Understanding Blind Backdoors and Command Execution

What You Learned

1. What Is a Blind Backdoor?

   • A blind backdoor is a way to control a remote system, but without direct feedback from the commands you run. You won’t see the results unless you explicitly request or create output (like files).

2. How It Works:

   • The attacker sets up a listener to interact with the backdoor.

   • Commands are sent to the remote system, but responses are not visible unless captured or logged.

3. Why This Is Important:

   • Blind backdoors are harder to detect because they don't communicate much back to the attacker.

   • They demonstrate the importance of monitoring system activity for unusual files or network behavior.

Commands Used and Their Purpose

1. Start the Backdoor:

   • ./cron.sh

     • Initiates the backdoor, which listens for incoming commands on a specified port (e.g., port 4444).

2. Connect to the Backdoor:

   • nc [IP_ADDRESS] [PORT] (e.g., nc 192.168.111.135 4444)

     • Connects to the system running the backdoor.

3. Send Commands to the System:

   • ls: Lists the files in the current directory to understand what’s available.

   • pwd: Prints the current working directory (location on the system).

   • mkdir hacked: Creates a new directory named "hacked" as proof of access.

   • touch hacked: Creates an empty file named "hacked."

4. Receive Feedback:

   • Output is not visible immediately. The attacker can later check for changes on the target system by listing directories or viewing file contents.

Key Takeaways

1. Blind Backdoor Behavior:

   • Unlike interactive backdoors, blind backdoors don’t show instant results. You must verify actions indirectly (e.g., by creating or listing files).

2. Commands to Check Impact:

   • Use commands like ls to confirm the changes you’ve made (e.g., a new file or folder).

   • Be methodical to avoid mistakes since you can’t see real-time feedback.

3. Defensive Measures:

   • Monitor for unexpected network activity (e.g., a system listening on unusual ports like 4444).

   • Regularly audit files and directories for suspicious changes.

   • Check for hidden scripts (e.g., cron.sh) and remove unauthorized ones.

Key Idea

Blind backdoors show the importance of proactively monitoring your systems. They demonstrate how attackers can remain undetected by minimizing communication and relying on stealth. To protect your system, always keep an eye on unusual file activity, unexpected processes, and open network ports!