In this lesson,
I want to perform a quick demonstration to
show you how easy it is to create
and use a virus and remote access Trojan.
Now, before we begin, it's important to note
that I'm using an older, legacy style machine
for this demonstration
because these are known vulnerable Windows 7 machines
that I'm using inside of my lab environment.
Now, this is a great operating system to use
for these types of security demonstrations,
because they are vulnerable
and there are no longer any new security patches
for Windows 7 systems in existence.
So if you're trying to replicate this demonstration
on a more modern workstation like Windows 11 or Windows 10,
it will usually be detected and blocked
by your modern antivirus software like Windows Defender.
But there are newer tools that are being developed
by threat actors, attackers, and penetration testers
all the time that you can use.
Now, I've had many students ask
where they can download a tool like JPS Virus Maker
that I'm going to be using in this demo
and you can find these things online.
Now, because I did not create this tool
and I don't own the copyright to it,
I am not able to provide you a direct download link
for this tool or tell you where you
can actually go and download it.
Making a virus is not considered a testable item
for your exams, but I wanted to provide
this quick demonstration so you can see
what kind of things a virus and a Trojan can do
once they've compromised your targeted system.
Now, if you move into the world
of penetration testing later on in your career,
you'll learn all about the different tools that we use
in modern networks to be able to create viruses
and Trojans to be able to break
into corporate networks as part
of your penetration testing assessments and engagements.
Alright, let's jump into the demonstration.
So I have two machines set up here.
I have one on the left, which will be my attacker
and one on the right, which will be my victim.
On the attacker's machine,
I'm running a program called Virus Maker 3.0, or JPS.
Here is basically a point and click options
of all the things that I can do
to that machine on the right.
For our example, I'm going to do one
that's easy to see, it's called Crazy Mouse.
So I'll go ahead and click that
and then I'm going to select what do I want it
to be called after installation.
We'll go ahead and call it the service host.
And what do we want the server name to be called?
The file name, and I'm going to go ahead
and call it Explorer.exe.
You could really choose whatever you want.
It just depends on how sneaky you're trying to be.
Now, the next thing I'm going to do is
I'm going to create that virus.
At this point that has been created
and saved to my downloads folder.
Now at this point, I need my victim to be able
to download this virus, and there's lots of ways
to do that based on your social engineering,
tying this virus into another program,
using a spear phishing campaign,
putting it as a rogue download, all sorts of things.
For this particular example though,
I'm just going to show you the effect
if the person was able to download it
and if they ran it.
So at this point the user's been tricked,
they've downloaded the file and now they run it
because they think it's a game or whatever else it is.
In this case, they think it's a picture.
If we go ahead and run that, see what happens.
And there you can see the mouse just starts
going jumping all over the screen
so that if I wanted to try to open something
like the trash can I can't because every time I click on it,
it jumps away someplace else.
That's the idea of this very simple virus.
It's just a nuisance, it's trying to cause
a problem for them.
Now, let me show you an example
of what a remote access Trojan or RAT looks like.
Now, on the left is my attacking machine
and on the right is my victim machine.
So I'm using a program called ProRat.
So the first thing I want to do is create a ProRat server.
I'm going to click on General Settings
and from here you can see the port
it's going to operate on: 5110,
which I can change to anything I want.
The server password in this case, 12345.
Again, not very secure,
but for our lab purposes it's just fine.
And then the victim's name if we have it.
From here we can give them error messages,
we can melt the server on install
which means once the Pro Rat has
been installed on the victim computer,
it will delete itself while still maintaining a connection.
We can kill the antivirus and the firewall on start,
we can disable Security Center
and all sorts of other things like that.
I'm going to go ahead and give a fake error message
here saying "You have been hacked."
Now, normally you wouldn't want to send a message
to your user showing that they've been hacked,
but I just want to show it to you for demonstration purposes.
Maybe you're doing this as a ransomware
and you've encrypted their files.
This is a way to send them a message saying
"You need to pay me if you want access to it."
And from there we'll just go down
and we can go ahead and hit Create Server.
From there, the server is going to be created for us.
Go ahead and hit OK.
So if we want to be a little trickier,
we're going to go ahead and bind it with a file.
So we're going to select a picture,
in this case, the desert.
Go ahead and hit Open on that
and then we're going to give it another server extension here.
We want to call it EXE, SCR, COM, PIF or BAT.
EXE will be just fine and for the icon,
what do we want this to look like?
Well, we want it to look like a photo,
so we're going to go ahead and make it a JPEG.
And then we can go ahead and hit Create the Server.
And this is going to be in our current directory,
so if I look back in my current directory
I now have the binded server with a JPEG icon.
And from here we can go ahead
and rename it and let's call it "Desert".
So now they think they're getting a photo of the desert.
At this point, again, we would use some form
of trickery or social engineering to get it to them
and once we do, it'll be on their desktop.
So at this point I've tricked the user
and they now have the file.
They're going to go ahead and open that file,
and when they run that file,
you're going to see the error message that we told it to have.
There's the picture and "You have been hacked."
Uh-oh, now what's going on?
Let's go ahead onto our target machine
and connect to that server that's now been installed.
Again, we're going to use our password 12345,
and at this point we now have access to that machine.
We can find out information about it.
In this case, if we go ahead and get the system information,
I know now the computer name is Bob Sales.
I know what kind of machine it is,
it's using English for its language,
System32 is its path,
I find out what kind of users it has,
I find out the date and time of the machine,
all of that information.
And if I close this on the right,
that'll move out of the way.
We can get all that information here
from our attacking machine about our victim machine.
We can also look at the last 25 websites they visited
and maybe that would be something that would be helpful
for us to be able to attack.
We can take screenshots and we can actually open it
and see what we're going to see.
So if I do a screenshot, I see what's on their screen.
So if they're on a website like Google here
which is not going to connect
'cause I'm in a live environment here
that's disconnected from the machine,
I'll go ahead and hit Snapshot and now I can see that.
If they had a webcam, I could view their webcam.
Again, I have lots of access to do whatever it is
we want to do on this machine.
I can send them messages if I want,
so I can do a message and say Test.
And it'll say, "I don't work for you anymore",
so we're going to go ahead and send that over there.
And there it is.
"I'm sorry, I don't work for you anymore."
And so you can see the power of a remote access tool,
and so this allows me to do all sorts of different stuff.
Again, I can take their files,
I can mess with their registry,
I can go through and look at all their files,
I can FTP over and grab their files,
I can chat over to them.
I can do some funny stuff.
Maybe it's my friend and I'm just trying
to show them that I have access to their machine.
For instance, I can hide their desktop icons,
and now you should be able to see that that is gone.
And I can show their icons and they're back.
I can make the mouse go crazy and then I can fix it.
I can flip their screen upside down and then I can fix it.
So you can do all sorts of different things
on this machine and take control and do whatever it is
that we want because we have that remote access to them.
I hope you found this demonstration insightful
as you started to see what kind of effects a virus
or a remote access Trojan can have on a victimized system.