]Hacking Team[ RCS Remote Control System DEMO PROCEDURES

Before starting... A clean PC to be infected The USB key with the backdoor installer A connection to internet A PC with the RCSConsole installed To start a demo you need:

Installation Turn off the victim PC Insert the USB key into the PC Turn on the PC and boot from USB Follow the wizard to install the backdoor Reboot the PC

Capturing data On the infected PC do the following: - Open notepad and write some words in English or any Unicode language - Open a "sensitive" office document from an external USB Key (es: secrets.doc) - Simulate an "on file" printing of another sensitive document - Make a Skype Call to a contact or to a mobile phone - Send some IM message to a Skype contact - Copy a password from a file using the clipboard - Open some website using IExplorer or firefox - In the meantime the first synchronization (every 3 minutes) should arrive

Viewing Data Install Adobe AIR on a PC Install the RCSConsole on the same PC Launch the console and connect to: Use the username and password provided Remember that every new installation (different pc or user) will create a new instance of the backdoor, so look for it when viewing logs

Viewing Data Show the captured data: Keylogger FileCapture Screen Capture Print Capture Voip calls IM messages Clipboard Web URL

Deleting Data Login into the console Select the backdoor instance Press the button “del” (top right) The backdoor and all its logs are deleted

Uninstallation Turn off the victim PC Insert the USB key into the PC Turn on the PC and boot from USB Follow the wizard to uninstall the backdoor Reboot the PC