Computer Hacking - Taking Full Remote Control in under 13 Seconds! Reverse Shell bypass Antivirus!
![[HA]rrison be[CKER]](http://yt3.ggpht.com/8AYzifybJiyudON0J-NJpU3bATMVSiHSKo9yjAh7c8A2MjPp1QHnh_6rTyHh5sBT7pRaS2ZKQQ=s48-c-k-c0x00ffffff-no-rj)
Vložit
- čas přidán 4. 01. 2021
- Tutorial Now Available!
Part 1: • Computer Hacking - How...
Like & SUBSCRIBE!!
#Hacking #Kali #KaliLinux #NetCat
In this video, I wrote my own code to program a DigiSpark using the Arduino IDE to take full remote control of a Windows 10 computer by making it automatically open a reverse shell with NetCat and an NGROK tunnel. Once the Windows computer was connected to my Kali Linux laptop, I was able to demonstrate that I had control by sending a command to hibernate. Devices like this are commonly known as a Rubber Ducky or Bad USB. Make sure to check out my tutorial to learn how you can do it too: • Computer Hacking - How...
that weird guy in the office hands you a usb:
Another reason to not plug any found USB devices!
Thanks for the video!
I created my own reverse shell at one time using Python and C#, I managed to get it working as WAN (with encryption) with port forwarding with a VPS I rented and remotely controlled my friend's computer (with his permission) which he lives hundreds of miles away. All of this was fun to do and it was a huge step for me in my own programming career. Note that I had this be an executable, all one person had to do was double click the file and their device would instantly connect to my VPS via attempting to connect to my open port every 5 seconds. All of this worked flawlessly with almost no bugs, however I did fix them though. The funny thing about this is that no anti-virus detects it.
Would you like to sell it ?
where did u learn python and C# skills like that from ?
well obviously no anti virus detected it lol
@@dudecool3259not the same script kiddie lmao
@@dudecool3259 In other words, would you like to sell me an application that allows me to hack illegally into other’s pcs
That was awesome! Glad i ran into your channel.
Very Nice, and very educational mate! Your v ideos are awesome
Bro good quality. I love your editing skills
Are you a bot? This was just some handheld footage and a few cuts.
@@danibot3000 no, no, no... you missed the edits, that's just how good he is.
Wait whaaaa?!
I have a better one with a one line defender bypass for that powershell session. No need to disable defender for the whole system. It patches a dll. One downside is the script is detected which means it can’t be stored, only typed live which is no problem for the rubber ducky. My experience with defender is that about a minute later it will warn you that your disabled. Which is fine for short bursts of payloads, not long term.
give?
pleaseeeeee give us :)
Link?
can you help me with kali
Can you help me
This is the power of a Usb rubber ducky 🐥
wait untill you see the 'omg cable' little boi uuuuuuuuuuuuuwwwwwwwwwwwwwuuuuuuuuuuu
Daaaamn this is friggin wild 😛 Job well done my man ! 👏
So, it plugs in, creates the connection and you unplug it? That's insanely simple, to a scary degree!
Does it work if the target pc is behind NAT?
Is the one on the left Dell latitude e6440 on the right?
Sweet More more great stuff 👍
This is amazing!
what about tamper protection? How does it bypass it?
How did you remove the 5 seconds timer?
How are you tunneling? Which tool? So it doesn't work just on the LAN
is it really hacking if you need to physically connect a usb to the target?
Wait so to bypass the bypass you just need a pin/password?!
And what if it is a domain computer with admin password ?
I don't suppose you can share with us. What will you use to make that happen
If ransomwre of windows defender is enabled the. Non of progam can run when ever any problem try to run window defender block it's access to system and give popup that unauthorised access block to xyz program and other thing without physical usb injection you are not able to do that
This reminds me of the time I was looking to download a google play store emulator and as soon as I clicked on install, my Windows Defender went out to lunch and everything, security wise, stopped working. Even the TPM. Windows said I didn't have the things necessary for the protection. So, I'm working on ways to fix it and solve the problem, then about 15 minutes later, my windows defender magically comes back online like nothing ever happened.
How can I detect and thwart attacks like this? I'm not sure if it was powershell, because at the time, not certified powershell scripts "couldn't" run on my pc...Great vid. So when do you launch your Udemy course and teach everyone else how to do it?
what if pc is slow? The time it loaded powershell is really fast and mustv'e been cached. Usually the powershell on these types of PC especially if not run before will take way longer to load. Is there any failsafe that if it is not loaded, it wont write it?
safest way is to make the delay in the code longer, preferably have 2 usb, one faster then the other
your work is very educative. Can you help with the script for the reverse shell
yeah u give him ur gf nur sis n ur mom..dont be a script kiddie.
😂@@bryanpaes6113
@@bryanpaes6113as someone who literally makes scripts, he's not a skid for just simply asking to have a script 🤷
@@bryanpaes6113that's how you do deals? Dude there are other ways to do such deals, why did you give ur mom and sis 😭
bruh even go net package can do it😂
You schould add "Windows+Ctrl+Shift+B" to your scrips...
What if the windows is signed-off or locked, or do you have to be signed in? Does the user need admin permissions who is signed in?
needs admin permissions and needs to be signed in. the usb only presses keys on the keyboard, nothing more. if youre not logged in it will mash all of those keybinds into the login screen doing nothing.
@@thirddroneThat's what I thought.
so you need a physical access to the computer, an admin permissions etc... what is the point of this ?
At least he edited the code he took off github. :D
you'd be surprised how often people just plug in usb's they find on the street
Imagine scattering a dozen of these things around a parking lot, going home, and waiting for curiosity to do the rest.
This is exactly how Stuxnet was delivered.
"What?! a terabyte storage of usb laying down the street. Oh goodies, i have now a present for my lil bro, but let me check for viruses first..."
The point is do not plug random flashdrive you found on the street, how come you can't understand that😂
can you provide the rubber ducky script here !!! the script you used
if there is a pswd why dont you set it up with hydra and rockyou.txt?
Can you provide a link to the documentation or something like that
its called go study pentesting
How to disable delay?
what's the code u use?
Where can I buy this bro?
for the digispark do you go about coding it with arduino?
Yes
what if powershell were to be disabled?
Will this work on win11?
Your usb stick is cute, but nothing beats a visual basic script attached to an excel file.
that's so cool! Lucky i found your youtube channel!
Good one, can you do it but with VNC please :)
how did you add the adapter to it?
its called a bad usb my guy you can build one cheap and the programming for all of it is on github
Are you sharing the code or no?
Pretty cool
Did you build that chip or whatever it is in your hand?
prolly bought it from arduino.
Is it kali or ubuntu??
Great video wow nice
How did you install ncat on the target? Because no ncat = no ncat conenction to your pc (If this was an actual attack you would have to assume that the target machine has no ncat installed yet)
The target is not required to have netcat installed, it connects to the attacker machine through a powershell payload (He showed how to include the payload in the arduino script in part 2 of the tutorial).
@@geekygymratPowerShell execution could be heavily restricted. This should prevent this, no?
@@Rosalies_ Many antivirus services instantly detected this payload as malicious (My Windows Defender didn't for some reason). A firewall is more than enough against reverse shell attacks imo.
I hear some one sad kali on physical machine is not very safe, is that true?
It's not true 🎉
How to get this script please?
Why port 444 and not 87 or 8080? Is there any difference between them?
You can use any ports. Port 8080 are usually used for proxies. Port 443 are used for ssl connections. You can use literally any port if doing a reverse connection
number's cooler
what? the netcat? just use port 6969 for better charm😂
Please make a full describing video please !!!
Is there any specific computer you use when it comes to hacking or websites?
It's very cool and all, but it still requires either that you or the user of the pc plugs in the USB. However, does this work if you disable all USB ports in device manager?
Well would be kinda concerning if someone could do it without making the victim download something or have a usb inserted lmao
@@Variant_Deltaor visit a website
still needs a few steps before this funny trick.. get into local network and there is some admim privileges issues. I assume its a local admin on the windows laptop
how to make one ?
I also have Usb but how to make my USB like yours sir !
Its not just a usb it acts like a mouse and keyboard
what a stupid comment
Github respository code???
Just to hibernate it? No critical needed
Link please?
WOW !
Tutorial video pls
All good but the big problem is this relies on having admin permissions without that it's already put a stop to this attack.
Incorrect, this works via opening a basic shell and you don't need admin to do that.
@@michaelepica3564 yes u need
@michaelepica3564 but you do need administrative privileges to disable windows defender.
@@paulmoore6052Theres ways to just bypass it
@@paulmoore6052 you are right but there is many github repositories for uacbypass
Puedes hacerlo con android
Joke's on you I'm using Temple OS
God bless you.
I can't help but notice that it doesn't seem like you actually say what you use to do this, or what's on the USB itself.
its a bad usb and all he is doing is creating a reverse shell this is kiddy shit
A Minecraft copy....take a fucking guess
was that rubber ducky ?
I just picked up my phone, and saw a notice "USB CONNECTOR CONNECTED".
My WIFI and Mobile Data were turned off, and I did not any computer or USB connected to my phone.
Somebody gained access / hacked my phone.
What can I do?
How can I prevent somebody from gaining access to my phone?
Get an iPhone
@@garysanchez576true, they still have bypasses tho. they get patched out really quickly.
Throw it in the sea
how do you make them usb stiks
Its not usb cuz windows would see it as virus its actually device that system detect as keyboard so in this way system cant detect viruses/script
can you make a tutorial ?
What is the purpose of having remote access anywhere in the world when you physically need to plug in a USB into an unsecured account.?
did it work if usb autorun is disabled?
itll only work if you execute the (possible) .vbs code
Hi can you show how you programmed the usb
github
Does it work,if user is not admin?
Does it work, if user logged off?
no its a rubber ducky so it will just type the same thing every time you plug it in. if the user is logged off you would need their password to create a new part to the script that logins. it works without admin tho
can u share the resources maybe?
The laptops are on the same network. Of course its easy to take full remote control within a few seconds. It's called you owning the devices, knowing the passwords and using RDP.
and if you are feeling extra hackerman to show off the terminal, throw some ssh connection 🤯🤯🤯😂😂😂
If you pay attention you'll hear him explain that he used tunneling/port forwarding in order to make this applicable over WAN, meaning it will work globally. This attack vector is absolutely applicable in many real-world scenarios. You'd be surprised how many people will leave their desktop logged in while they go to the other room to grab something from a printer or to get a cup of coffee.
@@GunsandGuitars69 The physical access to a logged on device is the pwn.. what you do after that stage is not the interesting part.
@@Luke-wz9wc right, people often seem to forget that physical access and social engineering are often major assets in a penetration test.
Hollywood level of hacking
Did you tell the code for this attack ...........
Can We control the victim's computer even after removing the USB???
Because I don't want to loose my USB
Yes you can he just executed code to tell the computer to connect to the kali machine he used a reverse shell payload which means target machine connects to attackers matching lol 😆 I have ways where you don’t need shell injection and python files that bypass the antivirus totally. It’s funny how he said he did it himself to bypass antivirus then turned it off. He actually could have gotten it to work with life threatening detection turned on as it doesn’t hate the shell code
@@ProCook703 Really thanks broo.... I appreciate that!!
@@ProCook703 Can you share it?
what is wrong with you people this is not funny.
@@mr_anone nothing
on the left thats one of the laptops i own
well well well. another skid has arrived on the internet. welcome :-7
Hey i have a question are those computer on the same network
Probably. But it doesnt matter you can port forward things with ngrok
probably right now but he's got tunneling to make it work over the internet
@@pratikmohite6202 uhh no just need to have something on his pc like netcat, the best thing you can do is leave a server listening out for a connection on the cloud, and you can manage it via a laptop, you need the computer to be on and waiting for that connection. you can also just leave usbs around the office someone will plug it up, if this happens to you, you should unplug the ethernet cable right away
Hey can i get in contact with you ? the team i work for got hacked and the hacker stole their discord is there anyway you can help or work with us
SE tool kit and find their email, its going to be strict social engineering which in my opinion isnt hacking
As someone who just earned the security+ cert, this is very cool!
just run one time or need the usb plugged for this method
I guess this would be a fun joke on your friend's computer. In a corporate world, people are told no USB from anyone, i.e. found in the parking lot or from yourself, ever. Newer models are without USB, networked only. Also, computers are locked CTRL-AL-DELETE when unattended, some have autolocks that activate after a short period needing a password to access. Tell me how many times I had to log back in during work... after timing out. Like someone else posted, intrusion alerts with a USB gets ADMIN attention. IT is more aware than they were 10 years ago.
Nevermind all that, users need admin credentials to perform elevated actions/commands.
In my work environment I can't even change background, it's just a terminal.
@@theskeletonboi
The same reason that the suggestion for decades has been to always use a guest account, assigning permissions through UAC if necessary for END USERS as well. Not me, I've lived dangerously on Admin accounts since the 90s. Though every single setup I've done for novices, I always make them standard account(s), disable remote access/assistance and tell them to tape their admin password to the monitor or side of computer (hackers don't come through the literal back door, generally).
There used to be some ports to disable, but I can't recall which ones... 1200 or something rings a bell.
Can you drop the tutorial?
So you can hack your discord friends ?
Just a side thign, it would've been slightly cooler if you showed how not even does it do what it does but it also has persistence
The point was for a quick shell persistence can come later
Hardly from the other side of the world ha k when u had to plug a usb in to it.
UAC is disabled 😐
Is there any way for them to be able to access the PC even if it's turned off?If yes how they do it
establish persistence you can use metasploit cause it sounds like you new
without physical access no
Computer Off > Hardware off > No internet connection > No remote access
No, physical isolation is always the best defense
If that's the case you just gotta make the only person that has access to stick the usb for you @@vision3972
Anywhere in the world eh? As long as you have someone plug that USB in for you 😆
How did you learn how to make this?
Wikihow...where tf do you think
This isn’t even really hacking. Yeah, if there’s no password and you have physical access to a machine, you can do pretty much anything you want. That’s the point of a password. I could just as easily open someone’s computer and “hack” them by deleting all their shit or encrypting their whole filesystem
I want to purchase the device. Please how much is it?
it's barely anything. like 10 bucks for 3. It's called a digispark
Kali Linux and fresh windows 8 install with tcp ports open on my local network (hacker god mode)
so you hack a machine in your local network
So you need to plug it onto someones computer first to control the other's pc?
Yeah of course lol do u even think before commenting
@@khj7937 Bro my message to my comment is that's so risky lmao.
Oh so to hack into the president's computer, I actually need to knock on the front door and ask them to let me in so I can plug in the USB adaptor?
@@MarkLikesCoffee860 That's what I'm trying to point hahaha.
@@MarkLikesCoffee860 what hes showcasing is a physical network, something like this you could do in public. if u want remot accses with no physical interaction, get an RAT software and figure out how to make its virus FUB
I have a Tamagotchi that does this
Please upload full setup video please
That’s not hacking! It’s just executing standard functionality the os offers. It would be impressive if the machine was locked and even more so if it was done from the attack host.
When you have physical access to a system, it’s very easy.