Instructor: Okay, so if we look at the backdoor 2 2
or the trojan that we generated so far, 3 3
we can see that it's very cool. 4 4
First of all, it has an icon that represents a file 5 5
that the target person is interested in. 6 6
When it's executed, it shows a normal file 7 7
that, again, the target person is interested in. 8 8
It shows an image or a PDF, 9 9
or anything that we want, really. 10 10
At the same time, 11 11
it's gonna execute our evil code in the background, 12 12
which will allow us to hack the target computer 13 13
or do whatever that we want. 14 14
The only problem with this file is, 15 15
if you look here at the end of the file, 16 16
you can see that it's .exe. 17 17
Now, in most cases, you probably want to see the .exe 18 18
because Windows would be configured to hide it. 19 19
But if it's not hiding it, 20 20
then it's obvious that this file is an executable 21 21
because it ends with a .exe. 22 22
What I wanna show you today is how to spoof this 23 23
and change this to something that corresponds to the file. 24 24
If we're trying to make our backdoor look like a PDF, 25 25
then you can make this look like a .pdf, 26 26
if we're trying to make the file look like an image, 27 27
then you wanna make this look like a .jpg or a .png, 28 28
or an extension that represents the image. 29 29
In our case, we're trying to make it look like an image, 30 30
so I'm gonna try to make this end with a .jpg. 31 31
To do that, we're gonna use 32 32
a right to left override character. 33 33
Before I show you how to do that, I'm just gonna rename this 34 34
and just literally copy the name. 35 35
I'm just gonna go on Rename, 36 36
copy everything here, 37 37
and I'm just gonna paste it in my text editor 38 38
so that when I'm modifying things, 39 39
it's clear to you what I'm doing. 40 40
Now, the first thing that I'm gonna do is 41 41
I'm just gonna type the new filename that I wanna use. 42 42
For the new filename, I'm not gonna use GTR image, 43 43
I'm just gonna use GTR. 44 44
This is, obviously, gonna have to be .exe. 45 45
Now, instead of this exe, 46 46
I, actually, want to have a .jpg. 47 47
But that's not possible because if I do that, 48 48
the file is not gonna be an executable. 49 49
To do this, I'm gonna try to get the text 50 50
to be read from right to left 51 51
using a right to left override character. 52 52
Because the text is gonna be read from right to left, 53 53
we're gonna type this extension after the filename, 54 54
but we're gonna spell it from right to left. 55 55
We're gonna spell it as G-P-J in here. 56 56
So, we're gonna put GPJ. 57 57
Again, this is just the extension that we want to use, 58 58
but we're spelling it from right to left. 59 59
We're spelling it G-P-J instead of JPG. 60 60
Now what I wanna do is 61 61
I wanna put a right to left character in here. 62 62
Basically, when I put that character in here, 63 63
the text, anything that comes in after that character, 64 64
will be read from right to left. 65 65
All this is gonna be flipped, 66 66
and, basically, the filename is gonna be called gtrexe., 67 67
and this is gonna be read from right to left, 68 68
so it's gonna be .jpg. 69 69
Let me do it, and you'll see what I mean by that. 70 70
To get that character, 71 71
we're gonna go on all applications here 72 72
and we're gonna look for characters. 73 73
You can see that it's already showing me 74 74
the right to left override here in the Recents, 75 75
but for you it won't show it. 76 76
So, you wanna go here on the search, 77 77
and you just wanna search for right to left override. 78 78
And you can see we have it in here. 79 79
If you click on it, 80 80
you'll just see a button 81 81
that'll allow you to copy that character. 82 82
I'm just gonna click on Copy, 83 83
and that'll, basically, just copy the character for me. 84 84
Now, I'm gonna come in here, 85 85
and, again, once I paste it in here, 86 86
anything that comes after that character 87 87
will be read from right to left. 88 88
So, we're gonna start in here, 89 89
and it's gonna be read as exe.jpg. 90 90
I'm gonna put the cursor here, 91 91
and I'm gonna paste, 92 92
and as you can see, now the filename is called gtrexe.jpg. 93 93
Now, again, I'm gonna remove the character. 94 94
Back to normal. 95 95
If I paste it, 96 96
everything is being read from right to left, 97 97
and the filename is gonna be called gtrexe.jpg. 98 98
Now, when you're using a filename like this, 99 99
in my case, it looks fine 100 100
because I'm already using a name of car which is called GTR. 101 101
If you send them to a person, they might think the exe 102 102
is just a special edition of this car. 103 103
If you are using this as a book or as something else, 104 104
you wanna think of a name that ends with ex. 105 105
For example, there's a lot of names, 106 106
so you can think of reflex, hex, sex, and so on. 107 107
Anything that ends up with an ex 108 108
will be a good name to use in here. 109 109
I have my name now. 110 110
I'm just gonna copy this. 111 111
Then I'm gonna rename this. 112 112
And that's it. 113 113
As you can see, now my file is called gtrexe.jpg. 114 114
Now, you can send this file the way it is to the target, 115 115
but I don't wanna send it like this 116 116
because some recent browsers 117 117
are removing the right to left override 118 118
when downloading the file. 119 119
What I'm gonna do is I'm gonna add this to an archive. 120 120
I'm gonna right-click it, and compress, 121 121
and we'll just add this to an archive called gtrjpg. 122 122
And we have our archive here. 123 123
This way, when the file is downloaded, 124 124
the browser will not replace the right to left override. 125 125
We're all done now. 126 126
I'm gonna copy this, 127 127
paste it in my evil files, 128 128
and then we're gonna go and download it 129 129
from the Windows machine. 130 130
Now, I'm, actually, already listening 131 131
for incoming connections here. 132 132
I've showed you how to do this before. 133 133
If you don't remember, please go back to that lecture. 134 134
I'm gonna go to the Windows machine, 135 135
I'm gonna go on my Firefox, 136 136
and we're gonna download the file, 137 137
which is at HTTP 10.20.14.213, 138 138
and the filename is gtrexe.zip. 139 139
I'm gonna save this. 140 140
And in here, in our downloads, we see the archive. 141 141
Now we're just gonna uncompress it here. 142 142
As you can see now, if you compare this file to this one, 143 143
you'll see that this one has an exe format, 144 144
this one has a .jpg format. 145 145
It has an image icon, 146 146
and if we double-click it, 147 147
it'll, actually, show us an image, as you can see. 148 148
But, at the same time, 149 149
it's gonna execute my backdoor in the background. 150 150
If I go to the Kali machine, 151 151
you'll see that I get a session from that computer. 152 152
And just to confirm this, I'm gonna do sysinfo. 153 153
As you can see, now I'm inside that computer 154 154
and I have full control over it. 155 155
We managed to do this using a file that looks 156 156
and functions exactly like an image. 157 157
And just like I said before, 158 158
this method can be used to make the file 159 159
look like any other file type, 160 160
so you don't have to make it look like an image. 161 161
You can use this method to make it look like a PDF, 162 162
a song, a video, or anything that you want at all. 163 163
You can use the download and execute payload 164 164
to combine the backdoor with any file, 165 165
and then use this method to change the file extension 166 166
to any file extension you want.