Hack Like a Pro: Creating a Virtually Undetectable Covert Channel with RECUB « Null Byte :: WonderHowTo

Welcome back, my budding hackers!We've spent a lot of time learning to compromise Windows systems, and we've successfullycompromised them with Metasploit,cracked their passwords, andhacked their Wi-Fi. However, very little time was spent developing ways to extract the information from the system once inside.Obviously, if we compromise a system, we're likely after some data inside. If so, we need a way to get the data out without being detected. On most systems, there is likely to be anIDSor IPS looking for malicious packets, both in and out. In addition, a vigilant security administrator will notice when a new port or service is open.Ideally, the best method of extracting data would be undetectable from the system admin or others so they can't close off our extraction path. As an exfiltration can often take hours, days, or weeks, we need a covert channel that can't be detected by the security devices or the security admin.How to Remain Undetected When Exfiltrating DataIn this tutorial, I will show you a tool calledRECUBthat will create a covert channel on a Windows or Linux system that is virtually undetectable by an intrusion detection system,nmap scanning, or even the operating system tools itself.A Quick Description of RECUBMicrosoft describes RECUB this wayon their website:"This threat is classified as a backdoor trojan. A backdoor trojan provides remote, usually surreptitious, access to affected systems. A backdoor trojan may be used to conduct distributed denial of service (DDoS) attacks, or it may be used to install additional trojans or other forms of malicious software.""For example, it might be used to install a downloader or dropper trojan, which may in turn install a proxy trojan used to relay spam or a keylogger trojan which monitors and sends keystrokes to remote attackers. It might also open ports on the affected system and thus potentially lead to further compromise by other attackers.""This threat is detected by the Microsoft antivirus engine. Technical details are not currently available."Step 1: Download RECUBYou can download RECUBhere. RECUB has a client/server architecture, so you will need to put the server on the target and the client on our attack system.Step 2: Install the RECUB Server on the Target SystemInstall it on the RECUB server by clicking on RecubSvr.The server will silently run in the background until it is awakened by the client activating it.Step 3: Install the RECUB Client on Your Attack SystemNow install the RecubClient.exe on the attack system and run it as administrator. It should have GUI interface like that below.Now, enter the IP address and port that you want RECUB to communicate on. I have used port 31337, but you can use any port. The password is 123 and can't be changed without recompiling RECUB, so let's not change it.Step 4: Send the Encrypted ICMPTo activate the server, RECUB uses an encrypted ICMP packet. Click on the "Send Act. Ping" button and it send the ping that activates the server on the target.The RECUB server will intercept the packet, decrypt it, and make a connection back to the client. This will open a command shell on the client system that gives you control of the target system!Better yet, we could use the HTTPS port 443, so to the security admin it will appear to normal HTTPS traffic.Step 5: Test Whether Snort Can Detect ItNow that we have a covert channel running between these systems, let's use an IDS likeSnortto see whether it can detect the traffic. Let's use Snort on ourKaliorBackTracksystem to sniff the traffic between these two machines and see if it triggers an alert.As you can see, this covert channel is totally invisible to Snort and does not trigger any alerts.Step 6: Test Whether Nmap Can Detect It on Open Port & ServiceNext, as our covert channel for exfiltration of data may need to be open for days or weeks, it's important that a vigilant security admin not be able to detect it.Some of the better and more vigilant security admins will do a periodic scan of open ports and services on their networks. In this way, they can see whether a system or network has been compromised.Inmany of our exploits, we have opened a communication channel between our control system and the victim system. If the sysadmin scans the system while this in place, they will see an unauthorized open port. This will lead to their action that will likely close that availability.Now, let's do an nmap scan of the system with the RECUB server and see whether we can detect the covert channel. In the below command,-sTscan for TCP ports,-sUscans for UDP ports, and-p0-65535tells nmap to scan all ports.nmap -sT -sU -p0-65535 10.59.27.89As you can see, nmap does not detect any unusual ports open on the system with the RECUB server.Step 7: Test Whether the RECUB Process Is VisibleThe RECUB covert channel is nearly undetectable, even by the operating system itself! One of the tools we have for viewing our running services is the Task Mananger. Let's open the Task Manager and see whether it shows the process RecubSvr.exe.As you can see, even the operating system itself can't detect the service!RECUB is one of the many tools that we place on the victim system that will enable us to control the victim system and remove the data that we are seeking. It is largely undetectable by the IDS, nmap, or the operating system itself. Some third-party tools can detect it, but most security admins will never look that deeply to detect a convert channel on the victim and all the while we can be quietly removing data without detection or interruption.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseHacker's eyeimage via ShutterstockRelatedHack Like a Pro:How to Create a Nearly Undetectable Covert Channel with TunnelshellHow To:Hack a Hard Drive into a Hidden Flash Drive, Cell Phone Charger & More!How To:Binge-Watch YouTube Videos on Android Like a True Couch PotatoHow To:Use multiple output channels in Soundtrack ProGalaxy S8 Oreo Update:Notification Channels Bring Granular Controls for AlertsHow To:Conduct a covert surveillance with audioNews:Does Face ID Work When Your iPhone 11, 11 Pro, or 11 Pro Max Is Flat on a Table?How To:Use Knoll Light Factory Pro After Effects pluginYouTube 101:How to Manage Your NotificationsHow to Hack Wi-Fi:Creating an Invisible Rogue Access Point to Siphon Off Data UndetectedHow To:Hack Lets You Fully Activate a Bootleg Copy of Windows 8 Pro for FreeHow To:You Can Easily Hack Instagram for a Crazy Amount of Likes (But You Totally Shouldn't)News:Here's How the Weather Channel Is Using Augmented Reality to Make Us All SaferHow To:Create an Undetectable Trojan Using a Domain NameHow To:Capture Unauthorized Users Trying to Bypass Your Windows 8 Lock ScreenHow To:Conduct a covert mobile surveillanceNews:Apple Just Released iOS 12.3 Public Beta 1 for iPhone, Includes Updated TV App with Subscription ChannelsHow To:Create a Multi-Channel Music Sequencer in MinecraftNews:Minecraft World's Weekly Workshop: Creating a Multi-Channel Music SequencerGoodnight Byte:Hack Our IRC Bot to Issue CommandsHow To:Fix the Channel -1 Glitch in Airodump on the Latest KernelNews:Achieve Results YouTube ChannelHow To:The Official Google+ Insider's Guide IndexNews:A Computer Game Inside MinecraftNews:Overhead Camera Boom Made with PVC PipeHow To:Remove Gamers Unite from your Facebook AccountGoodnight Byte:Coding an IRC Bot in Python (For Beginners)News:What does Pro Tools HD Native mean for you?Weekend Homework:How to Become a Null Byte Contributor (2/17/2012)How To:Draw Ferb of Disney Channel's Phineas and FerbHow To:Use straight alpha channels in Adobe Photoshop