[voidaslan]

In the 5th lecture under the Windows Malware – Generate Undetectable Backdoors module, I’m instructed to type my Linux Machine’s IP (eth0) into the browser on the Windows Machine.

Issue: After I put the IP in the Windows Machine browser, the browser does not load the “Apache2 Debian Default Page” as shown in the lecture. It’s unable to.

What am I doing wrong?

Appreciate the help, thank you.

[Diego Pérez]

Hi!
What are you getting instead? Is it a meesage like “It works :)”? if you do then everything is ok, if you don’t then can you show the results of:

ifconfig and route -n in kali
ipconfig in windows
Can you share a screenshot of the Network settings used in VirtualBox for both machines?

Thanks!
Diego

[voidaslan]

Diego, you’re a genius!

I neglected to set the Windows Machine Network Adapter to NetNetwork…my bad.

It works now, so, thank you; but I ran into another issue. If you don’t mind, I could use your advice.

The goal of the lecture was to test the Backdoor. Upon downloading it on my Windows Machine (both in Chrome and Microsoft Edge), both browsers flagged and deleted the file.

I tried testing the Backdoor using the No Distribute website–to see if scanners would detected it–but the website does not work anymore; ergo, I’m unable to test if the Backdoor was configured properly.

What can I do to make the Backdoor “safe” when it is downloaded on a browser via my Windows Machine?

I hope I articulated that well. Again, thank you for taking the time, brother.

[Diego Pérez]

Hi!
The very first step is to know if the backdoor works, then you can deal with AV evasion. To test it disable virus & threats real-time protection, if it works then you can try to modify it to bypass AVs.

Basically bypassing AV programs is like a game of cat and mouse, so backdoors might start getting detected at some stage, then the developers release an update, this will allow you to generate undetectable backdoors, then AV programs release an update which will make backdoors detectable ……..
So the main thing is to make sure that Veil or any other tool you’re using to generate the backdoor is up to date.​​
Here’s a few solutions to try if your backdoor is getting detected:
1. Make sure that you have the latest version of Veil, so do ​updated ​before doing ​use 1.
​2. Experiment with different payloads, and experiment with different payload options and you should be able to bypass it.​
3. Try generating a backdoor using the fat rat, empire (tutorial link for empire in the resources of lecture 68).
4. Modify backdoor code if its in bat (covered in my social engineering course.
5. Modify backdoor using a hex editor (covered in my social engineering course).
6. Create your own backdoor (covered in my python course).
The best thing to do is look at the last lecture of the course (bonus lecture) it contains all the courses that you can take with this course and a comparison between them.

Also check out this video:

How To Create Fully Undetectable Backdoors

Greetings!
Diego

[voidaslan]

Wow, Diego, dude, thank you so much for the literal list of info. I appreciate you taking the time. Truly.

If I could ask one final question, and I hope I’m not abusing your generosity…

What’s the best way to hack a social media account?

I started this Pen Testing journey on a bet. My cousin bet me I couldn’t get into his Snap in a week…Long story short, he was right and I was $200 short. But it all lead me to Zaid, you and ZSecurity. My point: I’ve bought 4 courses so far from you guys since you clearly provide quality content and I’m wondering if one of them specifically provides information on how to access a social media account, or, if it’s not too much trouble, I could ask you to tell point me in the right direction/provide a few steps.

Thanks again for taking the time, man. Your advice is golden, so, please, keep it comin!

[Diego Pérez]

Hi!
First of all I want to piont out that we are learning all of these to become Ethical Hackers, not to do evil things. But when getting credentials is needed for the job then doing some phishing attack is the best way to do it, or dumping a keylogger in victim machine can also be very useful.
So gathering information about the victim is essential, then you can do any of the attacks mentioned in the course. Those are just general ideas on what you can do so you have to make the proper adjustments so it fits your specific scenario. Also let me tell you that a week is not enough to do it like a professional hacker, this take time, patience, practice and lots of researching hours.

Greetings!
Diego

[voidaslan]

Lol, yes, I quickly realized that a week is nowhere near as long enough to learn something that others have made their passion/livelihood. It’s a little insulting of me to assume so, in fact; so, I apologize. I’m learning to appreciate what you and those in your field do with every lecture I watch from you guys’ courses.

I will try a phishing attack and keylogger, as soon as I learn what those are, exactly. Lol.

Sorry if I implied that I would do this behind his back. My cousin lives with me and Ethical Hacking is something we decided to pick up during quarantine together. Been trying to get him to learn from ZSecurity’s courses but he’s adamant about going somewhere else, for some strange reason. We both know our information (Snap, email, address, etc…cause we live together) and we have each others’ permission to hack one another for practice.

I will try to learn as much as possible about phishing attacks and keyloggers from the lectures, thank you, Diego. Hopefully he doesn’t get into my Snap before I get into his, or else I’m down another $100. Haha!

I remember Zaid saying that it’s boring to learn all this stuff if you don’t have something practical to use it on, so I’m trying to do that with this little Snapchat challenge. I think it’ll motivate me to keep going.

I’ll stop rambling and get started on phishing attacks. Thanks again, man, I appreciate you taking the time. If you have any other pieces of advise you wanna share I’m all ears/thank you.

Cheers.

[Diego Pérez]

Hi!
Ok, that’s great. I also have to mention that hacking into social media accounts would not always be part of a job as ethical hacker, it’s good to know some techniques but I wouldn’t recommend to focuson that other than to complete your challenge. Also check tryhackme.com and hackthebox.eu where you’ll be able to practice more, tryhackme is a good option when you are a beginner because it’s more like a walkthrough, hackthe box is a bit more challenging because there you’ll have to read and research a lot as you would do in a real pentest, keep in mind that the machines are vulnerable in pourpose so it’s more like a game but it will help to sharp your skills and patience haha.

Greetings!
Diego

[voidaslan]

Lol, yeah, you guys do a great job with the “skills” part, so that’s covered, but the “patience” part is what’s kicking my ass. Haha!

It’s crazy to think that Ethical Hacking goes way beyond the scope of social media. That basic stuff is really challenging for me, yet, to most, it’s close to being their first step…A little discouraging, not gonna lie. Lol.

Thank you so much for sharing those resources. I’ll likely try tryhackme.com before hackthebox.eu, since it sounds like it’s more beginner-friendly. So, thank you.

My cousin managed to get into my Snap the other day. Don’t even know how he did it, to be honest…Your boy just lost $100. (sad face)

You’ve been so generous with your feedback/help, Diego, so I’ll understand if you don’t wanna answer yet another question. BUT, if you’re willing, I would love to get your input.

Question: I’m working through the Create An Undetectable Backdoor videos in the lecture and Youtube video you were kind enough to share. I’m at the part where we use antiscan.me to see if the backdoor is detected by antivirus programs. I managed to get it past 9 out of 26 antivirus programs by modifying the SLEEP and PROCESSORS portion of the Backdoor several times/by inputting different values. Not great but I’m on the right track. What else can I adjust that will help me make the Backdoor undetectable by the remaining 17 antivirus scans on antiscan.me?

Really appreciate your advice, Diego, it’s helping me improve faster than I normally would, thank you. I’m likely too impatient to follow it thoroughly, in all honesty, because I want to hack my (smug) cousin’s Snapchat ASAP so I can be the smug douchebag for once. Haha!

Thank you again, brother, I appreciate it.

[Diego Pérez]

Hi!
Ethical hacking has more to do with enterprise network environments, web applications, applications in general, etc. So social media hacking is more of a black hat thing, as mentioned some ethical hacking jobs will require getting credentials but not necessarily from social media or hack into someone’s facebook, that’s is most of time out of the scope.

Yeah, changing settings directly in veil can help, let me tell you that just being detected by 9 AVs is a good number, but as you have seen Zaid modified some values in the script or in the executable (using a hexeditor) this will be more efficient while trying to bypass AVs but require more knowledge in order to avoid screwing up the code, but you’ll learn by trying things out and srewing it up haha. Also there were some recent attacks by some APTs that used undetectable backddors created with Golang and some other technologies, but the main ponit here is those hackers managed to create undetectable backdoors by coding them from the ground, that’s the best solution but it requires a very advanced coding knowledge and obfuscation techniques, so you can do it as well, it will just require time, patience and lot of reading.
Also your cousin might just guess your password, I mean both of you know well each other so it might not be difficult to guess passwords.

Greetings!
Diego

[Author]

Posts