Shell Shoveling Using Socket Programming

This research aims to modify the existing shell shoveling technique to gain persistent control over a target's windows system without the knowledge of the compromised user. A .exe file is executed on the target system, which initiates a connection with the server system using socket programming, giving it full control over the target system's command line. In the conventional shell shoveling technique, the connection would've been broken had the target either deleted the file or restarted his/her system. To overcome the former issue, we made sure that a separate copy of our .exe file is made in the AppData folder during the first execution of the .exe file. For the latter issue, a registry entry is made at ‘HKCU\Software\Microsoft\Windows\CurrentVersion\Run’ so the file would automatically get executed every time the system is started.