1. ]Hacking Team[ RCS Remote Control System DEMO PROCEDURES

2. Before starting... A clean PC to be infected The USB key with the backdoor installer A connection to internet A PC with the RCSConsole installed To start a demo you need:

3. Installation Turn off the victim PC Insert the USB key into the PC Turn on the PC and boot from USB Follow the wizard to install the backdoor Reboot the PC

4. Capturing data On the infected PC do the following: - Open notepad and write some words in English or any Unicode language - Open a "sensitive" office document from an external USB Key (es: secrets.doc) - Simulate an "on file" printing of another sensitive document - Make a Skype Call to a contact or to a mobile phone - Send some IM message to a Skype contact - Copy a password from a file using the clipboard - Open some website using IExplorer or firefox - In the meantime the first synchronization (every 3 minutes) should arrive

5. Viewing Data Install Adobe AIR on a PC Install the RCSConsole on the same PC Launch the console and connect to: https://rcs-demo.hackingteam.it:4443 Use the username and password provided Remember that every new installation (different pc or user) will create a new instance of the backdoor, so look for it when viewing logs

6. Viewing Data Show the captured data: Keylogger FileCapture Screen Capture Print Capture Voip calls IM messages Clipboard Web URL

7. Deleting Data Login into the console Select the backdoor instance Press the button “del” (top right) The backdoor and all its logs are deleted

8. Uninstallation Turn off the victim PC Insert the USB key into the PC Turn on the PC and boot from USB Follow the wizard to uninstall the backdoor Reboot the PC