Lesson 49: Backdoor Maintaining Access Video Lecture | Ethical Hacking using Kali Linux (in English) - Software Development

hey guys welcome to the next tutorial of
ethical hacking and penetration testing
by Kali Linux so this is the
continuation of my previous tutorials so
I'll just good and give you a short
brief about what happened exactly
I used se toolkit to create a simple
payload for meter printer and I went
ahead and ran that through my old
computer so I would imagine being over
here that through some social
engineering or other stuff you have
inserted this into your target cup
person's computer and once you have that
in their system it is up and running and
now as you can see I type the sessions -
L and we have this session open and I
used session - I space we want to go and
get access to that so now you might be
think that we could do all the thing or
anything that we want through to command
prompt then why would we would need
meter per term the reason being that if
the person has told you in one of my
previous tutorials he's smart enough he
will straight away go into the task
manager and write like the payload
that's running and end the process tree
and it will get disconnected so the
first thing that we wouldn't be doing
over here East we would be migrating
process to something else so I will just
type migrate and we'll type help and as
you can see a process ID must be
specified and not a process name so we
need the process ID for our payload
that's running over here so that's good
and and video and since running the
calenus we don't know what is the
process ID of the payload running so
this wouldn't type help and see what all
things can we see can we do by using the
meterpreter we can go and manipulate the
x term which is quite an awesome feature
of this one so that the person even if
you have inflicted it's a big
organization and you have changed the
time dates for each and everything the
foreign Seng investigator will just be
confused and he will not even be able to
know what is actually happening over
there then we have the has dumb database
that will go ahead and dump all the
contents of the security access manager
that is our simple computer that means
for the windows it a windows has the Sam
database that Security Act
bounce manager or access manager is
something that stores each and every
password that you save in your computer
so has them will go ahead and spit out
all the passwords that you have along
with the username then we have get
system that will go ahead and gain
access to our local system that is we
only have the administrator access
system now but we will get the system
access that means we will be able to
edit and modify the system files then if
our computer has video webcam then we
can go ahead and get again a snapshot of
that and we can also go down record the
our targets audio chat and video chat
anything that we want and all of these
things then we can go ahead and get a
screen shot or we can go ahead and use
multiple desktops if we want we can
start a keystroke lock in key scan and
all of these things but this is these
are not things we are interested I'm
teaching you that later on the most
important thing there first is that we
need to secure our access into that
computer we need to go ahead and make
sure that the person does not go out and
kill our process so for that we would
need to go ahead and migrate and before
we migrate we need to know which PID to
migrate which process to migrate to so
let's go and check it needs a process ID
name that to be specified so we will
first go and check the process ID that
means we need to first get the process
ID for our payload that's running so
that we could go to migrate so let's go
and check the words the command prompt
for taking all the process that's
running so let's check ok search upload
networking commands get proxy net start
and I have config IP config port forward
Ralph now we don't want any of these
things we just okay and get PID and yes
that's what we are looking for let's so
let's go ahead and check get PID three
eight eight zero that's the PID of our
current session let's check what we get
over here
and the payload so properties we want to
check the PRT for each one that's good
and check so we have all of these things
get desktop idle time that's not good
interested in she'll get UID of the
service running no ok PS so we will go
ahead and select PS and see all the
processes that's running so for payload
let's check the PID and the PPID we are
mostly interested in PID so that would
be three eight eight zero so let's check
if we could go ahead and use my grade
three eight eight zero okay so okay that
was an error from my end and what I did
I needed to migrate to explore dot exe
that is three two six eight so I'll type
my crate and I'll type three two six
eight now hit enter let's see if we are
able to migrate to the Explorer dot exe
perfect so what I did over here is that
I went ahead and transferred myself to
the Explorer dot exe so as you can see
we do not have any payload running over
here it's only the Explorer dot exe and
the reason because the I emerged the
payload along with explorer.exe and now
the person only if he goes ahead and
tries to end the process or is products
only then he will be able to go ahead
and treat and as you can see even if you
delete the payload exe it doesn't matter
to us because we still have our meetup
little running even after that even
after the person deleted the payload AB
the reason being that I we have migrated
our payload to explore Oh dot exe and he
cannot go ahead and throw us out anytime
sooner so now once we have migrated we
need to make sure that even if they come
even if the person goes ahead and
restarts his computer we would still be
able to go ahead and run our system so
there are two different ways for that
the first thing is that we go and copy
this payload to a startup folder over
here and make it on every time and the
second one is that we create a virus so
that
the it turns every time system starts it
starts with the boot sector so the thing
that I would be teaching right now is to
go ahead and copy this to our startup
file so we have this payload over here
in the user share se T and we need to
copy it to our let's say so it's under
they have Microsoft roaming windows nvm
variability so I have the location of
that in an ism but it is in mind where
it is exactly so I need to copy that
over here so that it will run every time
I go ahead and run this