Instructor: In this lecture I'd like to show you 2 2
how to combine the backdoor that we created before 3 3
with any other file type, 4 4
so that, when executed, 5 5
it'll display an image, 6 6
a PDF, 7 7
a song, 8 8
or something that the target person is interested in. 9 9
This way, you'll be able to social-engineer them 10 10
to run your backdoor 11 11
and they'll see something that they trust, 12 12
but at the same time, 13 13
your backdoor will run in the background. 14 14
We're gonna do this using a "download and execute script" 15 15
which will basically download the backdoor, 16 16
download the file that the person expects, 17 17
run the file that the person expects 18 18
and run the backdoor in the background. 19 19
I'm gonna include the download and execute script 20 20
in the resources, 21 21
but I already have it downloaded here. 22 22
So, you can literally just double-click this 23 23
and you'll see the code used inside the script. 24 24
I programmed this in a way, 25 25
so that you can use it to download and execute 26 26
anything and any number of files. 27 27
So, all you have to do, 28 28
is literally put the links or the URLs for the files in here 29 29
and separate them by a comma. 30 30
So, you can out URL-comma, URL-comma and keep going. 31 31
So, you can use this to download and execute 32 32
two executable, three executable, 33 33
or any number of files you want. 34 34
So, I'm gonna delete everything here 35 35
and I'm gonna put the file 36 36
that I want the target person to see. 37 37
Now, this file needs to be available online 38 38
and uploaded on a direct link 39 39
so it can be downloaded form that link. 40 40
For this example, I'm gonna use an image, 41 41
but you can use any other file type. 42 42
You can get them to open a PDF 43 43
or anything else that you want. 44 44
So, I'm just gonna go on my browser 45 45
and I'm gonna go on Google Images 46 46
and just look for an image. 47 47
And I'm gonna look for a car. 48 48
I'm gonna take the car image 49 49
and I'm gonna click on "view image" here. 50 50
And notice when I do that, we get the image itself 51 51
through a direct URL right here. 52 52
So, you can see the end of the URL is dot GPG 53 53
and when we access the image, 54 54
you'll see that there is no ads around it, nothing, no HTML. 55 55
All you see is just the file itself. 56 56
So, the files included in that script, 57 57
all have to have a direct URL. 58 58
So, I'm gonna copy all of this 59 59
and I'm gonna paste it in here as the first URL. 60 60
Now, this is done. 61 61
The next file that I wanted to be downloaded and executed 62 62
is gonna be my backdoor. 63 63
So, I'm gonna put a comma 64 64
and then I'm gonna put a direct URL for my backdoor. 65 65
And as we've seen before, that's toward at HTTP, 66 66
10, 20, 67 67
14 to 13, 68 68
evil files, rev HTTP, S-A-T-A-T dot EXE. 69 69
Now, just to go over this point again. 70 70
If I copy this URL 71 71
and paste it in my browser, 72 72
you'll see that I can download this, 73 73
I can access the backdoor and download it, 74 74
without seeing any HTML, 75 75
without seeing any timer or download-page. 76 76
Literally, if I paste that URL in there, 77 77
I can access the file and download it directly. 78 78
You can see that there's no pages loaded, nothing. 79 79
If I put the URL, I can download the file. 80 80
This is very, very important. 81 81
The script will not work if you don't use direct URLs. 82 82
So, as you can see, 83 83
the script is very simple. 84 84
All we had to do is, put he URL for the first file 85 85
and then we put a comma, 86 86
which is very, very important, again. 87 87
So, you have to separate the URLs by a comma. 88 88
And then we put the URL for the second file. 89 89
And like I said, if you want to download more files, 90 90
if you wanna download more backdoor or more evil-files, 91 91
all you have to do is just put another comma 92 92
and put the next URL. 93 93
Now, this is not a programming course, 94 94
so I'm not gonna explain how I program the script, 95 95
it's very simple. 96 96
Basically, all it's gonna do is, 97 97
it's gonna download these files 98 98
and then execute them. 99 99
And I have the download function in here. 100 100
Now, everything is ready for me. 101 101
I'm gonna save this and close it. 102 102
I'm just gonna go back to my downloads to see the script. 103 103
And now, all we have to do, 104 104
is compile the script to an "executable". 105 105
And I'm gonna show you how to do that in the next lecture.