last time to make sure that everything is set as I want it.
So I have the agent said to var W WW hasty AML backdoor dirty exit.
That's perfect.
And I have the inside set to the way I wanted.
So I'm ready to go.
And all we need to do now is just type start to start eval grade.
So right now if eval grade gets a request for an update it will say yes there is an update and it will
serve the backdoor dirty XP as the update.
The only problem is it will never get any requests right now because I am not intercepting connections.
I'm still not the man in the middle.
Therefore we're going to become the man in the middle using Buttercup.
Like I said you can use any method you want to become the man in the middle but we're just going to
do with using AARP spoofing right now.
So I'm gonna use better cap using the exact same command that we've been using before.
So we're just doing better cap given at the interface connected to the network and given it this poof
couplet so that it runs in our piece spoofing attack putting me in the middle of the connections I'm
going to hit enter and this all run with no errors.
So that's perfect.
We also need to use better cap to run a DNS spoofing attack and spoof and you request to update that
speed with dot com.
This is the domain that the target program uses to check for updates and we want to spoof DNS requests
to this.
So they return the IP of the Kelly machine right here which is running evil grade.
So evil grade gives them the fake update.
Now I covered how to do DNS spoofing in details and a full lecture before.
So if you don't remember how this works.
Please go back and revise this lecture because I'm going to do it a little bit quickly right now.
So I'm going to copy this domain and I'm going to clear the screen here and we're going to set the DNS
spoof all too true and we'll also set the DNS prove the DOT domains to the domain that we want to spoof.
Finally we're going to start the DNS pilfered by doing DNS spoof on and perfect.
Now it's working and it's telling us that it's going to spoof a new request to update that speed with
dot com to the IP of my Kelly machine.
The IP of my Kelly machine is really an evil grade.
It will grade will say yes there is a new update and it'll serve them the backdoor that we have right
here.
And that way the back door will be automatically executed on the target computer.
The only problem is the backdoor will get executed.
But we're not listening for income and connections here so we won't really get access.
Therefore we need to listen for income and connections using me to exploit as I showed you before.
Now I've already configured my multi handler again I covered this in detail so if you don't remember
how to do it.
Please go back to that lecture.
Right now I'm just going to do show options to show you the options that I set right here and you can
see that I am using a Windows meter operator reverse hash TPP here because I'm actually using a different
backdoor in my evil grade.
This backdoor right here it's not very very safe TTP as as shown in previous lectures.
It's actually a reverse hash TTP backdoor because for some reason I noticed the TTP s back doors are
not working with evil grade.
That's why I created a reverse hash TTP backdoor specifically for this lecture so set in my payload
to the same payload that's used in my backdoor I'm set in my IP and here I'm setting the airport to
80 80 so everything is perfect.
I'm going to run exploit to listen for income and connections.
And now we're ready to go.
So now let's go over this one more time.
When we go to the target computer and check for updates.
Right now this computer is intercepting connections because of buttercup and it's also gonna spoof a
new request for updated speed with dot com to this IP.
This is the IP where evil grade is working.
Evil grade is gonna say yes there is a new update the update is this executable the target's computer
will take this executable it will run it because it thinks it's an update when this gets executed it
will send a connection to us in here in our multi handler.
So let's go to the target's computer and see if this will actually work as we expected.
So I've already downloaded download accelerator plus the program that we're trying to hijack.
It's updates and installed it.
So I'm just gonna double click it to start the program.
Now it's just asking me to set it as the default download manager.
I'm going to say no and I'm going to go to help and I'm going to click on update.
Now we're going to say yes check for updates please.
I'm just going to uncheck this click on Next is checking for updates now and it's telling us that there
is a new update.
So we're going to say next.
And it's telling us right here it's a critical update.
So I'll be like Yeah I want to install this.
This will download the update for me and install it and it still notes that it's done everything is
done we're going to say next.
Thank you very much.
And finish now if we go back to the Kelly machine you can see we got a reverse connection here from
the target just to confirm this.
We can do this info to see more information and perfect as you can see we're inside the target computer.
And now we have full access to that computer and can do whatever the normal user can do on their system.
Now I will talk more about post exploitation and how to control the computer using this matter operator
access in the post exploitation section.
But right now we managed to hack into a computer using a fake update.