If outcome in this section, we are going to create our Trojan.
So go and download this project culture light project and zip and put it in the folder.
Open it and you will see a few files copied from various projects, which we've done in this course,
one on the Far East Select Project.
Now it's Dark Texte.
And you say he will finally listen to those.
So we have a compound, basically.
Hoping it.
A compound that will compile our resources from the resources to RC.
And you will also convert the COMPAR resources address into an object resources Dawodu.
And then the Khaleesi will combine everything to output Harris bill, which is how our Trojan and it
will be Windows based because he wanted to implement stealthy cogen comes.
And this is the SARS-CoV-2 fur.
For the Trojan.
We also have Biden's script, which we used before.
So this Python script, you know, encrypt the shark.
And he will put the shark as a message box.
I see your father.
So a message for ICAO, who be the greatest shark?
And this is the sixty four which are good, in which we generated using Metasploit and which we used
before in some previous projects.
And this is the resources that Hadifa fund, which is needed for creating shellcode and that it in the
resource section in the defines, he constan my icon.
And this is the resource that RC file which is needed when you are embedding a Chakotay in the resource
section.
So, Elise, my icon resource, you ask the constant and also negotiated with the Sherkat farm, which
is MessageBox ICAO.
And finally, we come to the actual SARS-CoV-2 in the missile school for the Trojan.
So this far is a combination of various parts and pieces from all our previous lessons in this course.
An application entry point is over here in Maine, which is used to create a stealthy Trojan has snow
council.
And you say here you have few encryption key, which is used when we were creating a show code named
Encrypting I shall be a Python script.
So the pythons could be served.
So he uses the same key
one.
And then over here, these few lines here who find and retrieve the chocolate milk from the recession.
And yesterday, he allocates memory in the Trojan horse in order to unpack the shellcode who tracks
the chocolate from Rhesus?
RTL move memory is to copy the Chako appeal to the newly allocated memory.
And so our function is used in order to decrease the shock.
And here is the starting of the injection.
Could you search for an precess explorer?
Because we are injecting tasteful and returns to Pindy.
And if the is fun, you open the Explorer process.
And here is where you inject the Shankle.
Into this whole process.
On top here, a definition for the various functions we have to assume SLR for detecting the chocolate.
The search for process function, which is used for searching explorer in the memory.
And the Sherko Inject Funkin.
We should remotely allocate the space in memory, in Explorer and in to it, and then executing all
of these and adding new bits and pieces.
There has been taken from various projects and combined into here in order to meet our target objectives.
So now, before we can do the Drogin, we have to create the messagebox, I can't fire you and encrypting
it in Python.
So in order to create new python.
The open access for Netiv to someone from.
You get to this location, so we copy the part first.
And I see this space and right click it to paste it and enter into then you used Python two point seven
by typing the full path to the python to seven in Python.
And then you give the name of the Python script, which is called Encrypted Casula.
And in the name of the Sherko that you want to include, which is MessageBox been.
Now we enter and he will increase and produce an output file called MessageBox Tikhon.
So it is MessageBox I can't really use when we run the compound screen.
So now we run the compound script.
And he has finished compiling everything, including the resources and linki of the resource people,
OK, and created our executive bushfire response, Peter E.M.S..
Now you can double click list and run it.
You're supposed to inject into a ISPA process.
We can open our presents, hacker to money take.
So these are a slow process.
So that is that booking is.
And immediately he injects, quote, to explore the process and then execute the how to show the proper
messagebox.
To confirm that this is coming from Explorer, he can use this tool here.
Using grandniece to find window and track two.
Entropy here.
And then you can see it opens up and confirm the parent is exploring, I see the process one, three,
three, two, which is in this process.
As far as I see, one, three, three, two.
If you go to the memristor.
And scroll.
Look for the readable and executable memory.
It's cooling down.
The Berkeley.
Not this one.
For another one, literally without any markings.
This is the other one, apoclea.
And you can see this is how Chalco, which has been decrypted.
So this is how we can implement a region that has called Anketell billion in the resource section and
which is able to inject into explorer and security.
So that's all for this video.
Thank you for watching.