Updated: Apr 22
A backdoor is a file that gives us full control over the machine that it gets executed on.
A backdoor is used to bypass security mechanisms, often secretly and mostly undetectably, it's possible to create a backdoor that connects back to the attacker by using reverse shell TCP.
Creating a undetectable reverse backdoor is very simple and convenient using Veil framework
Veil is a tool designed to generate metasploit payloads that bypass common anti-virus solutions.
Veil is current under support by @ChrisTruncer
Getting started with Veil:
Let’s fire up Veil. Be warned, mine took up 830MB of hard drive space and took hours to install because of the numerous required dependencies; don’t do it near bedtime
For installing Veil in Kali Linux you just have to use two commands
#apt-get install veil
Now, we are going to generate Veil using the backdoor. First, we are going to run the list command, then we will type the use 1 command, as we want to use Evasion. Now press Enter
As we want to use the 15th payload that is go/meterpreter/rev_https.py, so we will run the use 15 command, as follows:
Now we are going to change the payload's IP LHOST to the IP address of the Kali machine and set the LPORT also
We have to run the ifconfig command, to get the IP address of Kali machine.
IP of Kali machine is 10.0.2.15, which is where we want the target computer's connection to return to once the backdoor has been executed.
To ensure our backdoor can bypass AVG, we need to modify the minimum number of processor used by it. In this case, it is set to 1.
Now we are going to use the generate command to generate the backdoor, as shown as follows:
Now we are going to name our backdoor as rev_https__8082. The following screenshot illustrates what we see once a backdoor is generated. This includes the modules used by the backdoor, and where it is stored
To test our backdoor, we are going to bypass Veil's checkvt command, which is not always accurate, and VirusTotal, which shares its results with antivirus software, and instead opt for the website NoDistribute . Now, we are going to click on Browse... and navigate to our file at /usr/share/veil-output/compiled
Once we have clicked Scan File, we can that the file we uploaded has successfully bypassed all antivirus programs,
Now if this backdoor will be executed in any target machine so that will give us full control over that machine, this was most simplest way of creating a backdoor after that we can try to deliver this backdoor in smarter way like in form of updates and if the backdoor file is executed so we can listen for connections, The backdoor which we created uses a reverse payload. To work the reverse payload, we need to open a port in our Kali machine so that the target machine can connect to it. When we created the backdoor, we set the port to 8082, so we need to open 8082 port on our Kali machine.
To test our backdoor, we can browse the executable location of the backdoor and can download it from there ,