NTSD Backdoor

Here is a pretty neat trick I learned sometime ago using NTSD (from my good friend @_MC_).  NTSD (Microsoft NT Symbolic Debugger) is a debugger that is packaged as part of Windows.  You can find ntsd.exe in your system32 directory.

This little trick works by setting up the victim machine as a server using the -server flag.  This allows the debugging server to be accessed by other debuggers:

It really doesn’t matter what port you use or what application you choose to “debug.”  Now on the remote machine connect to the server:

Now that we’re connected we can start issuing commands.

Leave a Reply

Your email address will not be published. Required fields are marked *