In this lecture I want to show you another backdoor delivery method and this method.
We're going to wait for our target to download an executable and we will backdoor this executable as
it's being downloaded.
So when they run their executable they will get the file that they're expecting.
But at the same time a backdoor will run at the background given us full access to their computer.
The only limitation to this is you need to be the man in the middle.
It doesn't matter how you managed to achieve this position but you need to be able to intercept connections
so you can backdoor the downloads on the fly.
Now to do this we're going to be using a tool called backdoor factory proxy.
I already installed this tool for you in the Custom Image that I made for this course.
So all we have to do is go to our Kelly machine right here and navigate to the location where I installed
it to navigate to a specific location.
You can either just click in here and press the forward slash from your keyboard to open the path bar
or you can press control and El from your keyboard again to open the path bar.
Once this is open we need to go to the path where this tool is installed and it's installed in all Piti
B.
The F proxy in here.
You have the actual executable of the program and you have the configuration file.
So I'm going to double click the configuration file to change the config and the main thing that you
want to change in here is the proxy mode which we have right here.
It will be set to regular by default.
And you want to change that to transparent.
The next thing that we want to modify is the IP of my current computer because like I said this tool
will backdoor every file the target downloads.
So we need to tell this tool my IP so that when the backdoor gets executed on the target computer it
knows where to connect to.
So you can get your IP by running if config as I showed you before.
I've already done this and I know my IP is 10 0 to 15.
So I'm going to look for where it says windows in here.
This is the configuration for the Linux targets.
If you're targeting Linux then you also want to modify the IP here but I'm only going to be targeting
Windows.
So I'm going to look to where it says windows.
As you can see in here and I'm going to change the host to my IP which is 10 0 to 15 and I'm also going
to scroll down to change it for Windows 64.
And again in here you want to set it to 10 zero to 15.
And we're good to go.
So I'm going to control as to save and control q to quit and we are ready to use the tool.
So keep in mind the tool is installed in OPEC with the F proxy and the program that runs the tool is
this file right here BD f proxy dot P Y.
Therefore we're going to go to our terminal.
We're going to navigate to where the tool is installed.
So we're going to do c d o p t BD f proxy.
Gonna hit enter.
And if I do a quick ELAs you'll see we have the program file in here.
And because you see this in green it means it's an executable so we can run it by doing dot forward
slash followed by the file name which is BD of proxy dot P Y.
I'm going to hit enter and this will run with no errors.
So it's perfect.
So this program right now is running on its own.
And as soon as it receives a request for an E XY it's going to backdoor that executable.
But the way it is right now it's not going to receive any requests.
Therefore we need to redirect requests to it to do that.
We need to first become the man in the middle.
And like I said you can do this using a R P spoofing you can do it by using a fake access point and
targeting the clients that connect you or you can use this tool whenever you manage to become the man
in the middle.
Regardless of how you manage to do this I'm going to do it with a R P spoofing because it's the easiest.
So we're going to use Buttercup exactly the same way that we've been using it before.
So we're giving it the interface which is 88 0 and then I'm giving it my ERP spoofing couplet so that
it puts me in the middle of the connections allowing me to intercept data and modify it on the fly.
So I'm going to hit enter this one with no issues.
So it's perfect.
So now I'm intercepting the data any time this Windows machine right here which is the target tries
to download something it's going to be intercepted in here in better cap but BGF proxy is still not
able to see that there is a download because these are two separate programs.
So what we want to do is we need to link all the data that this program sees to this program right here
and to do that we're going to use a firewall that comes pre installed in most Linux systems called IP
tables and using IP tables we can specify rules that packets have to follow.
So I'm going to clear my screen here and I'm going to use IP tables to modify a table called knot and
append a pre routing rule that will apply for TGP packets that's going to add destination port 80 and
we want to redirect this to port 1880 where we have BD f proxy running and waiting to backdoor the downloads
so very simple command.
We're using a program called IP tables to modify a table called not Morgana append a pre routing rule
that will apply for DCP packets.
That's going to destination port 80 and we're going to redirect them to Port 1880 where we have this
program BDA proxy running waiting to backdoor our files for me.
So I'm going to hit enter and a misspelled port in here.
There's an R and this runs with no errors.
So that's perfect.
So now we're using better cap to intercept data.
All this data is going to be redirected using this rule to be IDF proxy which will wait and see if there
is an X being downloaded it will backdoor it and then serve it back to the target when the target executes
the X. It will execute a backdoor that will send the connection back to me.
So all I have to do right now here is to listen for income and connections and you can do this using
the multi handler as I showed you before or if you're lazy.
You can actually use the resource file that the backdoor factory creates for us.
So this file right here will automatically start the multi handler and listen for income and connections
for all of the payloads that we sow in the configuration file of BDA of proxy to run this.
All we have to do is first of all run MSF console as usual and we're gonna say I want to give you a
resource file and then give it the full path for this resource file.
Now keep in mind this file was created by BD proxy that is stored in O.P. TBD a proxy.
Therefore the location of this file is going to be in OPEC with the EFF proxy followed by the file name.
So if I hit enter now MSF console will run and it'll load all the code that is stored in the resource
file which will automatically start the multi handler and configure it with the eyepiece that we specified
when we configured BD f proxy.
So now everything is running and we are ready to go.
So let's go to the target computer and let's keep it simple when testing.
So I'm going to try to download something from a hash TTP Web site.
So we're gonna go to speed bit dot com and we're just going to click on Download.
This will actually download the DAP which I showed you how to hijack its updates you would get a normal
download we're gonna save it to our downloads.
This will automatically go to downloads so I have that already open in here.
As you can see it has an actual proper icon for the program.
This is the normal icon that you'll get if you download speed.
And if you double click it and run it it's just an executable you will actually get the normal installer.
So if this was an actual person then you want to really get suspicious because they're installing the
program that they wanted.
But what they don't know is this program got backdoor it on the fly as it was being downloaded.
So if we go back to our Candy Machine you'll see that meta exploit is saying that there is a new session
opened.
So all I have to do now is press enter on my keyboard then I'm going to do sessions L to list all of
the available sessions.
And as you can see we have a new session in here and to enter into this session to interact with it
I'm going to do sessions I followed by the idea of this session which is number one and I'm inside my
meter prettier session right now inside the target computer.
So to verify this I'm going to do this info.
And as you can see inside the M.S. edge right now and I can control this machine and do anything the
normal user can do on their computer.
And like I said I will show you how to control this computer remotely in the post exploitation section.
But for now we have full access to that computer and we managed to do this by backdoor in a file that
the normal user requested to download as that file was being downloaded.