Hello everyone. In this video. We're going to be taking a look at
generating payloads with msf. Venom. Now, given
that we are delving into the exploitation phase. It
is very important to understand and to
know how to generate. Payloads are. Now in the context
of exploitation, payloads are essentially, the
piece of code that is executed on the target
after successful exploitation, right? So a
payload can do anything on the target. It can execute a
command, it can delete files. Yeah, you can. It can
It can download additional files under the system. In
this case. We're going to be taking a look at generating a meterpreter payload.
Now meterpreter essentially gives us a
remote access to the Target system and
will allow us to execute commands remotely on the target system.
Now, I'm not going to get into the meterpreter right now
because we are talking about generating, the meterpreter payload.
In the next video. We'll talk about encoding it, so
that we can bypass any antivirus when
we executing the particular.
Payload on the target, which is very important, especially when dealing
with Windows systems. So the tool we're
going to be the tool. We're going to be utilizing, is a tool
called MSS, Venom now, msf. Venom, it goes hand
in hand, with Metasploit in. If I just open up a terminal here
and I say msf Venom and I
hit enter, you can see it gives us a ton of options. But if we take a
look at the information given to us, you can
see that tells us this is a Metasploit Standalone payload generator,
so it's used to generate payloads that
Can then use the with the Metasploit console and I'll be getting into
that very shortly. All right. So this is
also a replacement for msf, payload and msf and
code, which is important. So, let me just give you a brief
history lesson into payload generation, especially
with Metasploit. So before we add msf, Venom,
we had two tools msf, payload, and
msf, and code, which by their names. You can pretty much tell what
they did. Msf. Payload was, uh, it was used to
generate payloads and msfn code was used.
Used to encode payloads to bypass, antivirus to
bypass antiviruses in general. And these two
tools were combined into one tool, which is what we have now. Msf, Venom.
Now, as I said, msf, Venom allows you to
generate payloads and when we talk about payloads, we
there are two key elements that come into play. Number one
is the type of connection. You're going to be establishing in
terms of the protocol. So you can see that we can generate reverse
TCP connections, and we can also generate
reverse HTTP connection so we can specify
The protocol to use. And then we're going also
going to take a look at the, the platform that
the various platforms that are available. And the great
thing about MSR Venom is you can generate payloads for
various platforms. You can generate a Windows payloads
right over here. You can generate Linux or Unix payloads.
You can generate a BSD payloads. So
on and so forth or Mac, OS payloads and
then where it gets even more interesting is the fact is
where you can actually start generating web payloads.
So what I'm going to do is, I'm just going to open up my browser here. And if I open
up google.com, and we search for msf, venom msf.
Venom and we search for
cheat sheet, right? And we'll just click on the first link
right over here. So we have some very helpful cheat sheets
that will actually list out to you all the various payloads that
you can generate and the commands that you can use to run them. And
these cheat sheets are really helpful because sometimes you
might want to check up on, you know, various payloads that
are targeted towards particular.
Um, platform. So again, if we just take a look at the examples on
the binaries, you can see that we can generate Linux reverse
shells or the Linux meterpreter virtual payload.
We can also generate a bind shell which is different to
a reversal with the reversal that the connection is
actually in coming to you or you are going to listen for the
connection from the target instead of making a connection to
the Target where firewalls can then
block the connection. So reverse shell is usually preferred. You
then have the windows meterpreter.
Reverse TCP show, which is right over here, you
then have the windows reverse TCP shell, which does
not use the meterpreter. We're not going to be using that. We
also have the windows and coded meterpreter Windows reversal,
which will be taking a look at in the next video. If the
nav Mac OS of you have the various Macos reversals right
over here, and then you have the web payload. So if I'm
running Apache and running PHP on a back
end on a server, I can then generate a
PHP payload, which can then be executed and
Then give us a reverse show. We have a s pyramid temperature
of stcp pay loads, which are used for Microsoft Windows
servers or Microsoft is service. And
the format is you can see is sp. All you also have
your JSP Java meterpreter reverse TCP payloads. So
on and so forth. You also have your various scripting payloads
based on python bash and
pearl. So there's a MSS Venom is really,
really robust. Now, let's get exactly to what
we're going to be doing. So we are going to be generating the
Toes meterpreter, reverse TCP show. And the the
two important elements that we need to specify are going to
be your L host and airport. And if you watched the earlier
video you remember that. These two also featured
within the Metasploit fundamentals video. In
this case. The L host is the listening IP address. And
that is going to be our IP address or the attackers IP address.
And this is the connection to which you want
your reverse shell to connect to. So you can
start executing commands and URL Port is the port.
That you want you want the target to connect to
on your local machine. So you
can see the command is fairly simple to run. We specify the
format as exe and we specify the
file name. So we're going to generate our first Windows meterpreter, reverse
TCP shell and doing. It is extremely simple.
All we need to do is open up our terminal and we say msf,
Venom, and I'll just clear my terminal so MSR. Venom
And then we specify our L host options, which is going to be my
Kali Linux IP address. So I'll open up a new
terminal and I'll just list out my IP address like
so, and you can see it's 10.0.0.0 5.
So enter that right now. So 10.0.0.0 five
and then we want to enter in the alport, right?
The airport is going to be the port that we want to listen on by default.
This is set to four, four, four, four. You can set
it to a port that is that is clandestine if
you want now.
We'll just leave it as it is is and then we specify
the format as exe and we can then output
this into a exe file. So we specify the
file name so I can just call this will
call this will just call this
payload. Don't you XE and hit enter right?
Now? This payload is extremely effective.
However, one problem that you'll come
across when dealing with Windows and windows, exploitation is
the fact that you will come across.
Antivirus software, which again are going to detect.
Payloads that are not encoded or obfuscated in
any sense. So again, we'll just give this a few seconds to generate
the payload. It shouldn't it shouldn't take too much time at all.
And once it's generated we can then use this
payload to gain remote access to a system. So we can either
download this payload on to the Target
system. Through social engineering, we can do it through a
web server. So on and so forth. We can also take a look at binding, it
to another exe. So that, again, you can
Use it in a form of a sphere fishing
social engineering attack. In this case. You can
see it's generated. It tells us no platform will selected and
no architectural selector. You can also specify the
architecture by going into the
windows option, right over here. So I can generate a 64-bit
payload so I can say x 64
and I can hit enter that's going to generate a
64-bit payload, which is very important. So what
I'll do is I'll just let that generate this.
This is the 32-bit payload and it gives you information regarding the
payload. The payload size, is the 341 B, and
the final size of the exe file is 73 80
to B. So again, we'll just wait for the
the 64-bit payload to generate. And
again, it's, of course, it's generated two of them. So, what I'll do
is I'll just general, just remove the payload .exe
right away, and generate the 32-bit one,
one more time. And in the next video,
we'll talk about encoding, the payload and will also preserve the
The original version so that when we're testing it out, I
can actually show you the that the antivirus detect it.
And again, we'll take a look at the differences between the
encoded payload and the non encoded payload. So
I'm just going to wait for this to complete generating after
which we'll move on to the next video where we are. This is the 32-bit
payload and we have it ready. And we can now move
on to the next video.